Proper build flags for liboqs and oqs provider

[beldmit]

I build liboqs 0.10.0 + patch from open-quantum-safe/liboqs#1603 with flags
-DBUILD_SHARED_LIBS=ON -DOQS_USE_AES_OPENSSL=ON -DOQS_USE_AES_INSTRUCTIONS=OFF -DOQS_DIST_BUILD=ON -DOQS_ALGS_ENABLED=STD -DOQS_USE_SHA3_OPENSSL=ON -DOQS_DLOPEN_OPENSSL=ON -DCMAKE_BUILD_TYPE=Debug

and oqsprovider with flags
-DCMAKE_BUILD_TYPE=Debug -DOQS_KEM_ENCODERS=ON -LAH ..

After activating the provider I see the following KEM algorithms:

$ openssl list -key-exchange-algorithms
  { 1.2.840.113549.1.3.1, DH, dhKeyAgreement } @ default
  { 1.3.101.110, X25519 } @ default
  { 1.3.101.111, X448 } @ default
  ECDH @ default
  TLS1-PRF @ default
  HKDF @ default
  { 1.3.6.1.4.1.11591.4.11, id-scrypt, SCRYPT } @ default

When I list all algorithms, I see among others

Provided Key encapsulation:
  { 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default
  { 1.2.840.10045.2.1, EC, id-ecPublicKey } @ default
  { 1.3.101.110, X25519 } @ default
  { 1.3.101.111, X448 } @ default
  mlkem512 @ oqsprovider
  p256_mlkem512 @ oqsprovider
  x25519_mlkem512 @ oqsprovider
  mlkem768 @ oqsprovider
  p384_mlkem768 @ oqsprovider
  x448_mlkem768 @ oqsprovider
  x25519_mlkem768 @ oqsprovider
  p256_mlkem768 @ oqsprovider
  mlkem1024 @ oqsprovider
  p521_mlkem1024 @ oqsprovider
  p384_mlkem1024 @ oqsprovider

Previous versions of liboqs (0.9.x+0.5.3) enlisted Kyber among available Key Exchange Algorithms.

 $ openssl list -key-exchange-algorithms
{ 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default
  kyber512 @ oqsprovider
  p256_kyber512 @ oqsprovider
  x25519_kyber512 @ oqsprovider
  kyber768 @ oqsprovider
  p384_kyber768 @ oqsprovider
  x448_kyber768 @ oqsprovider
  x25519_kyber768 @ oqsprovider
  p256_kyber768 @ oqsprovider
  kyber1024 @ oqsprovider
  p521_kyber1024 @ oqsprovider

What are the relevant build options to make Kyber KEX re-enabled? As IANA has sort of standardized Kyber-based hybrid groups (https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8) and they are used by applications, it's useful to have them enabled at least for test purpose.

I see

OQS_ENABLE_KEM_KYBER:BOOL=ON
OQS_ENABLE_KEM_kyber_1024:BOOL=ON
OQS_ENABLE_KEM_kyber_512:BOOL=ON
OQS_ENABLE_KEM_kyber_768:BOOL=ON

in the liboqs build log, but it seems not to be of much help to specify this option in oqsprovider

[baentsch]

At first glance this has nothing to do with oqsprovider (it can not re-enable algs disabled in liboqs): By specifying "STD" during the liboqs build Kyber gets disabled: Rationale (there) is that ML-KEM now is standardized while Kyber is not. So I guess the most quick solution is to not use the STD filter any more but spec the exact list of algs wanted when building liboqs. The variable log output of Kyber algs as enabled puzzles me a bit though...

[beldmit]

@baentsch 2 questions if you don't mind

1. What is the proper way to enable both "old" kyber and "new" KEMs?
2. Why was Kyber IANA groups listed in -key-exchange-algorithms and ML-KEM - among -kem-algorithms?

[beldmit]

Looks like https://github.com/open-quantum-safe/liboqs/blob/main/.CMake/alg_support.cmake#L181-L184 makes impossible to add smth to the list if you specify the STD as selector

[baentsch]

What is the proper way to enable both "old" kyber and "new" KEMs?

I guess you mean how to enable Kyberxxx and ML-KEMxxx? If so, easiest would be to not use the STD selector but spec exactly those algs you want. But again, this is a liboqs question, really.

Why was Kyber IANA groups listed in -key-exchange-algorithms and ML-KEM - among -kem-algorithms?

That I don't understand: Are you talking about the openssl list command? There should be different output for -key-exchange-algorithms vs. -kem-algorithms (actually, no PQ algs should be reported for KEXs). Or is the question why which IDs have been chosen for ML-KEM vs. Kyber?

[beldmit]

1. Yes, sorry, you are correct.
2. Sorry again, I can't reproduce this behavior right now

 $ openssl list -key-exchange-algorithms
{ 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default
  kyber512 @ oqsprovider
  p256_kyber512 @ oqsprovider
  x25519_kyber512 @ oqsprovider
  kyber768 @ oqsprovider
  p384_kyber768 @ oqsprovider
  x448_kyber768 @ oqsprovider
  x25519_kyber768 @ oqsprovider
  p256_kyber768 @ oqsprovider
  kyber1024 @ oqsprovider
  p521_kyber1024 @ oqsprovider

[beldmit]

For my goals I added the following patch

diff -up liboqs-0.10.0/.CMake/alg_support.cmake.xxx liboqs-0.10.0/.CMake/alg_support.cmake
--- liboqs-0.10.0/.CMake/alg_support.cmake.xxx  2024-05-06 05:52:52.668502602 -0400
+++ liboqs-0.10.0/.CMake/alg_support.cmake      2024-05-06 05:57:03.715008552 -0400
@@ -182,6 +182,10 @@ elseif (${OQS_ALGS_ENABLED} STREQUAL "ST
 ##### OQS_COPY_FROM_UPSTREAM_FRAGMENT_LIST_STANDARDIZED_ALGS_START
        filter_algs("KEM_ml_kem_512;KEM_ml_kem_768;KEM_ml_kem_1024;SIG_ml_dsa_44;SIG_ml_dsa_65;SIG_ml_dsa_87;SIG_falcon_512;SIG_falcon_1024;SIG_falcon_padded_512;SIG_falcon_padded_1024;SIG_sphincs_sha2_128f_simple;SIG_sphincs_sha2_128s_simple;SIG_sphincs_sha2_192f_simple;SIG_sphincs_sha2_192s_simple;SIG_sphincs_sha2_256f_simple;SIG_sphincs_sha2_256s_simple;SIG_sphincs_shake_128f_simple;SIG_sphincs_shake_128s_simple;SIG_sphincs_shake_192f_simple;SIG_sphincs_shake_192s_simple;SIG_sphincs_shake_256f_simple;SIG_sphincs_shake_256s_simple")
 ##### OQS_COPY_FROM_UPSTREAM_FRAGMENT_LIST_STANDARDIZED_ALGS_END
+elseif (${OQS_ALGS_ENABLED} STREQUAL "STD_IANA")
+##### OQS_COPY_FROM_UPSTREAM_FRAGMENT_LIST_STANDARDIZED_ALGS_START
+       filter_algs("KEM_kyber_768;KEM_ml_kem_512;KEM_ml_kem_768;KEM_ml_kem_1024;SIG_ml_dsa_44;SIG_ml_dsa_65;SIG_ml_dsa_87;SIG_falcon_512;SIG_falcon_1024;SIG_falcon_padded_512;SIG_falcon_padded_1024;SIG_sphincs_sha2_128f_simple;SIG_sphincs_sha2_128s_simple;SIG_sphincs_sha2_192f_simple;SIG_sphincs_sha2_192s_simple;SIG_sphincs_sha2_256f_simple;SIG_sphincs_sha2_256s_simple;SIG_sphincs_shake_128f_simple;SIG_sphincs_shake_128s_simple;SIG_sphincs_shake_192f_simple;SIG_sphincs_shake_192s_simple;SIG_sphincs_shake_256f_simple;SIG_sphincs_shake_256s_simple")
+##### OQS_COPY_FROM_UPSTREAM_FRAGMENT_LIST_STANDARDIZED_ALGS_END
 elseif(${OQS_ALGS_ENABLED} STREQUAL "NIST_R4")
        filter_algs("KEM_classic_mceliece_348864;KEM_classic_mceliece_348864f;KEM_classic_mceliece_460896;KEM_classic_mceliece_460896f;KEM_classic_mceliece_6688128;KEM_classic_mceliece_6688128f;KEM_classic_mceliece_6960119;KEM_classic_mceliece_6960119f;KEM_classic_mceliece_8192128;KEM_classic_mceliece_8192128f;KEM_hqc_128;KEM_hqc_192;KEM_hqc_256;KEM_bike_l1;KEM_bike_l3;KEM_bike_l5")
 else()

Unfortunately, if you specify just STD, you can't add extra algorithms via other build options

[baentsch]

Unfortunately, if you specify just STD, you can't add extra algorithms via other build options

That arguably is a feature, not a bug. Tracking in open-quantum-safe/liboqs#1781.