Skip to main content

Using PQC to secure MQTT with TrustEdge

This tutorial walks you through setting up a TLS 1.3 session secured by post-quantum cryptography (PQC). You will generate ML-DSA certificates with TrustEdge, configure an open-source Mosquitto MQTT broker, and run TrustEdge MQTT clients to exchange messages over a PQC-protected channel.

Before you begin

Make sure you understand the following:

  • You need a TrustEdge compatible device.

  • GitHub CLI to clone TrustEdge repository.

Step 1: Install TrustEdge

  1. Download the appropriate TrustEdge release .deb package for your CPU architecture:

    # 64-bit Intel/AMD (x86_64)
wget https://github.com/digicert/trustedge/releases/download/trustedge_24.7.2-2187/trustedge_24.7.2-2187.x86_64.deb

# 64-bit ARM (AArch64)
wget https://github.com/digicert/trustedge/releases/download/trustedge_24.7.2-2187/trustedge_24.7.2-2187.aarch64.deb

# 32-bit ARM
wget https://github.com/digicert/trustedge/releases/download/trustedge_24.7.2-2187/trustedge_24.7.2-2187.arm.deb

  2. Remove any previous TrustEdge installation:

    sudo apt remove --purge trustedge

  3. Install the new package:

    sudo dpkg -i trustedge_24.7.2-2187.<cpu_arch>.deb

  4. Verify version ≥ v24.7.2-2187:

    trustedge --version

Step 2: Clone TrustEdge repository

  1. Clone the TrustEdge repository for the PQC demo tools:

    git clone https://github.com/digicert/trustedge.git

  2. Go to the pqc-demo directory:

    cd trustedge/examples/pqc-demo

Step 3: Generate ML-DSA certificates

  1. Copy the PQC demo CSR configuration files to the /etc/digicert/keystore/conf directory:

    sudo cp ca_csr.cnf /etc/digicert/keystore/conf
sudo cp server_csr.cnf /etc/digicert/keystore/conf

    Tip

    You can automate the next steps by running the PQC demo script certGeneration.sh. If you decide to automate this process, skip to Step 4: Configure and start the MQTT broker.

  2. Generate root CA key and certificate:

    sudo trustedge certificate -a QS -g MLDSA_44 -o CA.key -x CA.crt -i ca_csr.cnf -da 3651

  3. Generate server key and certificate signed by the root CA:

    sudo trustedge certificate -a QS -g MLDSA_44 -o server.key -x server.crt -i server_csr.cnf -da 3651 -sk CA.key -sc CA.crt

  4. Verify server and CA certificates:

    sudo trustedge certificate -pc /etc/digicert/keystore/certs/server.crt
sudo trustedge certificate -pc /etc/digicert/keystore/certs/CA.crt

  5. Copy server certificate and key to the PQC demo keystore/ directory:

    sudo cp /etc/digicert/keystore/keys/server.key ./keystore/server.key
sudo cp /etc/digicert/keystore/certs/server.crt ./keystore/server.crt

  6. Copy CA certificate and key to the PQC demo keystore/ directory:

    sudo cp /etc/digicert/keystore/keys/CA.key ./keystore/CA.key
sudo cp /etc/digicert/keystore/certs/CA.crt ./keystore/CA.crt

Step 4: Configure and start the MQTT broker

  1. Add the following MQTT server entry to your /etc/hosts configuration file:

    127.0.0.1 mqtt-pqc-broker

  2. Make start_broker.sh executable:

    chmod +x start_broker.sh

  3. Launch the MQTT broker with TLS 1.3 and ML-DSA credentials:

    ./start_broker.sh --cert ./keystore/server.crt --key ./keystore/server.key

  4. Confirm broker is listening on port 8883:

    ss -tlnp | grep 8883

Step 5: Run TrustEdge subscriber

  1. Make consumer.sh executable:

    chmod +x consumer.sh

  2. Subscribe to topic pqc/secure/channel:

    ./consumer.sh --broker mqtt-pqc-broker --port 8883 --ca-cert ./keystore/CA.crt

  3. You should see a “Connected” message followed by readiness to receive.

Step 6: Run TrustEdge publisher

  1. Make publisher.sh executable:

    chmod +x publisher.sh

  2. Publish a test message to pqc/secure/channel:

    ./publisher.sh --broker mqtt-pqc-broker --port 8883 --ca-cert ./keystore/CA.crt

Step 7: Capture and decrypt handshake in Wireshark

You can capture MQTT traffic on the loopback interface using Wireshark. Configure Wireshark to use your (pre)-master-secret log, filter for TLS packets, and then inspect both the hybrid key-exchange parameters and the server’s PQC x.509 certificate.

Capture traffic on the loopback adapter

  1. Open Wireshark.

  2. Select the “lo” (loopback) interface.

  3. Click Start to begin capture.

  4. Reproduce your MQTT client’s connection.

  5. Stop capture once the TLS handshake and MQTT CONNECT are complete.

Configure TLS decryption

  1. In Wireshark, go to Edit > Preferences.

  2. Expand Protocols, then scroll to TLS.

  3. In (Pre)-Master-Secret log filename, browse and select demo-pqc/client_keys.txt.

  4. Click OK.

Wireshark will now use those secrets to decrypt TLSv1.3 session data, including PQC certificates.

Filter for TLS handshake packets

  1. At the top of the main window, set the display filter to:

    tls

  2. Press Enter.

    Note

    This hides non-TLS traffic, so you can focus on the handshake.

Examine the key-exchange in ClientHello

  1. Find the ClientHello packet in the packet list.

  2. Expand Transport Layer Security → Extension: supported_groups.

  3. You will see two hybrid groups announced:

Hex Value

Decimal

Name

Description

0x11EC

4588

X25519MLKEM768

Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLS 1.3

0x11EB

4587

secp256r1MLKEM768

Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLS 1.3

Note

These tell the broker which PQC-hybrid key-exchange algorithms the client supports. To look up any new TLS parameter values, consult the TLS Parameters registry on the IANA website.

Inspect the server certificate

  1. Locate the Certificate message sent by the broker.

  2. Expand Transport Layer Security → Certificate and click on the server’s X.509 entry.

  3. Note the Algorithm ID field: 2.16.840.1.101.3.4.3.17

    Note

    This Algorithm ID is the OID dot notation for ML-DSA-44, the post-quantum signature algorithm. You can see the description and ASN.1 notation at the OID repository for 2.16.840.1.101.3.4.3.17.

In this section: