Dont get Server Temp Key in openssl s_client when testing

[majodu]

Describe the bug
Following the instructions on https://test.openquantumsafe.org/ I should find a Server Temp Key field underneath Peer signature type in the output of the openssl s_client command. After running it however, there is no Server Temp Key listed even though running the same command checking for a standard non-pqc algorithm works fine. The command otherwise completes successfully and you are able to GET / the webpage.

To Reproduce
Steps to reproduce the behavior:
After running docker run -v pwd:/ca -it openquantumsafe/curl:latest openssl s_client --connect test.openquantumsafe.org:6109 -CAfile /ca/CA.crt -groups kyber768 -security_debug_verbose -msg -trace -tls1_3
Testing with 0.9.2 image results in the same error

You will see:
Security callback: Supported Curve=UNDEF, security bits=192: yes
extension_type=supported_groups(10), length=4
UNKNOWN (572) extension_type=key_share(51), length=1092 NamedGroup: UNKNOWN (572) with 572 or 0x23C as the default id for kyber768

Expected behavior
What I expect to be there is equivalent output to running the command with a X25519 curve
Security callback: Supported Curve=X25519, security bits=128: yes
Server Temp Key: X25519, 253 bits
NamedGroup: ecdh_x25519 (29)

Environment:

• OS: openquantumsafe/curl:latest
• OpenSSL version: OpenSSL 3.3.0-dev3
• oqsprovider version: 0.5.4-dev

[baentsch]

Thanks, @majodu for reporting this bug. The documentation at the test server indeed is not in sync with the implementation: This information had been output in oqs-openssl111 (forked code) but is not output when using openssl3 (mainstream code). This however is no issue for oqsprovider but for upstream openssl or rather the documentation in the sample integration underlying the test server. Hence transferring this issue to that project.

[baentsch]

@bhess -- are you following issues in this project? Would you want to do something about this issue in the test server (documentation) or shall we close?

[bhess]

Thanks for tagging me. I'll review the documentation on the test server.

[baentsch]

@bhess You may want to update the documentation in light of openssl/openssl#25959 which brings this feature to openssl master (no backport) -- so please sync with @ajbozarth as to what code version is being put into the docker images referenced in the documentation.