PQC: a blindspot (logging) on BIG-IP - RFE
On BIG-IP it's currently not possible to log information such as proposed and negotiated Key Exchange Algorithm. No available iRule commands for that. On the other hand, NGINX do offer the possible to log it ($ssl_curve/$ssl_curves variables). I've got a RFE created for the following: Provide new iRule commands in events CLIENTSSL_CLIENTHELLO and CLIENTSSL_HANDSHAKE that outputs the Key Exchange Algorithm: - list of proposed (by the SSL client) Key Exchange Algorithms in CLIENTSSL_CLIENTHELLO - negotiated Key Exchange Algorithms in CLIENTSSL_HANDSHAKE => RFE ID2347153 ā "iRule command equivalent to NGINX's $ssl_curve for logging the negotiated KEM/DH group" Don't hesitate to open a support case to bind it to that RFE, the more we are the higher priority will be assigned to implement it (hopefully). š Alexandre
Any plans of supporting X25519MLKEM768 (0x11EC)
Hi Experts, It seems F5 is supporting the obsolete draft version, i.e., X25519Kyber768Draft00 (0x6399), whose support has been removed from the latest versions of Chrome and FireFox, instead X25519MLKEM768 (0x11EC) is supported on all the latest versions of Chrome and FireFox. So, does F5 have any plans to support X25519MLKEM768 (0x11EC) in its BIG-IP Next and TMOS flavours soon? Sources: - PQC support in BIG-IP Next: https://my.f5.com/manage/s/article/K000148294 - PQC support in BIG-IP TMOS: https://my.f5.com/s/article/K000149577