Uploaded image for project: 'OpenStack Strategy'
  1. OpenStack Strategy
  2. RHOSSTRAT-977

Cryptographic use in OpenStack - assessing the crypto libraries to support PQC

XMLWordPrintable

    • Icon: Initiative Initiative
    • Resolution: Unresolved
    • Icon: Critical Critical
    • None
    • None
    • Security
    • None
    • Not Selected
    • False
    • False
    • Hide

      None

      Show
      None
    • 0
    • 0
    • 96% To Do, 4% In Progress, 0% Done
    • rhos-ops-platform-services-security

      Feature Overview (mandatory - Complete while in New status)
      As part of the broader PQC Support in RHOSO (OCPSTRAT-2372) initiative, we are conducting an initial research spike to assess the effort required to implement Post-Quantum Cryptography (PQC) within the OpenStack codebase.

      The transition to Post-Quantum Cryptography (PQC) is essential because many current cryptographic algorithms (like RSA and ECC) will be vulnerable to cryptanalytic attacks from future quantum computers. For full context, refer to the presentation or watch the recording.
      Follow the PQC Program Status dashboard] to check any duplication of common-library or some work already in progress.

      Goals (mandatory - Complete while in New status)
      Perform a deep-dive analysis of the Component Name codebase to identify cryptographic operations (TLS, encryption, signing, key management) requiring updates for quantum-safe algorithms (ML-KEM/ML-DSA).

      Scope of Analysis:

      • Go-based services: Map dependencies against OCP 4.20/4.22+ crypto libraries.
      • Python/Dataplane: Assess RHEL 9.7+/10.1+ PQC compatibility.
      • TLS 1.3: Confirm the service can run without TLS 1.2 hardcoding.
      • Cryptographic modules: List all cryptographic modules used in the Component Name codebase (separating test code from product code), with their current/planned PQC support (if information exists).

      Timebox: If the analysis reveals high complexity, a follow-up implementation Jira should be created which should be a RHOSO 19 Beta target (likely).

              Unassigned Unassigned
              jjung@redhat.com JP Jung
              JP Jung JP Jung
              Edu Alcaniz Edu Alcaniz
              rhos-dfg-security
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: