Add post-quantum cryptography (PQC) support to SSLConfig #53

kou · 2026-08-06T13:27:56Z

How about using ArgumentError instead of our custom exception class?

I checked the current situation on the master branch.

The reason why I created DRbBadConfig for bad configuration was because I saw the following exceptions classes.

$ grep -r '^.*class.*DRbError' lib lib/drb/drb.rb:# dRuby-specific errors, all of which are subclasses of DRb::DRbError. lib/drb/drb.rb: class DRbError < RuntimeError; end lib/drb/drb.rb: class DRbConnError < DRbError; end lib/drb/drb.rb: class DRbServerNotFound < DRbError; end lib/drb/drb.rb: class DRbBadURI < DRbError; end lib/drb/drb.rb: class DRbBadScheme < DRbError; end lib/drb/drb.rb: class DRbUnknownError < DRbError lib/drb/drb.rb: class DRbRemoteError < DRbError

However, now I notice Ruby standard exception classes ArgumentError, NoMethodError, and SecurityError are also used.

$ grep -r raise lib/ | grep -E 'ArgumentError|NoMethodError|SecurityError' lib/drb/drb.rb: raise(ArgumentError, "#{any_to_s(msg_id)} is not a symbol") unless Symbol == msg_id.class lib/drb/drb.rb: raise(SecurityError, "insecure method '#{msg_id}'") if insecure_method?(msg_id) lib/drb/drb.rb: raise NoMethodError, "private method '#{msg_id}' called for #{desc}" lib/drb/drb.rb: raise NoMethodError, "protected method '#{msg_id}' called for #{desc}" lib/drb/drb.rb: raise NoMethodError, "private method '#{msg_id}' called for #{desc}" lib/drb/drb.rb: raise NoMethodError, "protected method '#{msg_id}' called for #{desc}"

I also see the following code and past commit about raising DRb custom exception classes.

drb/lib/drb/drb.rb

Lines 511 to 513 in 2b002d4

rescue NameError, ArgumentError

DRbUnknown.new($!, s)

end

drb/lib/drb/drb.rb

Lines 619 to 623 in 2b002d4

begin

Marshal::load(str)

rescue NameError, ArgumentError

DRbUnknown.new($!, str)

end

The commit 0be5d9b is notable. This commit replaced the raised exception class from ArgumentError to DRbConnError. Though I don't know the context or reason of this change.

And I personally interpret the above code comment "dRuby-specific errors, all of which are subclasses of DRb::DRbError". We should use DRb specific (custom) exception classes for DRb specific things, that is anything that can happen in ruby/drb.

What is your justification or reason to use Ruby's standard ArgumentError class rather than DRb custom exception classes?

kou · 2026-08-06T13:16:44Z

Can we simplify these conditions?

Suggested change

@certs = nil

if config[:SSLCertificate] && config[:SSLPrivateKey]

@certs = [[config[:SSLCertificate], config[:SSLPrivateKey]]]

end

@certs = config[:SSLCertificates] if config.key?(:SSLCertificates)

if config.key?(:SSLCertificates)

@certs = config[:SSLCertificates]

elsif config[:SSLCertificate] && config[:SSLPrivateKey]

@certs = [[config[:SSLCertificate], config[:SSLPrivateKey]]]

else

@certs = nil

end

kou · 2026-08-06T13:36:16Z

Why do you ignore :SSLCertificates when :SSLCertificate and :SSLPrivateKey are specified? (Why don't you mix them/)

You are right. When I implemented and wrote the logic that :SSLCertificates overrides :SSLCertificate and :SSLPrivateKey. But this is my logic bug. This config option input behavior confuses users. Obviously we shouldn't mix the config option check between SSLCertificates and :SSLCertificate/:SSLPrivateKey even when we manage the internal value as one @certs. Maybe when I got an idea that managing internal value as one @certs for both :SSLCertificates and :SSLCertificate/:SSLPrivateKey, that made me blind, thinking such a mixed input check logic. I will fix it.

# :SSLCertificates :: # An Array of [certificate, private_key] pairs. Each element # is an Array of an OpenSSL::X509::Certificate and its # corresponding private key. This option is prioritized over # :SSLCertificate and :SSLPrivateKey. See # OpenSSL::SSL::SSLContext#add_certificate

kou · 2026-08-06T13:17:15Z

Do we need config[:SSLPrivateKeyAlgorithms] || here?

Suggested change

@pkey_algs = config[:SSLPrivateKeyAlgorithms] ||

self[:SSLPrivateKeyAlgorithms]

@pkey_algs = self[:SSLPrivateKeyAlgorithms]

You are right. The self[:SSLPrivateKeyAlgorithms] is good enough considering the value by argument config. I will fix it.

def initialize(config) @config = config

# A convenience method to access the values like a Hash def [](key); @config[key] || DEFAULT[key] end

kou · 2026-08-06T13:27:14Z

Why do you want to make setup_ssl_context public? It's just for test? If so, we should not make it public. We can use __send__ in test.

In the current master branch 2b002d4, the setup_ssl_context is already public method. I didn't change the method from private to public.

drb/lib/drb/ssl.rb

Line 203 in 2b002d4

def setup_ssl_context

rhenium · 2026-08-01T18:52:20Z

OpenSSL 1.0.2 is the minimum version supported by ruby/openssl bundled with non-EOL Ruby versions. I think you can forget about even older versions.

OK. I will remove the "1.0.2" information.

kou · 2026-08-06T13:37:56Z

Do we need this check? I think that NoMethodError is enough without this check.

I intended the this check to notify users the cause of the errors, and how to fix, notifying the information they need to upgrade Ruby OpenSSL or/and OpenSSL. At the same time, I don't understand how the standard libraries like ruby/drb should handle in the missing method cases due to old dependent libraries. So, if you say so, I will remove this check.

rhenium · 2026-08-01T18:45:31Z

Suggested change

cert.public_key = pkey.public_key

cert.public_key = pkey

I recognize this was taken from the original code, but the OpenSSL::PKey::RSA#public_key call was unnecessary. In OpenSSL's design, a private key can always act as a public key.

I see. The examples of OpenSSL::PKey::RSA#public_key to set to OpenSSL::X509::Certificate#public_key are documented below. Maybe shall we improve the examples not to use OpenSSL::PKey::RSA#public_key in ruby/openssl?

https://github.com/ruby/openssl/blob/e324933034dffe45dce64b83c351d545c0fc93c4/ext/openssl/ossl_x509cert.c#L925

https://github.com/ruby/openssl/blob/e324933034dffe45dce64b83c351d545c0fc93c4/ext/openssl/ossl_x509cert.c#L946

I didn't realize it was in ruby/openssl's docs. Yes, it's unnecessary and we should clean it up.

The only valid use case for RSA#public_key was in method chains with #to_der/#to_pem (e.g., rsa.public_key.to_der), but it should be updated to use rsa.public_to_der nowadays.

rhenium · 2026-08-01T18:49:51Z

This should work with all ruby/openssl versions as long as it's linked with OpenSSL >= 3.5. Perhaps it's best to pass through the OpenSSL::PKey::PKeyError (for minimum amount of code in drb, and for allowing the user see the raw context information that may be added by OpenSSL)?

Maybe you are talking about the following part.

begin pkey = OpenSSL::PKey.generate_key(pkey_alg) rescue OpenSSL::PKey::PKeyError

For the topic to pass through OpenSSL::PKey::PKeyError, a similar topic to pass through NoMethodError is also suggested on another thread https://github.com/ruby/drb/pull/53/changes#r3729234016. Considering these 2 similar suggestions from you and kou, I would agree with you guys that we should pass through the OpenSSL::PKey::PKeyError and NoMethodError without rescuing these exception classes. I will fix it.

-Original file line number
+Diff line change
@@ Expand Up / @@ -4,6 +4,7 @@ @@
     require 'drb/drb'
     require 'drb/extservm'
     require 'timeout'
+    require_relative 'drbtest_utils'
     module DRbTests
@@ Expand Down Expand Up / @@ -393,4 +394,90 @@ def test_07_break_18 @@
     end
+    # A PQC Utilities module inspired from ruby/rubygems omit_unless_support_pqc
+    module DRbPQCUtilities
+      # PQC algorithms ML-KEM and ML-DSA require OpenSSL >= 3.5.
+      # https://openssl-library.org/post/2025-04-08-openssl-35-final-release/
+      def support_pqc_openssl?
+        OpenSSL::OPENSSL_VERSION_NUMBER >= 0x30500000
+      end
+      # Ruby OpenSSL >= 4.0 supports OpenSSL::SSL::SSLContext#groups,
+      # OpenSSL::SSL::SSLSocket#sigalg, #peer_sigalg used in PQC cases, fixing the
+      # following issue.
+      # https://github.com/ruby/openssl/blob/v4.0.0/History.md#notable-changes
+      # https://github.com/ruby/openssl/commit/9614b7f67a629cc8d31b6fe5be5040c68263ca8b
+      def support_pqc_ruby_openssl?
+        Gem::Version.new(OpenSSL::VERSION) >= Gem::Version.new('4.0')
+      end
+      # Probe an actual PQC handshake between a forced-PQC server and a
+      # default-configured client, mirroring what the integration tests exercise.
+      # Memoized so the probe runs at most once per process.
+      def support_pqc_handshake?
+        return @support_pqc_handshake unless @support_pqc_handshake.nil?
+        @support_pqc_handshake = probe_pqc_handshake
+      end
+      def probe_pqc_handshake
+        server = TCPServer.new('127.0.0.1', 0)
+        ctx = OpenSSL::SSL::SSLContext.new
+        ctx.add_certificate(
+          Fixtures.read_cert('mldsa65_server.crt'),
+          Fixtures.read_pkey('mldsa65_server.key'))
+        ctx.groups = 'X25519MLKEM768'
+        ssl_server = OpenSSL::SSL::SSLServer.new(server, ctx)
+        port = server.addr[1]
+        server_thread = Thread.new do
+          client = ssl_server.accept
+          client.close
+        rescue OpenSSL::OpenSSLError
+          nil
+        end
+        client_ctx = OpenSSL::SSL::SSLContext.new
+        client_ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        socket = TCPSocket.new('127.0.0.1', port)
+        ssl = OpenSSL::SSL::SSLSocket.new(socket, client_ctx)
+        ssl.connect
+        ssl.close
+        true
+      rescue OpenSSL::OpenSSLError, SystemCallError
+        false
+      ensure
+        server_thread&.join(5)
+        server_thread&.kill if server_thread&.alive?
+        ssl_server&.close
+        server&.close
+      end
+      def omit_unless_support_pqc
+        unless support_pqc_openssl?
+          yield if block_given?
+          omit 'PQC algorithms require OpenSSL >= 3.5'
+          return
+        end
+        unless support_pqc_ruby_openssl?
+          yield if block_given?
+          omit 'PQC test requires Ruby OpenSSL >= 4.0'
+          return
+        end
+        unless support_pqc_handshake?
+          yield if block_given?
+          omit 'PQC handshake is not available in this OpenSSL configuration'
+        end
+      end
+    end
+    module DRbPQC
+      include DRbBase
+      include DRbPQCUtilities
+      def test_01_hello
+        assert_equal('hello', @there.hello)
+      end
+    end
     end

Uh oh!

Add post-quantum cryptography (PQC) support to SSLConfig #53

Are you sure you want to change the base?

Uh oh!

Add post-quantum cryptography (PQC) support to SSLConfig #53

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

kou Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

junaruga Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kou Aug 6, 2026 •

edited

Loading

junaruga Aug 12, 2026 •

edited

Loading