OpenStack Crypto-Agility Vulns: Missing PQC & TLS 1.3 Support

OpenStack Post-Quantum Cryptographic Agility Vulnerability Summary Overview Core Issue: OpenStack has a large number of hardcoded cryptographic algorithms (e.g., RSA, ECDSA P-256) and TLS protocol version limitations, preventing a smooth transition to post-quantum cryptography (PQC) algorithms. Key Risks: - Barbican: Hardcoded RSA/ECDSA key generation, with no PQC support. - Keystone: JWS signing is hardcoded to ECDSA P-256, with no configuration options. - oslo.messaging: RabbitMQ TLS configuration hardcodes to TLS 1.2, and the maps to the TLS 1.3 constant, making it impossible to enable TLS 1.3. - Certificate Verification Bypass: and are widely used in Go and Python components, removing critical layers of security. - Kubernetes Default Cryptography: cert-manager defaults to using RSA-2048, without configuring PQC hybrid key exchange. Scope of Impact Analysis Scale: 27 teams, 90+ repositories, 572 findings. High-Risk Components: - Barbican: Key generation and storage. - Keystone: Authentication and signing. - oslo.messaging: Inter-service communication. - cert-manager: Kubernetes certificate management. - OpenStack Operator: Certificate templates and configuration. Impact: All OpenStack deployments relying on the above components are affected, particularly when enabling TLS 1.3 or PQC. Remediation Barbican: - Added configuration option, supporting EC, RSA, DSA, and PQC (e.g., ML-KEM, ML-DSA). - Refactored the internal function to support PQC key pair generation. Keystone: - Added configuration option, allowing administrators to specify accepted JWS signature algorithms (e.g., ES256, ES384, ES512, EdDSA). - Support for PQC signature algorithms (e.g., ML-KEM, ML-DSA). oslo.messaging: - Removed the hardcoded and replaced it with a configurable , supporting TLS 1.3. - Updated the RabbitMQ driver to support PQC hybrid key exchange. cert-manager: - Configured to enable TLS 1.3. - Support for PQC certificates and key exchange. OpenStack Operator: - Updated certificate templates to support PQC algorithms. - Configured to enable TLS 1.3. POC Code / Exploit Code

Goal Reached Thanks to every supporter — we hit 100%!

OpenStack Crypto-Agility Vulns: Missing PQC & TLS 1.3 Support