update supported groups for TLS#55589
Conversation
The underlying boringssl version used in envoy now supports the group X25519MLKEM768. Enable this support in Istio
|
😊 Welcome @navaneethrameshan! This is either your first contribution to the Istio istio repo, or it's been You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines Thanks for contributing! Courtesy of your friendly welcome wagon. |
|
Hi @navaneethrameshan. Thanks for your PR. I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/ok-to-test |
|
/retest |
* upstream/master: Bump modules and minimum go version (istio#55514) update supported groups for TLS (istio#55589) Automator: update proxy@master in istio/istio@master (istio#55590)
Upstream Istio 1.25+ supports X25519MLKEM768 natively via BoringSSL (istio/istio#55589). Clarify that this project's OQS/OpenSSL approach is specific to OSSM builds.
Please provide a description of this PR:
The underlying boringssl version used in envoy now supports the hybrid group
X25519MLKEM768for TLS key exchange. Enable support for this group in Istio.The dependency of istio -> proxy -> envoy -> boringssl is the following:
Istio -> proxy : proxy SHA
Proxy -> envoy: envoy SHA
Envoy -> boringssl: boringssl version
BoringSSL - supported groups