[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-relays] Post-Quantum Cryptography in Tor's TLS Layer: Help needed!
Hello Tor Relay Operators,
With the arrival of OpenSSL 3.5.0 in 2025, we finally had an important missing
piece of infrastructure to start enabling the Tor network to support
Post-Quantum Cryptography in the outermost cryptographic layer of the Tor
protocol. Since Tor version 0.4.8.17, we have supported the x25519/ML-KEM-768
hybrid handshake in our TLS layer, and we have gradually seen more relays
supporting it in the production network. Tor Browser has been built against
OpenSSL >= 3.5.0 since (at least) version 13.5.22, released in September 2025,
and therefore supports Post-Quantum TLS handshakes today, but it requires that
its guard node supports it. We need to give a big shout-out to the OpenSSL Team
here to get this out and available to the masses! <3
Since Q3 2025, I've been running some semi-regular scans of the Tor production
network to check for TLS cipher suite availability. This work started as part of
the first Tor Community Gathering back in October, 2025[1]. The results are as
follows:
In January, around 28% of the Tor relays supported the Post-Quantum TLS
handshake. The scan I did yesterday showed an increase of around 4 percentage
points to 32.32%.
Out of 9476 scanned relays, 9185 were reachable, 291 were unreachable. Of the
9185 reachable relays, I saw the following distribution of cipher suites:
`TLS13_AES_256_GCM_SHA384`: 9023 relays.
`TLS13_CHACHA20_POLY1305_SHA256`: 158 relays.
`TLS13_AES_128_GCM_SHA256`: 4 relays.
For the key exchange groups, I saw the following distribution:
`secp256r1`: 6212 relays.
`X25519MLKEM768`: 2969 relays.
`X25519`: 4 relays.
Of the Directory Authorities, 5 of them supported the `X25519MLKEM768` key
exchange group during the TLS handshakes.
2969 / 9185 * 100 = 32.32% of relays support the `X25519MLKEM768` cipher suite.
This number is a good start, but we should ideally bump it up!
You can see the individual results for your relay(s) in the big table available
at https://ahf.me/tor-tls-pqc/2026-02-26/ -- entries without a cipher suite or
key exchange group were unreachable at the time I ran the scan. These missing
entries can be due to a network problem anywhere on the path between my host and
yours, so don't get worried if your relay is missing :-)
The scanner I used is free software and is available as part of the Network
Health Team's Margot tool[2], used for various analysis purposes.
Please note that the goal here isn't to enumerate all available cipher suites
for each relay, but instead I'm interested in the "strongest" possible cipher
suite my custom client can negotiate with each relay.
My ask for you as the relay operator community here is as follows: Next time you
folks are doing maintenance on your relay(s), please have a look at whether you
can upgrade either your packages or underlying software distribution to a
version such that you either get a new enough version of OpenSSL (>= 3.5.0), or
if you are a LibreSSL user, check whether the LibreSSL project supports the
ML-KEM hybrid handshake, and upgrade to that version. It looks like the LibreSSL
project is currently working towards supporting the ML-KEM handshake in the next
upcoming release[3].
For Debian users, to get a new enough OpenSSL version that supports the PQC TLS
handshake, you need to upgrade to (at least) Debian Trixie. For everybody else,
it's best to check your respective software distribution's package management
system to find the version you need to upgrade to.
For Arti users, a licensing issue with the currently available crypto providers
in Arti prevented enabling the ML-KEM handshake. Nick, however, has recently
been making progress on this matter and has a patch up that is now pending
upstream review[4]! :-)
If you are excited about exploring different aspects of the Tor ecosystem,
talking with other Tor enthusiasts, and you have nothing planned for your
weekend in two weeks, I highly encourage you to look into the next Tor Community
Gathering in Denmark. The event takes place from 2026-03-13 to 2026-03-15. For
more information, check out our website at https://onionize.space/2026/
Thank you all for all the work you do to make Tor better! <3
Cheers,
Alex
[1]: https://onionize.space/2025/
[2]: https://gitlab.torproject.org/tpo/network-health/margot/
[3]:
https://github.com/libressl/portable/blob/a989b7acb9a475fde656e48dbcb38289de519a1d/ChangeLog#L40
[4]: https://github.com/RustCrypto/rustls-rustcrypto/pull/143
--
Alexander Hansen Færøy
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx