PQC: a blindspot (logging) on BIG-IP - RFE

Not discounting the actual need to support logging the negotiated key exchange algorithm, but in the short term please allow me to provide some options.

iRule solution that essentially "guesses" at the negotiation:

when CLIENTSSL_CLIENTHELLO {
    # Capture which PQC groups the client offered
    set ::pqc_offered ""
    if { [SSL::extensions exists -type 10] } {
        set sg [SSL::extensions -type 10]
        # X25519MLKEM768  = 0x11EC (4588)
        # SecP256r1MLKEM768 = 0x11EB (4587)
        # X25519Kyber768Draft = 0x6399 (25497)
        # X25519 = 0x001D (29)
        if { [string match *\x11\xEC* $sg] } { append ::pqc_offered "X25519MLKEM768 " }
        if { [string match *\x11\xEB* $sg] } { append ::pqc_offered "SecP256r1MLKEM768 " }
        if { [string match *\x63\x99* $sg] } { append ::pqc_offered "X25519Kyber768Draft " }
        if { [string match *\x00\x1D* $sg] } { append ::pqc_offered "X25519 " }
        if { [string match *\x00\x17* $sg] } { append ::pqc_offered "secp256r1 " }
    }
}
when CLIENTSSL_HANDSHAKE {
    # SSL::cipher name gives the bulk cipher suite (e.g. TLS_AES_256_GCM_SHA384)
    # SSL::cipher version confirms TLS 1.3 — required for ML-KEM
    set ver   [SSL::cipher version]
    set ciph  [SSL::cipher name]
    set ip    [IP::client_addr]

    # If TLS 1.3 and client offered X25519MLKEM768, BIG-IP will have picked it
    # (assuming your cipher group lists it and no HelloRetryRequest occurred)
    if { $ver eq "TLSv1.3" && [string match *X25519MLKEM768* $::pqc_offered] } {
        log local0.info "LIKELY-MLKEM client=$ip cipher=$ciph version=$ver offered=$::pqc_offered"
    } else {
        log local0.info "NO-MLKEM client=$ip cipher=$ciph version=$ver offered=$::pqc_offered"
    }
}

Your LTM log output would look something like this:

LIKELY-MLKEM client=10.1.10.50 cipher=TLS13-AES128-GCM-SHA256 version=TLSv1.3 offered=X25519MLKEM768 X25519 secp256r1 

There's also a set of tmctl options you can use to view PQC stats:

## Client side
tmctl -r -P -s common.cipher_uses.mlkem768,common.cipher_uses.mlkem1024,common.cipher_uses.x25519_mlkem768,common.cipher_uses.p256_mlkem768,common.cipher_uses.p384_mlkem1024,common.cipher_uses.kem_x25519_ml_kem768 profile_clientssl_stat

Name                                    Value
--------------------------------------- -----
common.cipher_uses.mlkem768                 6
common.cipher_uses.mlkem1024                0
common.cipher_uses.x25519_mlkem768          6
common.cipher_uses.p256_mlkem768            0
common.cipher_uses.p384_mlkem1024           0
common.cipher_uses.kem_x25519_ml_kem768     6

## Server side
tmctl -r -P -s common.cipher_uses.x25519_mlkem768,common.cipher_uses.mlkem768,common.cipher_uses.mlkem1024 profile_serverssl_stat

Name                               Value
---------------------------------- -----
common.cipher_uses.x25519_mlkem768     6
common.cipher_uses.mlkem768            6
common.cipher_uses.mlkem1024           0

## Total ML-KEM connections
tmctl -q -c -s common.cipher_uses.mlkem768,common.cipher_uses.mlkem1024,common.cipher_uses.x25519_mlkem768,common.cipher_uses.p256_mlkem768,common.cipher_uses.p384_mlkem1024,common.cipher_uses.kem_x25519_ml_kem768 profile_clientssl_stat \
> | awk -F, '{for(i=1;i<=NF;i++)s+=$i} END{printf "TOTAL ML-KEM connections: %d\n", s}'

TOTAL ML-KEM connections: 18

## Total ML-KEM family count
tmctl -q -c -s common.cipher_uses.mlkem768,common.cipher_uses.x25519_mlkem768,common.cipher_uses.p256_mlkem768,common.cipher_uses.kem_x25519_ml_kem768,common.cipher_uses.mlkem1024,common.cipher_uses.p384_mlkem1024 profile_clientssl_stat \
> | awk -F, '{k768+=$1+$2+$3+$4; k1024+=$5+$6} END{printf "ML-KEM768 family: %d\nML-KEM1024 family: %d\nTOTAL PQC: %d\n", k768, k1024, k768+k1024}'

ML-KEM768 family: 18
ML-KEM1024 family: 0
TOTAL PQC: 18

## Total ML-KEM + Kyber connections
tmctl -q -c -s common.cipher_uses.mlkem768,common.cipher_uses.mlkem1024,common.cipher_uses.x25519_mlkem768,common.cipher_uses.p256_mlkem768,common.cipher_uses.p384_mlkem1024,common.cipher_uses.kem_x25519_ml_kem768,common.cipher_uses.kyber768,common.cipher_uses.x25519_kyber768,common.cipher_uses.kem_x25519_kyber768 profile_clientssl_stat \
> | awk -F, '{for(i=1;i<=NF;i++)s+=$i} END{printf "TOTAL PQC (ML-KEM + Kyber) connections: %d\n", s}'

TOTAL PQC (ML-KEM + Kyber) connections: 18

Thanks.