OpenSSL Algorithm Support - crt26/PQC-LEO GitHub Wiki
OpenSSL 4.0.3 includes native support for the NIST-standardised PQC algorithms ML-KEM, ML-DSA, and SLH-DSA. This project integrates these algorithms for TLS benchmarking where possible. However, some limitations affect their usage in performance testing and handshake scenarios.
The TLS handshake transmission cost test uses the same algorithm lists as standard TLS handshake testing. Consequently, an algorithm marked as supporting TLS handshake testing also supports the bytes test, while handshake exclusions apply to both categories.
-
SLH-DSA is supported for certificate generation, but not for TLS handshakes or the
speedutility in OpenSSL 4.0.3. OQS-Provider also disables its SLH-DSA implementations when used with OpenSSL 3.5 or later, while legacy SPHINCS+ support has been removed upstream. As such, neither scheme is available for TLS benchmarking with the current dependencies. Support for SLH-DSA in TLS handshakes is planned for a future OpenSSL release and will be integrated into this project once available. For further details, see the OQS-Provider compatibility documentation and SPHINCS+ removal. -
The X448MLKEM1024 Hybrid-PQC KEM is implemented and supported by OpenSSL's
speedtool, but not registered as a TLS group. It is excluded from TLS handshake and transmission cost testing, though it remains available for TLS speed testing within this project.
To provide performance baselines for comparison, TLS handshake, TLS speed, and transmission-cost testing includes a set of classical digital signature algorithms, key-exchange groups, and TLS 1.3 ciphersuites. Every supported classical signing algorithm is tested with every supported key-exchange-group and ciphersuite combination. However, in TLS speed testing, only the signing and key-exchange algorithms are benchmarked, excluding ciphersuites. The complete lists are provided in the classical algorithm tables below.
RSA-PSS is supported for TLS handshake, transmission-cost, and TLS operations energy usage testing. However, it is not supported for standard TLS speed testing. The absence of RSA-PSS in standard TLS speed testing is due to the limitations of the openssl speed command interface, which does not provide a separate RSA-PSS selector or result category. Instead, it only exposes size-based RSA selectors (e.g., rsa2048, rsa3072, rsa4096) that benchmark the standard RSA/PKCS#1 v1.5 path.
These configurations help assess the overhead and feasibility of PQC adoption in real-world contexts by providing a comprehensive comparison of performance metrics.
Algorithms provided by OpenSSL that are used within standard TLS handshake testing are also supported for TLS handshake energy usage testing. For TLS operations energy usage testing, the tls_operations_energy_test.sh script uses OpenSSL commands to evaluate PQC and Hybrid-PQC KEMs and digital signatures, alongside classical digital signatures and key-exchange algorithms. However, the following Hybrid-PQC KEM algorithms are not supported for TLS operations energy usage testing. This is due to the current version of OpenSSL not providing the required encoding paths, preventing key export and file-based cryptographic operations required by the benchmarking process.
Unsupported Algorithms for TLS Operations Energy Usage Testing:
- X25519MLKEM768
- X448MLKEM1024
- SecP256r1MLKEM768
- SecP384r1MLKEM1024
- curveSM2MLKEM768
| Algorithm Name | Hybrid Algorithm (*) | TLS Handshake Test Support (*) | OpenSSL Speed Test Support (*) | TLS Handshake Bytes Test Support (*) |
|---|---|---|---|---|
| MLKEM512 | * | * | * | |
| MLKEM768 | * | * | * | |
| MLKEM1024 | * | * | * | |
| X25519MLKEM768 | * | * | * | * |
| X448MLKEM1024 | * | * | ||
| SecP256r1MLKEM768 | * | * | * | * |
| SecP384r1MLKEM1024 | * | * | * | * |
| curveSM2MLKEM768 | * | * | * | * |
| Algorithm Name | Hybrid Algorithm (*) | TLS Handshake Test Support (*) | OpenSSL Speed Test Support (*) | TLS Handshake Bytes Test Support (*) |
|---|---|---|---|---|
| MLDSA44 | * | * | * | |
| MLDSA65 | * | * | * | |
| MLDSA87 | * | * | * |
| Algorithm Name | TLS Handshake Test Support (*) | OpenSSL Speed Test Support (*) | TLS Operations Energy Test Support (*) | TLS Handshake Bytes Test Support (*) |
|---|---|---|---|---|
| RSA_2048 | * | * | * | * |
| RSA_3072 | * | * | * | * |
| RSA_4096 | * | * | * | * |
| RSA-PSS_2048 | * | * | * | |
| RSA-PSS_3072 | * | * | * | |
| RSA-PSS_4096 | * | * | * | |
| prime256v1 | * | * | * | * |
| secp384r1 | * | * | * | * |
| secp521r1 | * | * | * | * |
| ed25519 | * | * | * | * |
| ed448 | * | * | * | * |
| brainpoolP256r1 | * | * | * | * |
| brainpoolP384r1 | * | * | * | * |
| brainpoolP512r1 | * | * | * | * |
The blank OpenSSL speed-test cells for RSA-PSS_* indicate that openssl speed does not produce a distinct RSA-PSS benchmark category. They do not indicate that RSA-PSS is unsupported by OpenSSL or TLS.
| Key Exchange Group | TLS Handshake Test Support (*) | OpenSSL Speed Test Support (*) | TLS Operations Energy Test Support (*) | TLS Handshake Bytes Test Support (*) |
|---|---|---|---|---|
| x25519 | * | * | * | * |
| x448 | * | * | * | * |
| secp256r1 | * | * | * | * |
| secp384r1 | * | * | * | * |
| secp521r1 | * | * | * | * |
| brainpoolP256r1tls13 | * | * | * | * |
| brainpoolP384r1tls13 | * | * | * | * |
| brainpoolP512r1tls13 | * | * | * | * |
| Ciphersuite | TLS Handshake Test Support (*) | OpenSSL Speed Test Support (*) | TLS Operations Energy Test Support (*) | TLS Handshake Bytes Test Support (*) |
|---|---|---|---|---|
| TLS_AES_128_GCM_SHA256 | * | * | ||
| TLS_AES_256_GCM_SHA384 | * | * | ||
| TLS_CHACHA20_POLY1305_SHA256 | * | * | ||
| TLS_AES_128_CCM_SHA256 | * | * |