As we move toward post quantum crypto, selecting and/or detecting hybrid TLS 1.3 groups (ie; Eliptic Curve Crypto [ECC] + MLKEM) is paramount.
Today, this data is not exposed through various .NET methods, such as the ASP.NET code below.
app.MapGet("/", (HttpContext ctx) =>
{
var tls = ctx.Features.Get<ITlsHandshakeFeature>();
return Results.Json(new
{
Protocol = tls?.Protocol.ToString() ?? "Unknown",
CipherSuite = tls?.NegotiatedCipherSuite?.ToString() ?? "Unknown"
});
});An update would include some like this:
CipherGroup = tls?.NegotiatedGroup?.ToString() ?? "Unknown"
This would require additional pub enums that include the group value:
public enum TlsSupportedGroup : ushort
{
// Classical ECDHE (RFC 8446 §4.2.7, RFC 8422).
secp256r1 = 0x0017, // NIST P-256
secp384r1 = 0x0018, // NIST P-384
x25519 = 0x001D, // RFC 7748
// Hybrid ECDHE + ML-KEM (draft-kwiatkowski-tls-ecdhe-mlkem).
SecP256r1MLKEM768 = 0x11EB,
X25519MLKEM768 = 0x11EC,
SecP384r1MLKEM1024 = 0x11ED,
}This list is not complete, but I doubt you want the entire list; it runs to about 100-ish values.
For bonus points; the following would be useful:
IsHybrid() - classic AND MLKEM
IsPostQuantum() - MLKEM OR IsHybrid()
IsPurePostQuantum() - MLKEM
IsClassic() - classic
Note: the group is negotiated separately from the ciphersuite in TLS 1.3.
If you want more info - just ask.
As we move toward post quantum crypto, selecting and/or detecting hybrid TLS 1.3 groups (ie; Eliptic Curve Crypto [ECC] + MLKEM) is paramount.
Today, this data is not exposed through various .NET methods, such as the ASP.NET code below.
An update would include some like this:
This would require additional pub enums that include the group value:
This list is not complete, but I doubt you want the entire list; it runs to about 100-ish values.
For bonus points; the following would be useful:
Note: the group is negotiated separately from the ciphersuite in TLS 1.3.
If you want more info - just ask.