Skip to content

Commit 815a606

Browse files
Merge pull request #5021 from wso2/hwupathum-patch-2
Update post-quantum TLS configuration documentation
2 parents cd4a584 + e9e6550 commit 815a606

File tree

1 file changed

+18
-0
lines changed

1 file changed

+18
-0
lines changed

en/includes/deploy/security/configure-post-quantum-tls.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
# Configure Post-Quantum TLS
22

3+
{% if is_version == "7.0.0" %}
4+
To overcome the quantum threat on traditional cryptographic techniques, WSO2 Identity Server integrates post-quantum cryptography with the current traditional methods. Specifically, it adopts the [X25519+Kyber](https://datatracker.ietf.org/doc/draft-tls-westerbaan-xyber768d00/) key agreement algorithm for inbound TLS communications, ensuring robust protection against quantum threats. To configure TLS with post-quantum security, WSO2 Identity Server should be configured to utilize OpenSSL 3.x as the JSSE provider, along with [liboqs](https://openquantumsafe.org/liboqs/) library to support post-quantum algorithms.
5+
6+
{% else %}
37
To overcome the quantum threat on traditional cryptographic techniques, {{product_name}} integrates post-quantum cryptography with the current traditional methods. Specifically, it adopts the [X25519MLKEM768](https://datatracker.ietf.org/doc/draft-kwiatkowski-tls-ecdhe-mlkem/03/) key agreement algorithm for inbound TLS communications, ensuring robust protection against quantum threats. To configure TLS with post-quantum security, {{product_name}} should be configured to utilize OpenSSL 3.x as the JSSE provider, along with [liboqs](https://openquantumsafe.org/liboqs/) library to support post-quantum algorithms.
48

9+
{% endif %}
10+
511
Post-quantum TLS is **disabled** by default on {{product_name}}.
612

713
!!! note
@@ -149,6 +155,17 @@ Follow the instructions given below to install the required runtime dependencies
149155
150156
1. Shut down the {{product_name}} instance if it's running.
151157
2. Add the following configurations to the `<IS_HOME>/repository/conf/deployment.toml` file.
158+
159+
{% if is_version == "7.0.0" %}
160+
``` toml
161+
[transport.https.openssl]
162+
enabled = true
163+
named_groups="x25519_kyber768:x25519"
164+
[transport.https.sslHostConfig.properties]
165+
protocols="TLSv1+TLSv1.1+TLSv1.2+TLSv1.3"
166+
```
167+
168+
{% else %}
152169
``` toml
153170
[transport.https.openssl]
154171
enabled = true
@@ -157,6 +174,7 @@ Follow the instructions given below to install the required runtime dependencies
157174
[transport.https.sslHostConfig.properties]
158175
protocols="TLSv1+TLSv1.1+TLSv1.2+TLSv1.3"
159176
```
177+
{% endif %}
160178
3. Restart {{product_name}}.
161179

162180

0 commit comments

Comments
 (0)