1. PQC Algorithm Summary

   See PQC algorithm

2. Hybrid Algorithm Summary

See supported PQC algorithms

The following quantum-safe algorithms from liboqs are supported (assuming they have been enabled in liboqs):

• BIKE: bike1l1cpa, bike1l3cpa, bike1l1fo, bike1l3fo
• CRYSTALS-Kyber: kyber512, kyber768, kyber1024, kyber90s512, kyber90s768, kyber90s1024
• HQC: hqc128, hqc192, hqc256†
• SIDH: sidhp434, sidhp503, sidhp610, sidhp751
• SIKE: sikep434, sikep503, sikep610, sikep751

If <KEX> is any of the algorithms listed above, the following hybrid algorithms are supported:

• if <KEX> has L1 security, the fork provides the method p256_<KEX>, which combine <KEX> with ECDH using the P256 curve.
• if <KEX> has L3 security, the fork provides the method p384_<KEX>, which combines <KEX> with ECDH using the P384 curve.
• if <KEX> has L5 security, the fork provides the method p521_<KEX>, which combines <KEX> with ECDH using the P521 curve.

For example, since kyber768 claims L3 security, the hybrid p384_kyber768 is available.

• CRYSTALS-Dilithium:dilithium2*, dilithium3*, dilithium5*, dilithium2_aes*, dilithium3_aes*, dilithium5_aes*
• Falcon:falcon512*, falcon1024*
• SPHINCS-Haraka:sphincsharaka128frobust*, sphincsharaka128fsimple, sphincsharaka128srobust, sphincsharaka128ssimple, sphincsharaka192frobust, sphincsharaka192fsimple, sphincsharaka192srobust, sphincsharaka192ssimple, sphincsharaka256frobust, sphincsharaka256fsimple, sphincsharaka256srobust, sphincsharaka256ssimple
• SPHINCS-SHA256:sphincssha256128frobust*, sphincssha256128fsimple, sphincssha256128srobust, sphincssha256128ssimple, sphincssha256192frobust, sphincssha256192fsimple, sphincssha256192srobust, sphincssha256192ssimple, sphincssha256256frobust, sphincssha256256fsimple, sphincssha256256srobust, sphincssha256256ssimple
• SPHINCS-SHAKE256:sphincsshake256128frobust*, sphincsshake256128fsimple, sphincsshake256128srobust, sphincsshake256128ssimple, sphincsshake256192frobust, sphincsshake256192fsimple, sphincsshake256192srobust, sphincsshake256192ssimple, sphincsshake256256frobust, sphincsshake256256fsimple, sphincsshake256256srobust, sphincsshake256256ssimple

The following hybrid algorithms are supported; they combine a quantum-safe algorithm listed above with a traditional digital signature algorithm (<SIG> is any one of the algorithms listed above):

• if <SIG> has L1 security, then the fork provides the methods rsa3072_<SIG> and p256_<SIG>, which combine <SIG> with RSA3072 and with ECDSA using NIST's P256 curve respectively.
• if <SIG> has L3 security, the fork provides the method p384_<SIG>, which combines <SIG> with ECDSA using NIST's P384 curve.
• if <SIG> has L5 security, the fork provides the method p521_<SIG>, which combines <SIG> with ECDSA using NIST's P521 curve.

For example, since dilithium2 claims L1 security, the hybrids rsa3072_dilithium2 and p256_dilithium2 are available.

For hybrid singing, the message to be signed is hashed using the SHA-2 hash function matching the security level of the OQS scheme (SHA256 for L1, SHA384 for L2/L3, SHA512 for L4/L5) before being signed by the classical algorithm. The message to be signed is passed directly to the OQS signature API without hashing.

3. Enabled algorithm summary

• PQC Key Exchange

  See kem_verify.c

• HYBRID PQC Key Exchange

  Refer to obj_mac.h

"-" means unsupported in Windows, and supported in Linux. "+" means fail in Windows, and succeed in Linux.

• RAW PQC public key mode

  See sig_verify.c

• HYBRID PQC cert public key mode

  See hybrid_sig_verify.c from obj_mac.h

"*" means unsupported because of large size. "+" means fail in Windows, and succeed in Linux.

4. Algorithm Stack & Heap usage

See PQC Stack Heap Usage

5. Performance

We collect performance data for a typical SPDM flow:

• Connection Setup: GET_VERSION, GET_CAPABILITIES, NEGOTIATE_ALGORITHM
• Device Authentication: GET_DIGESTS, GET_CERTIFICATE (REQ:CERT_VERIFY), CHALLENGE (RSP:CHAL_SIGN, REQ:CHAL_VERIFY)
• Secure Session Setup: KEY_EXCHANGE (REQ:KEY_EX_KEM_GEN, RSP:KEY_EX_KEM_ENCAP+KEY_EX_KEM_SIGN, REQ:KEY_EX_KEM_DECAP+KEY_EX_KEM_VERIFY), FINISH

See table below in microsecond (us) on Intel Core(TM) i7-8665U CPU @ 1.90 GHz.

  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_pub_key_mode RAW --hash SHA_256 --asym RSAPSS_3072
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_pub_key_mode RAW --hash SHA_256 --asym ECDSA_P256
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode CERT --hash SHA_256 --asym RSAPSS_3072 --pqc_sig DILITHIUM_2
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode CERT --hash SHA_256 --asym ECDSA_P256 --pqc_sig DILITHIUM_2
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512_90S --pqc_pub_key_mode CERT --hash SHA_256 --asym ECDSA_P256 --pqc_sig DILITHIUM_2_AES
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode CERT --hash SHA_256 --asym RSAPSS_3072 --pqc_sig FALCON_512
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode CERT --hash SHA_256 --asym ECDSA_P256 --pqc_sig FALCON_512
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode RAW --hash SHA_256 --asym RSAPSS_3072 --pqc_sig SPHINCS_HARAKA_128F_ROBUST
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode RAW --hash SHA_256 --asym RSAPSS_3072 --pqc_sig SPHINCS_SHA256_128F_ROBUST
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode RAW --hash SHA_256 --asym RSAPSS_3072 --pqc_sig SPHINCS_SHAKE256_128F_ROBUST
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode RAW --hash SHA_256 --asym ECDSA_P256 --pqc_sig SPHINCS_HARAKA_128F_ROBUST
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode RAW --hash SHA_256 --asym ECDSA_P256 --pqc_sig SPHINCS_SHA256_128F_ROBUST
  spdm_perf_emu.exe  --dhe SECP_256_R1 --pqc_kem KYBER_512 --pqc_pub_key_mode RAW --hash SHA_256 --asym ECDSA_P256 --pqc_sig SPHINCS_SHAKE256_128F_ROBUST
  spdm_perf_emu.exe  --dhe SECP_384_R1 --pqc_pub_key_mode RAW --hash SHA_384 --asym ECDSA_P384
  spdm_perf_emu.exe  --dhe SECP_384_R1 --pqc_kem KYBER_768 --pqc_pub_key_mode CERT --hash SHA_384 --asym ECDSA_P384 --pqc_sig DILITHIUM_3
  spdm_perf_emu.exe  --dhe SECP_384_R1 --pqc_kem KYBER_768_90S --pqc_pub_key_mode CERT --hash SHA_384 --asym ECDSA_P384 --pqc_sig DILITHIUM_3_AES
  spdm_perf_emu.exe  --dhe SECP_384_R1 --pqc_kem KYBER_768 --pqc_pub_key_mode CERT --hash SHA_384 --asym ECDSA_P521 --pqc_sig FALCON_1024
  spdm_perf_emu.exe  --dhe SECP_521_R1 --pqc_pub_key_mode RAW --hash SHA_512 --asym ECDSA_P521
  spdm_perf_emu.exe  --dhe SECP_521_R1 --pqc_kem KYBER_1024 --pqc_pub_key_mode CERT --hash SHA_512 --asym ECDSA_P521 --pqc_sig DILITHIUM_5
  spdm_perf_emu.exe  --dhe SECP_521_R1 --pqc_kem KYBER_1024_90S --pqc_pub_key_mode CERT --hash SHA_512 --asym ECDSA_P521 --pqc_sig DILITHIUM_5_AES
  spdm_perf_emu.exe  --dhe SECP_521_R1 --pqc_kem KYBER_1024 --pqc_pub_key_mode CERT --hash SHA_512 --asym ECDSA_P521 --pqc_sig FALCON_1024

This package is only the sample code to show the concept. It does not have a full validation such as robustness functional test and fuzzing test. It does not meet the production quality yet. Any codes including the API definition, the libary and the drivers are subject to change.