PQC: a blindspot (logging) on BIG-IP - RFE

On BIG-IP it's currently not possible to log information such as proposed and negotiated Key Exchange Algorithm. No available iRule commands for that.

On the other hand, NGINX do offer the possible to log it ($ssl_curve/$ssl_curves variables).

I've got a RFE created for the following:

Provide new iRule commands in events CLIENTSSL_CLIENTHELLO and CLIENTSSL_HANDSHAKE that outputs the Key Exchange Algorithm:
- list of proposed (by the SSL client) Key Exchange Algorithms in CLIENTSSL_CLIENTHELLO
- negotiated Key Exchange Algorithms in CLIENTSSL_HANDSHAKE

=>

RFE ID2347153 — "iRule command equivalent to NGINX's $ssl_curve for logging the negotiated KEM/DH group"

Don't hesitate to open a support case to bind it to that RFE, the more we are the higher priority will be assigned to implement it (hopefully). 😀

Alexandre