-
Bug
-
Resolution: Unresolved
-
Major
-
rhel-10.1
-
None
-
yggdrasil-0.4.8-2.el10
-
No
-
Important
-
subs-client-tools
-
5
-
False
-
False
-
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
Per testing task RHELMISC-11986 post-quantum cryptography in TLS, I discovered that yggdrasil-0.4.6-1.el10.x86_64 failed to connect to a server capable of post-quantum crytography. Instead of connecting with a desirable X25519MLKEM768 key exhange, x25519:secp256r1:secp384r1:secp521r was the best it could do with an RSA certificate and failed to even parse a ML-DSA certificate key.
Solution: Rebuild yggdrasil with go version 1.24, as suggested in https://pkg.go.dev/crypto/tls#pkg-overview...
// From Go 1.24, the default includes the [X25519MLKEM768] hybrid // post-quantum key exchange.
The steps to reproduce the testing failure are in this RHELMISC-11986 comment.
- links to
-
RHSA-2025:149326 yggdrasil security update