Post-Quantum Cryptography (PQC) Support (8.0.3)

FortiWeb 8.0.3 introduces support for post-quantum cryptography (PQC) in TLS 1.3, enabling administrators to adopt quantum-resilient key exchange and signature mechanisms as part of their encrypted traffic strategy. With new PQC capabilities provided through the OpenSSL 3.5 integration, FortiWeb can negotiate key exchange groups such as ML-KEM and hybrid ECC-PQC modes to strengthen long-term confidentiality against emerging quantum threats.

PQC controls are available through CLI configuration for both client-side and server-side TLS settings.

Enhancements

• New PQC key exchange groups for TLS 1.3, including ML-KEM variants and hybrid ECC-PQC combinations.

• PQC configuration available for both server policies and server pool connections, allowing end-to-end TLS flows to adopt PQC.

• PQC signature algorithms (ML-DSA) included through OpenSSL 3.5, with certificate selection available in CLI.

Supported Algorithms

Key Exchange Groups (TLS 1.3)

• mlkem512

• mlkem768

• mlkem1024

• secp256r1mlkem768

• secp384r1mlkem1024

• x25519mlkem768

Signature Algorithms

• mldsa44

• mldsa65

• mldsa87

PQC algorithms are available only for TLS 1.3 sessions.

Configuration

PQC is configured through the CLI. TLS 1.3 must be enabled before PQC key exchange groups can be selected. PQC settings can be applied to both the client-side TLS handshake (server policy) and the server-side connection (server pool).

Server Policy

config server-policy policy
    edit <name>
        set tls-v13 enable
        set tls-pqc-support enable
        set tls-pqc-groups mlkem512 mlkem768 mlkem1024 \
            secp256r1mlkem768 secp384r1mlkem1024 x25519mlkem768
    next
end

Server Pool (Proxy-to-Server Connection)

config server-policy server-pool
    edit <pool_name>
        config pserver-list
            edit 1
                set tls-v13 enable
                set tls-pqc-support enable
                set tls-pqc-groups mlkem512 mlkem768 mlkem1024 \
                    secp256r1mlkem768 secp384r1mlkem1024 x25519mlkem768
            next
        end
    next
end

Limitations

• PQC support depends on OpenSSL 3.5 and is available only for TLS 1.3 handshakes.

• The slh-dsa signature algorithm is not supported because its TLS signature identifier has not yet been standardized.