 |
VOOZH | about |
| Git Clone URL: | https://aur.archlinux.org/oqsprovider.git (read-only, click to copy) |
|---|---|
| Package Base: | oqsprovider |
| Description: | OpenSSL 3 provider containing post-quantum algorithms |
| Upstream URL: | https://openquantumsafe.org/applications/tls.html#oqs-openssl-provider |
| Licenses: | MIT |
| Provides: | oqsprovider.so |
| Submitter: | iyanmv |
| Maintainer: | iyanmv |
| Last Packager: | iyanmv |
| Votes: | 6 |
| Popularity: | 0.000931 |
| First Submitted: | 2022-11-23 18:03 (UTC) |
| Last Updated: | 2025-12-24 16:44 (UTC) |
To use this provider you need to add it explicitly to /etc/ssl/openssl.cnf and activate it. Alternatively, add the -provider oqsprovider to all your openssl commands.
For example, to list all the signature algorithms use:
openssl list -signature-algorithms -provider oqsprovider
As oqsprovider generally requires the latest liboqs version, I suggest to change depends to "liboqs>=$_pkgverliboqs".
Works, forgot to reply. It sucks that my setup doesn't work for some websites. I can't build jitsi packages with it for example.
taba: I have removed the liboqs version from the depends array so that people building with AUR helpers or without clean chroot envs don't have issues. Please, give it a try.
Can't build without uninstalling previous version of liboqs.
For system-wide setup on both server and client, follow the printed instructions or https://github.com/open-quantum-safe/oqs-provider/blob/0ec51eca39d72867f309878f5bb9002f1c3e07fb/USAGE.md but respectively set
[tls_system_default]
Groups = x25519_kyber768:p384_kyber768:x25519:secp256r1:x448:secp521r1:secp384r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
or
[system_default_sect]
Groups = x25519_kyber768:p384_kyber768:x25519:secp256r1:x448:secp521r1:secp384r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
Relevant links: https://discuss.privacyguides.net/t/quantum-computing-and-harvest-now-decrypt-later-hype/18380/2, https://github.com/open-quantum-safe/oqs-provider/blob/0ec51eca39d72867f309878f5bb9002f1c3e07fb/USAGE.md, https://blog.aegrel.ee/kyber-nginx.html. I got the default Groups list from the following testing commands.
Testing:
Following should use X25519Kyber768Draft00 or whatever you set
curl https://crypto.cloudflare.com/cdn-cgi/trace
openssl s_client -trace crypto.cloudflare.com:443 </dev/null 2>&1 | grep NamedGroup
Following should use something old
openssl s_client -trace archlinux.org:443 </dev/null 2>&1 | grep NamedGroup
To use this provider you need to add it explicitly to /etc/ssl/openssl.cnf and activate it. Alternatively, add the -provider oqsprovider to all your openssl commands.
For example, to list all the signature algorithms use:
openssl list -signature-algorithms -provider oqsprovider