Configuring PQC in NetBackup
The NB_PQC_MODE option enables the use of Post Quantum Cryptography (PQC) algorithm in TLS 1.3 Hybrid Key Exchange.
See About Post-Quantum Cryptography (PQC).
Caution:
NetBackup leverages the Open Quantum Safe (OQS) provider to support PQC for secure communications. While the provider is a significant step towards preparing for a quantum-safe future, it is widely used in experimental and research environments. It is recommended that you thoroughly assess all the associated risks and ensure that its usage aligns with your organization's security policies and compliance requirements before you enable the NB_PQC_MODE option.
Note:
The PQC mode is supported only if the FIPS mode is disabled.
Table: NB_PQC_MODE
Usage | Description |
|---|---|
Where to use | On NetBackup servers or clients. |
How to use | Use the nbgetconfig and the nbsetconfig commands to view, add, or change the option. For information about these commands, see the NetBackup Commands Reference Guide. By default, the NB_PQC_MODE option is disabled. To enable the option, use the following format: NB_PQC_MODE = ENABLE To disable the option, use the following format: NB_PQC_MODE = DISABLE After you enable or disable PQC in NetBackup, restart the NetBackup service on the server and the client using the following commands: For UNIX, run the following commands: /usr/openv/netbackup/bin/bp.kill_all /usr/openv/netbackup/bin/bp.start_all For Windows: install_path\NetBackup\bin\bpdown install_path\NetBackup\bin\bpup |
Equivalent NetBackup web UI property | No equivalent exists in the host properties. |
The cluster failover or restarting services through cluster console does not restart the vnetd or bpcd service that is already running on cluster nodes.
Restart the vnetd service manually on each cluster node to reflect the changes in the PQC mode.
On UNIX, do the following:
To stop vnetd service on UNIX, run the following command:
/usr/openv/netbackup/bin/vnetd -terminate
To start vnetd service on UNIX, run the following command:
/usr/openv/netbackup/bin/vnetd -standalone
On Windows, restart 'NetBackup Legacy Network Service' using the Service Control Manager (SCM).