Support post-quantum crypto algorithms

[bestbeforetoday]

As a business application developer
I want to use post-quantum crypto algorithms with Fabric
So that the integrity of business data is maintained as quantum computing technology advances

NIST has selected some quantum-resistant cryptography algorithms:

https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms

It would be good for Fabric to support use of one or more of these algorithms (or future recommendations) as an alternative (or in addition) to the existing ECDSA cryptography for securing messages and ledger data. This could also extend to the cryptography used for secure (TLS) gRPC connections, although that might be better tracked as a separate issue.

Current post-quantum crypto algorithms are available as a Golang module here:

https://github.com/open-quantum-safe/liboqs-go

[SamYuan1990]

#3880, maybe for post-quantum crypto algorithms we can impl in a specific repo as decouple bccsp from fabric repo?

[InLindquistWeTrust]

Currently implemented Falcon and Kyber keys into Hyperledger fabric for an IoT network. While the latency is low,I am trying to push the latency even lower for efficiency. Any suggestions on this would be greatly appreciated.

[bestbeforetoday]

Post-quantum crypto support in the Go standard libraries looks to be tracked in golang/go#64537.

The comments for that issue mention the cloudflare/circl Go library containing post-quantum crypto implementations.

[SamYuan1990]

Post-quantum crypto support in the Go standard libraries looks to be tracked in golang/go#64537.

The comments for that issue mention the cloudflare/circl Go library containing post-quantum crypto implementations.

IMO, there lots of PQC impls libraries today, but the blocking is on x509 as IETF is on draft version.
But, maybe we should get ready for Alg level and once IEFT finalized x509 format, we can go ahead.
Maybe for now, starts with either cloudflare/circl or liboqs and then move to go native as a switch later on.(I am not sure if go native need to wait with openssl.... or not?)

[SamYuan1990]

and btw, @bestbeforetoday , should we start any level of development? for example, try with cloudflare/circl on ALG level code? or open a dev branch today?

[bestbeforetoday]

I personally would be in favour of it. It's really a question for the @hyperledger/fabric-core-maintainers maintainers though.

From a quick glance at the two post-quantum crypto libraries mentioned above, cloudflare/circl seems like a better bet since it does not have a native library dependency, which is more trouble to install and configure. Best would be to use Golang standard libraries once they provide all the required functionality.

[SamYuan1990]

I personally would be in favour of it. It's really a question for the @hyperledger/fabric-core-maintainers maintainers though.

From a quick glance at the two post-quantum crypto libraries mentioned above, cloudflare/circl seems like a better bet since it does not have a native library dependency, which is more trouble to install and configure. Best would be to use Golang standard libraries once they provide all the required functionality.

Agree, that if we can have a light library then we can switch to golang standard libraries in an easy way.
@denyeart , can you help with core maintainers on this topic, to see if we can have a feature branch or not?