Hybrid post-quantum cryptography in SSL deep inspection in flow mode 7.6.5

FortiGate now supports TLS 1.3 hybrid Post-Quantum Cryptography (PQC) key exchanges in SSL deep inspection (flow mode), enabling secure traffic inspection. This enhancement ensures compatibility with modern browsers and PQC-enabled servers that utilize algorithms such as X25519MLKEM768.

test.openquantumsafe.org:6003 supports X25519MLKEM768 as the key exchange algorithm.

Clients were unable to access web servers that used hybrid post-quantum cryptography (PQC) key exchange due to limitations in the previous IPS Engine.

With the updated IPS Engine that includes support for the new feature, clients can now successfully access web servers using hybrid PQC key exchange.

When using TLS 1.3 with the X25519MLKEM768 (hybrid PQC) key exchange, we can confirm that the IPS SSL Status displays the supported groups and their trigger counters in the TLS 1.3 (EC)DHE Named Groups section.

The following shows the status of IPS SSL when X25519MLKEM768 hybrid PQC was triggered once:

# diagnose ips ssl status
---------------------------------------------------------
TLS 1.3 (EC)DHE Named Groups:

   secp256r1:  0
   secp384r1:  0
   secp521r1:  0
      x25519:  0
        x448:  0
   ffdhe2048:  0
   ffdhe3072:  0
   ffdhe4096:  0
   ffdhe6144:  0
   ffdhe8192:  0
    mlkem512:  0
    mlkem768:  0
   mlkem1024:  0
  secp256r1mlkem768:  0
  x25519mlkem768:  1
  secp384r1mlkem1024:  0
---------------------------------------------------------