Enabling PQC on Server

Edit online

Protect your server with Post-Quantum Cryptography to keep sensitive data secure against quantum-powered attacks.

Securing server with Post-Quantum Cryptography protects the heart of infrastructure—where sensitive data is stored, processed, and managed. A quantum-protected server ensures that sensitive data remain encrypted and inaccessible to quantum-powered attacks, even if attackers gain physical or remote access to your systems. This creates a trusted foundation for your entire ecosystem, as all client communications, data storage, and backend operations originate from a quantum-resistant secure base.

Securing Data at Rest
  1. Disabling FIPS mode for cryptography: Set ibm-slapdUseNonFIPSCrypt to true in the cn=Configuration stanza
    Example: Disabling FIPS mode for cryptography 
    /opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i fipsDisable.ldif
    Contents of fipsDisable.ldif: 
    dn: cn=Configuration
changetype: modify
replace: ibm-slapdUseNonFIPSCrypt
ibm-slapdUseNonFIPSCrypt: TRUE
  2. Enable PQC: Set ibm-slapdPQCMode to either PQC_HYBRID or PQC_ONLY in the cn=Configuration stanza
    Example: Enabling PQC Server Mode 
    /opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i pqcServerEnable.ldif
    Contents of pqcServerEnable.ldif: 
    dn: cn=Configuration
changetype: modify
replace: ibm-slapdPQCMode
ibm-slapdPQCMode: PQC_ONLY
    Table 1. Supported Values for ibm-slapdPQCMode
    Value Description
    PQC_DISABLED Disables quantum-resistant cryptography, using only traditional algorithms. This is the default (out-of-the-box) value.
    PQC_HYBRID Enables hybrid mode where both traditional and quantum-resistant algorithms are available. The server can communicate over all configured protocols including TLSv1.3. Passwords are encrypted using the algorithm specified in the ibm-slapdPwEncryption property. A warning is issued if the specified algorithm is not quantum-safe.
    PQC_ONLY Enforces exclusive use of quantum-resistant cryptographic algorithms. All security protocols except TLSv1.3 are disabled. Connections are accepted only on TLSv1.3 using either quantum-resistant or traditional algorithms. An error is returned if the ibm-slapdPwEncryption algorithm is not quantum-safe. Only AES256, SHA512, SSHA512, ARGON2, and SCRYPT are considered quantum-safe in this mode.
  3. Configure quantum-safe password encryption: Set ibm-slapdPwEncryption to use a quantum-safe algorithm in the cn=Configuration stanza
    Example: Configuring ARGON2 Password Encryption 
    /opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i argon.ldif

    Contents of argon.ldif:

    dn: cn=Configuration
changetype: modify
replace: ibm-slapdPwEncryption
ibm-slapdPwEncryption: argon2
    Supported quantum-safe password encryption algorithms:
    • AES256
    • SHA512
    • SSHA512
    • ARGON2
    • SCRYPT

  4. Restart the server after making the changes

Securing Data in Transit
To ensure quantum-safe communication between server and client, follow these steps:
  1. Disable FIPS mode: Set ibm-slapdUseNonFIPSCrypt to true in the cn=Configuration stanza
    Example: Disabling FIPS Mode 
    /opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i fipsDisable.ldif
    Contents of fipsDisable.ldif: 
    dn: cn=Configuration
changetype: modify
replace: ibm-slapdUseNonFIPSCrypt
ibm-slapdUseNonFIPSCrypt: TRUE
  2. Disable SSL FIPS mode: Set ibm-slapdSslFIPSProcessingMode to false in the cn=SSL, cn=Configuration stanza
    Example: Disabling SSL FIPS Mode 
    /opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i sslFipsDisable.ldif
    Contents of sslFipsDisable.ldif: 
    
dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSslFIPSProcessingMode
ibm-slapdSslFIPSProcessingMode: FALSE
  3. Enable SSL communication: Set ibm-slapdSecurity to either SSL, SSLOnly, or SSLTLS in the cn=SSL, cn=Configuration stanza
    Example: Enabling SSL 
    /opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i sslEnable.ldif
    Contents of sslEnable.ldif: 
    dn: cn=SSL, cn=Configuration
changetype: modify
replace: ibm-slapdSecurity
ibm-slapdSecurity: SSLTLS
  4. Enable PQC on server: Set ibm-slapdPQCMode to either PQC_HYBRID or PQC_ONLY in the cn=Configuration stanza
    Example: Enabling PQC Server Mode 
    /opt/ibm/ldap/V11.0.1/bin/idsldapmodify -h <hostname> -p <port> -D <adminDN> -w <admin_password> -i pqcServerEnable.ldif
    Contents of pqcServerEnable.ldif: 
    dn: cn=Configuration
changetype: modify
replace: ibm-slapdPQCMode
ibm-slapdPQCMode: PQC_ONLY
    1. Restart the server after making the changes