Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:126392
Precedence: bulk
MIME-Version: 1.0
Date: Thu, 13 Feb 2025 09:51:43 -0500
Message-ID: <CAKws9z2-e8YnGbdpp0BJvEBEiEsqHQMzyAo+Vee4naXy5mK40w@mail.gmail.com>
Subject: [PHP-DEV] Update OpenSSL Extension to Support KEMs
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000000d1d1f062e073320"
From: security@paragonie.com (Paragon Initiative Enterprises Security Team)

--0000000000000d1d1f062e073320
Content-Type: text/plain; charset="UTF-8"

OpenSSL 3 introduced a KEM API, which is an abstraction for the kinds of
cryptographic operations used by the NIST post-quantum cryptography
standards (i.e., FIPS-203).

KEM stands for "Key Encapsulation Mechanism". It's the preferred way to do
asymmetric cryptography. Even RSA-KEM is safer than how most people
experience RSA encryption.

The relevant functions are EVP_PKEY_encapsulate() and
EVP_PKEY_decapsulate().

https://github.com/openssl/openssl/blob/4b4333ffcc8e4ecbf5c70214769c77c7a1bb684f/crypto/evp/kem.c#L225

https://github.com/openssl/openssl/blob/4b4333ffcc8e4ecbf5c70214769c77c7a1bb684f/crypto/evp/kem.c#L262

Currently, these APIs only seem to support classical cryptography (ECC,
RSA), but that is one of the APIs that will enable post-quantum
cryptography for software using OpenSSL in the future.

We intend to send a pull request later this year to include PHP functions
in the OpenSSL extension that look like this:

function openssl_kem_encaps(OpenSSLAsymmetricKey $pk): array;
  // 0 -> shared secret (typically 32 bytes)
  // 1 -> KEM ciphertext for decaps
function openssl_kem_decaps(OpenSSLAsymmetricKey $sk, string
$kemCiphertext): string;
  // Returns a shared secret or throws an exception upon decryption failure.

I don't know if this change needs an RFC or not, but I wanted to start the
discussion just in case.

Security Team
Paragon Initiative Enterprises <https://paragonie.com/security>

--0000000000000d1d1f062e073320
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div class=3D"gmail_default" style=3D"font-family:mon=
ospace,monospace">OpenSSL 3 introduced a KEM API, which is an abstraction f=
or the kinds of cryptographic operations used by the NIST post-quantum cryp=
tography standards (i.e., FIPS-203).</div><div class=3D"gmail_default" styl=
e=3D"font-family:monospace,monospace"><br></div><div class=3D"gmail_default=
" style=3D"font-family:monospace,monospace">KEM stands for &quot;Key Encaps=
ulation Mechanism&quot;. It&#39;s the preferred way to do asymmetric crypto=
graphy. Even RSA-KEM is safer than how most people experience RSA encryptio=
n.</div><div><div class=3D"gmail_default" style=3D"font-family:monospace,mo=
nospace"><br></div><div class=3D"gmail_default" style=3D"font-family:monosp=
ace,monospace">The relevant functions are EVP_PKEY_encapsulate() and EVP_PK=
EY_decapsulate().</div><div class=3D"gmail_default" style=3D"font-family:mo=
nospace,monospace"><br></div><div class=3D"gmail_default" style=3D"font-fam=
ily:monospace,monospace"><a href=3D"https://github.com/openssl/openssl/blob=
/4b4333ffcc8e4ecbf5c70214769c77c7a1bb684f/crypto/evp/kem.c#L225" target=3D"=
_blank">https://github.com/openssl/openssl/blob/4b4333ffcc8e4ecbf5c70214769=
c77c7a1bb684f/crypto/evp/kem.c#L225</a></div><div class=3D"gmail_default" s=
tyle=3D"font-family:monospace,monospace"><br></div><div class=3D"gmail_defa=
ult" style=3D"font-family:monospace,monospace"><a href=3D"https://github.co=
m/openssl/openssl/blob/4b4333ffcc8e4ecbf5c70214769c77c7a1bb684f/crypto/evp/=
kem.c#L262" target=3D"_blank">https://github.com/openssl/openssl/blob/4b433=
3ffcc8e4ecbf5c70214769c77c7a1bb684f/crypto/evp/kem.c#L262</a></div><div cla=
ss=3D"gmail_default" style=3D"font-family:monospace,monospace"><br></div><d=
iv class=3D"gmail_default" style=3D"font-family:monospace,monospace">Curren=
tly, these APIs only seem to support classical cryptography (ECC, RSA), but=
 that is one of the APIs that will enable post-quantum cryptography for sof=
tware using OpenSSL in the future.</div></div><div class=3D"gmail_default" =
style=3D"font-family:monospace,monospace"><br></div><div class=3D"gmail_def=
ault" style=3D"font-family:monospace,monospace">We intend to send a pull re=
quest later this year to include PHP functions in the OpenSSL extension tha=
t look like this:</div><div class=3D"gmail_default" style=3D"font-family:mo=
nospace,monospace"><br></div><div class=3D"gmail_default" style=3D"font-fam=
ily:monospace,monospace">function openssl_kem_encaps(OpenSSLAsymmetricKey $=
pk): array;</div><div class=3D"gmail_default" style=3D"font-family:monospac=
e,monospace">=C2=A0 // 0 -&gt; shared secret (typically 32 bytes)</div><div=
 class=3D"gmail_default" style=3D"font-family:monospace,monospace">=C2=A0 /=
/ 1 -&gt; KEM ciphertext for decaps</div><div class=3D"gmail_default" style=
=3D"font-family:monospace,monospace">function openssl_kem_decaps(OpenSSLAsy=
mmetricKey $sk, string $kemCiphertext): string;</div><div class=3D"gmail_de=
fault" style=3D"font-family:monospace,monospace">=C2=A0 // Returns a shared=
 secret or throws an exception upon decryption failure.</div><div class=3D"=
gmail_default" style=3D"font-family:monospace,monospace"><br></div><div cla=
ss=3D"gmail_default" style=3D"font-family:monospace,monospace">I don&#39;t =
know if this change needs an RFC or not, but I wanted to start the discussi=
on just in case.</div><br clear=3D"all"></div><div><div dir=3D"ltr" class=
=3D"gmail_signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr">Se=
curity Team<div><a href=3D"https://paragonie.com/security" target=3D"_blank=
">Paragon Initiative Enterprises</a></div></div></div></div></div>

--0000000000000d1d1f062e073320--