How to set OQS algorithm (KEX/SIG) using C API?

[mkcdot]

Hi,

I am using oqs-openssl library for TLS communication between client and server written in C. I am using regular openssl code used for TLS, with only change of using certificates generated using oqs-openssl command (as per README.md) with SIG set as dilithium2.
I have linked oqs-openssl crypto and ssl libraries and oqs library while compiling.

When I client communicates with server, server uses x25519 kex and not kyber or any oqs algorithm. Is there any API to force server and client use oqs algorithms for communucation?

[baentsch]

Is there any API to force server and client use oqs algorithms for communucation?

This (and alternatively SSL_CTX_set1_groups) should work as-is for OpenSSL111, too. We do recommend using OpenSSL3, though, as it's supported beyond September 2023.

[mkcdot]

Thanks for the answer. Using SSL_CTX_set1_groups() with NID list is throwing error. But I am able to use SSL_CTX_set1_groups_list() with string list of kex algorithm names. Now client is sending group(s) as set using SSL_CTX_set1_groups_list() and key exchange is happening as per that group.