PQC-Based FreeSWITCH and PJSIP Quantum-Resistant Communication System Upgrade Solution

To transform FreeSWITCH and PJSIP into a quantum-resistant encryption system, currently feasible open-source approaches mainly focus on integrating post-quantum cryptography (PQC) algorithm libraries, as well as leveraging existing open-source VPNs or SDKs for technical validation.

1. Core Cryptographic Algorithm Libraries and OpenSSL Engine

The foundation of the upgrade is to replace existing RSA/ECC algorithms and introduce NIST-standardized PQC algorithms (such as ML-KEM, ML-DSA, SLH-DSA).

liboqs (Open Quantum Safe): This is currently the most mainstream C-language PQC algorithm library, integrating all candidate algorithms. It does not directly modify FreeSWITCH itself but provides a standard C API. It typically needs to be used in conjunction with oqs-engine, which is an OpenSSL provider that allows PQC algorithms to be injected into OpenSSL 3.0 and above.

Upgrade Logic: Both FreeSWITCH and PJSIP rely on OpenSSL for TLS handshakes. By compiling and installing `liboqs` and `oqs-engine`, and configuring OpenSSL to support PQC cipher suites, the existing SIP TLS channel can support quantum-resistant encryption "transparently" without extensive modifications to the business-layer code.

2. Quantum-Resistant Upgrade of PJSIP Open-Source Code

For the PJSIP-side upgrade, the primary approach relies on recompiling its underlying SSL library.

Underlying Dependency Replacement: PJSIP supports OpenSSL and Mbed TLS. Currently, the open-source community's PQC support for Mbed TLS is not as mature as that of OpenSSL. Therefore, it is recommended that PJSIP link against the OpenSSL dynamic library integrated with `oqs-engine`.

Configuration Adjustments: In the PJSIP configuration (such as `pjproject/config_site.h`), enable TLS support and specify the use of the system OpenSSL. After compilation, modify the SIP transport configuration to force the use of specific PQC cipher suites for SIP over TLS registration and calling.

3. Open-Source VPN Solution (for Transparent Encryption)

If modifying the application-layer code is too difficult, another approach is to establish a PQC-based VPN tunnel between the FreeSWITCH server and PJSIP endpoints.

Rosenpass: This is a post-quantum key exchange tool specifically designed for WireGuard. It adds a layer of PQC key exchange (such as Kyber) on top of WireGuard's standard encryption to generate pre-shared keys.

Deployment Method: Rosenpass can be run in the background on both the server and client, forwarding RTP and SIP traffic through a virtual tunnel interface. The advantage of this approach is that PJSIP and FreeSWITCH require no code modifications; the disadvantage is the need to maintain a virtual network environment.

4. Comprehensive Evaluation and Implementation Recommendations

Long-Term Solution (Application Layer): It is recommended to prioritize the liboqs + oqs-engine + OpenSSL 3.0 path. This is the most thorough upgrade method that conforms to network layering principles, enabling true end-to-end SIP signaling encryption.

Short-Term Validation (Tunnel Layer): If PJSIP compilation and debugging are time-consuming, Rosenpass + WireGuard can be used first to establish a tunnel for validation. Once the communication link is stable, the application-layer PQC-TLS can then be attempted as a replacement.

Notes: The public key and signature lengths of PQC algorithms are significantly larger than those of traditional algorithms, which may cause SIP packets to exceed the MTU (Maximum Transmission Unit) and result in fragmentation, or increase handshake latency during registration. Performance testing is required.