KEM being used

[KrishCrS]

How to understand that a quantum-safe key exchange via the Kyber768 is being used instead of Diffie-Hellman key exchange ?
Neither I am able to find anything related the term "Kyber" in openvpn-status.log nor in terminal where client.config was running. Even this KEM is not mentioned in config files. Only we can see that dilithium3 is being used to generate key and certificates. Can you please help in this matter so that we can observer that Kyber KEM is happening ?

[baentsch]

Even this KEM is not mentioned in config files.

It is:

oqs-demos/openvpn/openvpn-openssl.cnf

Line 64 in aa063be

Groups = kyber768:p384_kyber768

that we can observer that Kyber KEM is happening ?

Get Wireshark to run as per #227

[KrishCrS]

Thanks a lot.

[Alestrix]

There are setups where using wireshark or tcpdump is not possible (in my case it's an openstack platform centrally hosted by the enterprise where in the VMs I cannot enable promisuous mode on the network interfaces).

Since the client connecting to the OQS-enabled server should know whether it's using PQ algorithms, is there no way to share that info with the user? Like some info from curl -vv or from openssl s_client -debug?

[baentsch]

Since the client connecting to the OQS-enabled server should know whether it's using PQ algorithms, is there no way to share that info with the user? Like some info from curl -vv or from openssl s_client -debug?

Hmm, that'd be some feature of openssl (outputting KEM used, e.g., by openssl s_client code calling SSL_get_negotiated_group). But then again, what's wrong with the openssl s_client "-groups" option? By setting this appropriately you can be sure to only have PQ groups used.