chore(generator): add post-quantum cryptography (PQC) integration tests - #17586
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for mTLS in REST transport fixtures within conftest.py and introduces a new integration test in test_pqc.py to verify Post-Quantum Cryptography (PQC) negotiation with the Showcase server. The review feedback highlights several critical improvements: resolving a compatibility issue with urllib3 v2.0+ by overriding cert_verify instead of using assert_hostname in PoolManager, adding defensive None checks for gRPC metadata and interceptor attributes to prevent runtime errors, and avoiding shadowing the built-in dir function.
e6c889a to
2d0fe09
Compare
ohmayr
changed the title
| # Enforce PQC compliance (X25519MLKEM768) | ||
| assert ( | ||
| "MLKEM" in negotiated_group | ||
| ), f"Failed: {transport_name} Connection did not negotiate X25519MLKEM768! Negotiated: {negotiated_group}" |
There was a problem hiding this comment.
Do we need to check for X25519MLKEM768 exectly? or *MLKEM*? The assertion and comments seem to suggest different things
There was a problem hiding this comment.
We check "MLKEM" in negotiated_group instead of exact string matching (== "X25519MLKEM768") to ensure compatibility across different TLS implementations (BoringSSL on gRPC vs OpenSSL on REST), which format group strings slightly differently (e.g. X25519MLKEM768 vs X25519MLKEM768Draft00).
There was a problem hiding this comment.
Gemini says there is also secp256r1MLKEM768. It seems like that's another post-quantum algorithm, but I'm not sure if that's one we want to support or not.
Maybe we should either change the comments to be more general, or the assertion to be more specific?
There was a problem hiding this comment.
Honestly, these tests run against Showcase server so it doesn't really matter much.
However, current goal is that we support a Hybrid group which we'll default too. In future, we'll default to a PURE PQC group. So in reality, the backend will only return what they're defaulting too. Keeping it generic is more robust for us.
…ts (#17586) Adds integration tests against showcase to verify that our libraries support PQC TLS key exchange. To verify, you can run `nox -s showcase_pqc`.
2 participants
Adds integration tests against showcase to verify that our libraries support PQC TLS key exchange.
To verify, you can run
nox -s showcase_pqc.