Re: Hybrid PQC: x25519-mlkem fails in openssl 3.5.5 with default provider
murugesh pitchaiah <[email protected]> Fri, 27 Mar 2026 22:25:38 +0530
| Newsgroups | gmane.comp.encryption.openssl.user,gmane.comp.encryption.openssl.devel |
|---|---|
| Message-ID | <CAOu9RAdKUFRTFxezd_mXAcnH3bM-WVb1aee+KWJsXvb=YpNM4w@mail.gmail.com> |
--0000000000000a8887064e046009 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Tomas, Thanks for the reply. Please share what's the hybrid algorithm can be used for a complete TLS client/server. ( To generate x509 key and certificate) If no such support available, only way is to use ml-dsa ? (non hybrid) Thanks, Murugesh On Fri, 27 Mar, 2026, 9:21=E2=80=AFpm Tomas Mraz, <[email protected]= > wrote: > Hi, > > Yes, the X25519MLKEM768 does NOT have any defined private key format > and for that reason it is usable only for ephemeral keys. > > Regards, > > Tomas Mraz, CTO, OpenSSL Foundation > > > On Fri, 2026-03-27 at 20:55 +0530, murugesh pitchaiah wrote: > > Hi All, > > > > I have downloaded the openssl 3.5.5 code base and built the library. > > While trying to generate the hybrid ml-kem keypair see below error: > > > > (snip) > > > > $ openssl genpkey -algorithm X25519MLKEM768 -out > > x25519_mlkem_768_key.pem > > Error writing key(s) > > 80CB0C248B760000:error:1D800065:ENCODER > > routines:OSSL_ENCODER_to_bio:reason(101):crypto/encode_decode/encoder > > _lib.c:78:No encoders were found. For standard encoders you need at > > least one of the default or base providers available. Did you forget > > to load them? > > 80CB0C248B760000:error:04800073:PEM routines:do_pk8pkey:error > > converting private key:crypto/pem/pem_pk8.c:132: > > > > $ openssl list -providers > > Providers: > > default > > name: OpenSSL Default Provider > > version: 3.5.5 > > status: active > > $ > > > > $ openssl list -kem-algorithms | grep -i mlkem > > { 2.16.840.1.101.3.4.4.1, id-alg-ml-kem-512, ML-KEM-512, MLKEM512 } > > @ default > > { 2.16.840.1.101.3.4.4.2, id-alg-ml-kem-768, ML-KEM-768, MLKEM768 } > > @ default > > { 2.16.840.1.101.3.4.4.3, id-alg-ml-kem-1024, ML-KEM-1024, > > MLKEM1024 } @ default > > X25519MLKEM768 @ default > > X448MLKEM1024 @ default > > SecP256r1MLKEM768 @ default > > SecP384r1MLKEM1024 @ default > > $ > > > > (snip) > > > > I assume the support is added by default and no provider load is > > needed. Can anyone please share what am i missing ? Thanks in > > advance. > > > > Regards, > > Murugesh > > -- > > You received this message because you are subscribed to the Google > > Groups "openssl-users" group. > > To unsubscribe from this group and stop receiving emails from it, > > send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org > > To view this discussion visit > > > https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAOu9RAdFHf= B4_RtCsD79tNTCuE3PiUtOn31Ora82dE_LYgPzcw%40mail.gmail.com > > . > > -- > Tom=C3=A1=C5=A1 Mr=C3=A1z, Chief Technology Officer, OpenSSL Foundation > We need your support! Help us protect digital privacy=E2=80=A6 everywhere= . > https://openssl.foundation/donate/ways-to-give > --=20 You received this message because you are subscribed to the Google Groups "= openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/CAOu9RAdKUFRTFxezd_mXAcnH3bM-WVb1aee%2BKWJsXvb%3DYpNM4w%40= mail.gmail.com. --0000000000000a8887064e046009 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto">Hi Tomas,<div dir=3D"auto"><br></div><div dir=3D"auto">Th= anks for=C2=A0the reply.=C2=A0 Please share=C2=A0 what's the hybrid alg= orithm can be used for a complete TLS client/server.=C2=A0 ( To generate x5= 09 key and certificate)</div><div dir=3D"auto"><br></div><div dir=3D"auto">= If no such support available,=C2=A0 only way is to use ml-dsa ? (non hybrid= )</div><div dir=3D"auto"><br></div><div dir=3D"auto">Thanks,=C2=A0</div><di= v dir=3D"auto">Murugesh=C2=A0</div></div><br><div class=3D"gmail_quote gmai= l_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, 27 Mar, 20= 26, 9:21=E2=80=AFpm Tomas Mraz, <[email protected]> wrote:<br>= </div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-l= eft:1px #ccc solid;padding-left:1ex">Hi,<br> <br> Yes, the X25519MLKEM768 does NOT have any defined private key format<br> and for that reason it is usable only for ephemeral keys.<br> <br> Regards,<br> <br> Tomas Mraz, CTO, OpenSSL Foundation<br> <br> <br> On Fri, 2026-03-27 at 20:55 +0530, murugesh pitchaiah wrote:<br> > Hi All,<br> > <br> > I have downloaded the openssl 3.5.5 code base and built the library.<b= r> > While trying to generate the hybrid ml-kem keypair see below error:<br= > > <br> > (snip)<br> > <br> > $ openssl genpkey -algorithm X25519MLKEM768 -out<br> > x25519_mlkem_768_key.pem<br> > Error writing key(s)<br> > 80CB0C248B760000:error:1D800065:ENCODER<br> > routines:OSSL_ENCODER_to_bio:reason(101):crypto/encode_decode/encoder<= br> > _lib.c:78:No encoders were found. For standard encoders you need at<br= > > least one of the default or base providers available. Did you forget<b= r> > to load them?<br> > 80CB0C248B760000:error:04800073:PEM routines:do_pk8pkey:error<br> > converting private key:crypto/pem/pem_pk8.c:132:<br> > <br> > $ openssl list -providers<br> > Providers:<br> > =C2=A0 default<br> > =C2=A0 =C2=A0 name: OpenSSL Default Provider<br> > =C2=A0 =C2=A0 version: 3.5.5<br> > =C2=A0 =C2=A0 status: active<br> > $=C2=A0<br> > <br> > $ openssl list -kem-algorithms | grep -i mlkem<br> > =C2=A0 { 2.16.840.1.101.3.4.4.1, id-alg-ml-kem-512, ML-KEM-512, MLKEM5= 12 }<br> > @ default<br> > =C2=A0 { 2.16.840.1.101.3.4.4.2, id-alg-ml-kem-768, ML-KEM-768, MLKEM7= 68 }<br> > @ default<br> > =C2=A0 { 2.16.840.1.101.3.4.4.3, id-alg-ml-kem-1024, ML-KEM-1024,<br> > MLKEM1024 } @ default<br> > =C2=A0 X25519MLKEM768 @ default<br> > =C2=A0 X448MLKEM1024 @ default<br> > =C2=A0 SecP256r1MLKEM768 @ default<br> > =C2=A0 SecP384r1MLKEM1024 @ default<br> > $=C2=A0<br> > <br> > (snip)<br> > <br> > I assume the support is added by default and no provider load is<br> > needed. Can anyone please share what am i missing ? Thanks in<br> > advance.<br> > <br> > Regards,<br> > Murugesh<br> > -- <br> > You received this message because you are subscribed to the Google<br> > Groups "openssl-users" group.<br> > To unsubscribe from this group and stop receiving emails from it,<br> > send an email to <a href=3D"mailto:openssl-users%2Bunsubscribe@openssl= .org" target=3D"_blank" rel=3D"noreferrer">openssl-users+unsubscribe@openss= l.org</a>.<br> > To view this discussion visit<br> > <a href=3D"https://groups.google.com/a/openssl.org/d/msgid/openssl-use= rs/CAOu9RAdFHfB4_RtCsD79tNTCuE3PiUtOn31Ora82dE_LYgPzcw%40mail.gmail.com" re= l=3D"noreferrer noreferrer" target=3D"_blank">https://groups.google.com/a/o= penssl.org/d/msgid/openssl-users/CAOu9RAdFHfB4_RtCsD79tNTCuE3PiUtOn31Ora82d= E_LYgPzcw%40mail.gmail.com</a><br> > .<br> <br> -- <br> Tom=C3=A1=C5=A1 Mr=C3=A1z, Chief Technology Officer, OpenSSL Foundation<br> We need your support! Help us protect digital privacy=E2=80=A6 everywhere.<= br> <a href=3D"https://openssl.foundation/donate/ways-to-give" rel=3D"noreferre= r noreferrer" target=3D"_blank">https://openssl.foundation/donate/ways-to-g= ive</a><br> </blockquote></div> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;openssl-users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org">openssl-us= [email protected]</a>.<br /> To view this discussion visit <a href=3D"https://groups.google.com/a/openss= l.org/d/msgid/openssl-users/CAOu9RAdKUFRTFxezd_mXAcnH3bM-WVb1aee%2BKWJsXvb%= 3DYpNM4w%40mail.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://g= roups.google.com/a/openssl.org/d/msgid/openssl-users/CAOu9RAdKUFRTFxezd_mXA= cnH3bM-WVb1aee%2BKWJsXvb%3DYpNM4w%40mail.gmail.com</a>.<br /> --0000000000000a8887064e046009--