From e584e68548786054e85c16debf096f029a7c9cb3 Mon Sep 17 00:00:00 2001 From: ramnbt Date: Sat, 24 Oct 2026 10:54:00 -0500 Subject: [PATCH] tls: enable hybrid post-quantum key exchange (X25519MLKEM768) Generated by crypt 0.0.1-dev; templates T1-tls-curvepreferences-x25519mlkem768; all verification gates passed in a sandbox build (compile, diff-isolation proof, ML-KEM KAT, OpenSSL interop, rescan). Evidence: crypt-evidence.json --- server.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server.go b/server.go index 5c2cca50..e38bf795 100644 --- a/server.go +++ b/server.go @@ -224,7 +224,7 @@ func (s *Server) Serve() (err error) { httpsServer.TLSConfig = &tls.Config{ // Only use curves which have assembly implementations // https://github.com/golang/go/tree/master/src/crypto/elliptic - CurvePreferences: []tls.CurveID{tls.CurveP256}, + CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.CurveP256}, // Use modern tls mode https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility NextProtos: []string{"h2", "http/1.1"}, // https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule_-_Only_Support_Strong_Protocols