Enabling Post Quantum Cryptography

You can enable post quantum cryptography (PQC) on Windows and Linux computers in a CommCell environment, including the CommServe computer, the Web Server computer, the MediaAgent, and client computers. Post quantum cryptography provides resistance against attacks from quantum computers.

Before You Begin

On Windows computers where you plan to install the CommServe server, the Web Server computer, or the Command Center, add MaxRequestBytes and MaxFieldLength keys to the registry as follows:

1. Open the Windows Registry Editor and then go to the HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/HTTP/Parameters directory.

2. Create a new DWORD (32-bit) key named MaxRequestBytes with a value 30720 (30 KB).

3. Create a new DWORD (32-bit) key named MaxFieldLength with a value 30720 (30 KB).

4. Close the Registry Editor.

5. Reboot the computer.

Procedure

1. Install the CommServe computer where you plan to enable PQC.

   Important

   Ensure that no clients are installed and communicating with the CommCell yet. Client installations in PQC mode are supported only after PQC has been enabled on the CommServe server.

2. Add the sPostQuantumCerts additional setting to the CommServe computer as shown in the following table.

   For information about adding an additional setting to a server or server group, see Adding a Setting for Servers and Server Groups.

   Property	Value
   Name	sPostQuantumCerts
   Category	Session
   Type	String
   Value	dilithium3

3. Add the sPostQuantumKEM additional setting to the CommServe computer as shown in the following table.

   For information about adding an additional setting to a server or server group, see Adding a Setting for Servers and Server Groups.

   Property	Value
   Name	sPostQuantumKEM
   Category	Session
   Type	String
   Value	kyber1024

4. Restart services on the CommServe computer to renew the CA and generate a new client certificate.

What to Do Next

• Proceed with client installations, and select Post Quantum Cryptography (PQC) mode enabled on CommServe during installation.

  For more information, see the following:

  - Installing Commvault Locally on Windows Computers Using Installation Package

  - Installing the Production CommServe Host

  Note

  PQC certificates will be created under the Base/certificates folder. In addition, a folder named rest will be created under the Base/certificates folder. Certificates under the rest folder are used for web service communication.

  To verify if certificates are generated with new algorithms, decode the contents of individual certificates under the Base/certificates folder and confirm there is no mention of RSA or SHA. Use the following command:

  openssl x509 -in <cert file>.pem -text -noout
  

  Alternatively, you can check the file size for newly generated certificates. The newly generated certificates will be larger in size compared to previous ones. Use the following command on Linux computers:

  ls -lh