From eb8a2e06045e469de2ea2c8529d39b2b6c8eb5b6 Mon Sep 17 00:00:00 2001 From: Ali Syed Date: Thu, 16 Jul 2026 14:26:52 +0100 Subject: [PATCH] web: add X25519MLKEM768 post-quantum curve to TLS config X25519MLKEM768 is a hybrid post-quantum key exchange combining X25519 with ML-KEM-768. It has been available since Go 1.24 and is enabled by default in TLS 1.3, but users who explicitly set curve_preferences cannot currently include it. Assisted-by: Claude Signed-off-by: Ali Syed --- docs/web-configuration.md | 2 +- web/testdata/web_config_noAuth_allCurves.good.yml | 1 + web/tls_config.go | 9 +++++---- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/web-configuration.md b/docs/web-configuration.md index c3b1cf12d..316e2b62c 100644 --- a/docs/web-configuration.md +++ b/docs/web-configuration.md @@ -86,7 +86,7 @@ tls_server_config: # the order of elements in cipher_suites, is used. [ prefer_server_cipher_suites: | default = true ] - # Elliptic curves that will be used in an ECDHE handshake, in preference + # Elliptic curves and key exchange mechanisms that will be used in a TLS handshake, in preference # order. Available curves are documented in the go documentation: # https://golang.org/pkg/crypto/tls/#CurveID [ curve_preferences: diff --git a/web/testdata/web_config_noAuth_allCurves.good.yml b/web/testdata/web_config_noAuth_allCurves.good.yml index 2b29808ca..a4724f531 100644 --- a/web/testdata/web_config_noAuth_allCurves.good.yml +++ b/web/testdata/web_config_noAuth_allCurves.good.yml @@ -7,3 +7,4 @@ tls_server_config: - CurveP384 - CurveP521 - X25519 + - X25519MLKEM768 diff --git a/web/tls_config.go b/web/tls_config.go index 7245f7414..db0740d7e 100644 --- a/web/tls_config.go +++ b/web/tls_config.go @@ -480,10 +480,11 @@ func (c Cipher) MarshalYAML() (any, error) { type Curve tls.CurveID var curves = map[string]Curve{ - "CurveP256": (Curve)(tls.CurveP256), - "CurveP384": (Curve)(tls.CurveP384), - "CurveP521": (Curve)(tls.CurveP521), - "X25519": (Curve)(tls.X25519), + "CurveP256": (Curve)(tls.CurveP256), + "CurveP384": (Curve)(tls.CurveP384), + "CurveP521": (Curve)(tls.CurveP521), + "X25519": (Curve)(tls.X25519), + "X25519MLKEM768": (Curve)(tls.X25519MLKEM768), } func (c *Curve) UnmarshalYAML(unmarshal func(any) error) error {