OQS for embedded linux

[embetrix]

Hello,

I wanted to share that I've launched a new project focused on seamless integration of OQS into Embedded Linux devices using OpenEmbedded/Yocto.
This should support any hardware through Yocto : so far tested with Raspberrypi3/4/5, STM32M1 MPUS, i.MX8x, Qemu (Emulation)

You can check out the details on GitHub here:

https://github.com/embetrix/meta-pqc.git

More demos are coming

[SWilson4]

It's always nice to hear from somebody using OQS. How was the experience integrating the libraries? If you had any "pain points" during the process, please let us know so we can try to smooth them out. (PRs also happily accepted in that regard!)

[baentsch]

Thanks for letting us know @embetrix ! As you're also supporting Botan, I'd obviously mirror @SWilson4 's question above: Anything OQS should do to improve to make integration easier? Finally, as you're also integrating openssl and oqsprovider, please consider sharing any experiences you have integrating openssl without oqsprovider now that the standard PQ algorithms have landed there -- or if you don't want to do that, why? This could help inform our discussion at open-quantum-safe/oqs-provider#610.

[embetrix]

Hello @SWilson4 @baentsch,

It seems that the only thing missing is an easier cross-compilation process for liboqs (see #2029). I’ll take care of that once I have some spare time. Other than that, everything works like a charm!

It’s great news that OQS has been integrated directly into OpenSSL. However, based on my experience, incorporating a newer OpenSSL version (e.g 3.5.x) into Yocto or any Linux distribution (specially LTS branches) takes a while due to compatibility issues. Because of this, I believe the oqs-provider will remain relevant for several more years and should continue to be maintained.

[embetrix]

for the information here is the release plan of

Yocto:

https://wiki.yoctoproject.org/wiki/Releases

Actual LTS (Long Term Support) is 5.0 (End Of Life 2028) using OpenSSL version 3.2.x

Debian (and derivatives) :

https://www.debian.org/releases/stable/

Actual LTS (Long Term Support) is 12.0 (End Of Life 2028) using OpenSSL version 3.0.x

[baentsch]

It’s great news that OQS has been integrated directly into OpenSSL.

This is not a correct statement: OQS has not (and IMO never will be, see reasons for example here and here) integrated to OpenSSL: I talked above about PQC (algorithms) landing in OpenSSL, not OQS (code base). I just happen to have a keen interest for both projects - each with a different perspective: OQS is to further the "state of the art" while OpenSSL is to improve "the security of the world".

incorporating a newer OpenSSL version (e.g 3.5.x) into Yocto or any Linux distribution (specially LTS branches) takes a while due to compatibility issues. Because of this, I believe the oqs-provider will remain relevant for several more years and should continue to be maintained.

That statement I agree with. It's the reason behind openssl/openssl#26649.