Feature #22068: Adding post-quantum cryptography (PQC) support across Ruby standard libraries

• Status: Assigned
• Assignee: jaruga (Jun Aruga)
• Target version: -

[jaruga (Jun Aruga)]

Summary and motivation

What is PQC?

Post-quantum cryptography (PQC) means cryptography algorithm which people can safely use after (post) quantum computing is practically used like today's personal computer in the future.

Motivation

By using the quantum computing which is much more powerful than the current computing, it can be possible to crack the current non-PQC algorithms. I want to prepare for the situation.

I cite the following text from the NIST's PQC document. NIST is an organization defining cryptographic standards.

Some engineers even predict that within the next twenty or so years sufficiently large quantum computers will be built to break essentially all public key schemes currently in use. Historically, it has taken almost two decades to deploy our modern public key cryptography infrastructure. Therefore, regardless of whether we can estimate the exact time of the arrival of the quantum computing era, we must begin now to prepare our information security systems to be able to resist quantum computing.

I also cite the following text from DigiCert, a security company's blog. (link)

Gartner predicts that by 2029, conventional asymmetric cryptography like RSA and ECC will be unsafe for protecting sensitive data due to “harvest-now, decrypt-later" threats—even before a quantum break occurs.

So, it's better to prepare PQC support now.

As an example of the actual movement, European Commission is trying to migrate from non-PQC to PQC.(link)

Goal of the ticket

The goal of this ticket is to add PQC support across standard libraries including default gems and bundle gems. PQC-supported algorithms are only ML-DSA, ML-KEM and SLH-DSA for now. ML-DSA and SLH-DSA used for signature (certification), and ML-KEM is used for connection. As I heard from my colleagues working for OpenSSL, that SLH-DSA is not ready to be used, we can ignore SLH-DSA for now. The details of the goal of this ticket is making sure that PQC, non-PQC multiple (dual) key exchange / certificate use cases work by adding unit or integration tests. I think adding ML-KEM for key exchange and ML-DSA for certification is necessary. However, I need to investigate if we need to support SLH-DSA.

Notes

PQC, non-PQC hybrid and multiple key-exchange algorithms, and multiple PQC (ML-DSA), non-PQC (RSA) certificate functionalities and migration

ML-KEM, ML-DSA, SLH-DSA are algorithm groups. They has algorithms in them.

ML-KEM has hybrid algorithms that both PQC and non-PQC client can connect: X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024. X25519MLKEM768 is hybrid algorithm of X25519 and MLKEM768.

In my understanding, ML-DSA doesn't have such hybrid algorithm. So, TLS server need to support multiple certificates ML-DSA (PQC) and RSA (non-PQC).

Supporting PQC, non-PQC hybrid and multiple key-exchange algorithms, and multiple PQC (ML-DSA), non-PQC (RSA) certificates server is important for people to migrate their TLS servers from non-PQC to non-PQC/PQC hybrid/multiple, and then to PQC only. If these are no hybrid/multiple key exchange and multiple certificates functionalities, people need to prepare multiple servers for exclusive PQC server and exclusive non-PQC servers. That's costy and complicated migration.

Standardization status for PQC

According to nist-pqc, ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) specification is already final. However, there is uncertainty or adjustment about the future of ML-DSA. ML-DSA private CA is supported by some vendors. But the future of ML-DSA is Merkle Tree Certificate (MTC)-based or public-CA. MTC is a kind of alternative of public-CA. Google is promoting MTC on their blog. MTC is draft status in IETF. RFC 10024 is about ML-KEM hybrid key algorithms X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 for TLS 1.3.

Proof of concept

I manage my proof-of-concept scripts on my junaruga/ruby-pqc-test repository. For now, there are only some scripts to test RubyGems and Bundler in PQC use cases.

Current status & affected libraries

Ruby OpenSSL (ruby/openssl) already supports PQC by the ticket ruby/openssl#894 by adding ML-KEM, ML-DSA capabilities. However, we need to work for other standard libraries using Ruby OpenSSL in Ruby to support PQC.

I investigated ruby/ruby including default gems and bundled gems at the master branch commit 93f1010f70a3ac924c3b37e4ae82cf1a669fcbf0 which was the latest at that time. While ruby/ruby original code doesn't have PQC logic, the following libraries that have the own upstream project need to be modified to support PQC use cases in my investigation. And I am motivated to work on these tasks, adding the PQC features and/or tests. I will open the issue ticket for each upstream project ruby/* one by one.

• ruby/rubygems - issue link - Add PQC features
• ruby/rubygems bundler - issue link - Add PQC features
• ruby/net-http - default gem - Update code comments and add PQC tests
• ruby/open-uri - default gem - Add PQC tests
• ruby/spec - spec/ - Add PQC tests
• ruby/drb: bundled gem - issue link - Add PQC features
• ruby/rbs: bundled gem - Not sure. There is stdlib/openssl/0/openssl.rbs.

Note I used the following ripgrep's rg command (an enhanced grep command) to check the affected files by PQC.

$ rg "require +['\"]openssl['\"]|OpenSSL" --type ruby

Let me know what you think.

[jaruga (Jun Aruga)]

• Description updated (diff)

[jaruga (Jun Aruga)]

• Description updated (diff)

[jaruga (Jun Aruga)]

• Description updated (diff)

[hsbt (Hiroshi SHIBATA)]

Thanks for your detailed summary. I will handle rubygems and bundler.

[jaruga (Jun Aruga)]

As I heard from my colleagues working for OpenSSL, that SLH-DSA is not ready to be used, we can ignore SLH-DSA for now.

Sorry, the above was wrong or outdated information.
SLH-DSA is ready to use for signature use case (but not for TLS signature) now.

I am working at Red Hat, and it seems that my colleagues meant the following page's content that RHEL 10.0 provided a draft version of SLH-DSA by the OQS provider not by OpenSSL.

Interoperability of RHEL 10 post-quantum cryptography
https://access.redhat.com/articles/7119430

The OQS provider (oqsprovider-0.8.0-5.el10) implements the ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) and ML-DSA (Module-Lattice-Based Digital Signature Algorithm) NIST standards. The package provides an early draft version of SLH-DSA (Stateless Hash-Based Digital Signature), the SPHINCS+ algorithm, which will not be supported in the future.

However, as OpenSSL 3.5 supports SLH-DSA, this is not the case.

[jaruga (Jun Aruga)]

hsbt (Hiroshi SHIBATA) wrote in #note-4:

Thanks for your detailed summary. I will handle rubygems and bundler.

Thanks!

[jaruga (Jun Aruga)]

• Description updated (diff)

[jaruga (Jun Aruga)]

@seki (Masatoshi Seki) or other ruby/drb maintainers, I opened the issue ticket https://github.com/ruby/drb/issues/52, sending the PR. The PR link is on the issue ticket. I would appreciate your reviews for the PR.

[jaruga (Jun Aruga)]

• Description updated (diff)

[jaruga (Jun Aruga)]

• Description updated (diff)

[jaruga (Jun Aruga)]

• Status changed from Open to Assigned
• Assignee set to jaruga (Jun Aruga)

[jaruga (Jun Aruga)]

Based on the Dev Meeting on 6th August 2026, I updated this ticket's first comment, adding the following sections.

• What is PQC?
• Goal of the ticket
• PQC, non-PQC hybrid and multiple key-exchange algorithms, and multiple PQC (ML-DSA), non-PQC (RSA) certificate functionalities and migration
• Standardization status for PQC

[jaruga (Jun Aruga)]

• Description updated (diff)

[jaruga (Jun Aruga)]

• Description updated (diff)

[jaruga (Jun Aruga)]

• Description updated (diff)