PQC key exchange groups for EAP-TLS

Updated: September 11, 2026

Want to summarize with AI?

Explains the PQC key exchange groups that IOS XR uses during 802.1X EAP-TLS negotiation for dynamic MACsec sessions.

A PQC key exchange group is a TLS named group that

combines classical and post-quantum cryptography (PQC) algorithms to protect key exchange,
is advertised by IOS XR during 802.1X EAP-TLS negotiation, and
enables support for hybrid, pure PQC, and classical key exchange methods for dynamic MACsec sessions.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
PQC-enabled MACsec with EAP-TLS	Release 26.3.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]) (select variants only); Centralized Systems (8400 [ASIC: K100]) (select variants only) Introduces PQC-capable TLS key exchange support to 802.1X EAP-TLS, with default CiscoSSL group advertisement and per-profile group configuration. *This feature is supported on all MACsec-supported IOS XR platforms.

From IOS XR Release 26.3.1, EAP-TLS advertises CiscoSSL-supported PQC and classical groups by default when no explicit group list is configured. You can configure a colon-separated list on each EAP profile.

The feature supports the 802.1X EAP-TLS supplicant and the Local EAP authenticator. After successful authentication, the EAP-TLS session provides keying material for MACsec key establishment.

Note

Hybrid groups are recommended during migration because they provide classical and PQC key exchange protection.

On platforms that support port control, MACsec EAP does not support the should-secure MACsec security policy. Dot1x continues to perform port control as part of its default operation, which prevents should-secure from functioning with MACsec EAP.

Ensure compatibility and FIPS compliance for PQC EAP-TLS configuration

Follow these requirements when configuring PQC EAP-TLS key exchange groups:

Ensure that the supplicant and authenticator have at least one key exchange group in common.
If the peers have no group in common, EAP-TLS fails and the system logs an authentication or supplicant TLS failure with a no-common-group hint.
Use only FIPS-approved groups when the system operates in FIPS mode.
The system retains valid non-FIPS configured groups but excludes them from EAP-TLS authentication while FIPS mode is active.
If FIPS excludes every configured group, the TLS session fails explicitly without using the default group list.
Changing the configured key exchange groups restarts affected EAP-TLS and MACsec sessions.

Supported PQC and classical key exchange groups

Use this reference to select supported TLS key exchange groups for an EAP profile.

Table 2. Supported key exchange groups
Category	Groups	FIPS mode
Hybrid ML-KEM and ECDHE	x448_mlkem768, X25519MLKEM768, x25519_mlkem512, p256_mlkem512, p384_mlkem768, SecP256r1MLKEM768, p521_mlkem1024, SecP384r1MLKEM1024	p256_mlkem512, p384_mlkem768, SecP256r1MLKEM768, p521_mlkem1024, SecP384r1MLKEM1024
Pure ML-KEM	mlkem512, mlkem768, mlkem1024	Not permitted
Classical ECDHE	x25519, x448, secp256r1, secp384r1, secp521r1	secp256r1, secp384r1, secp521r1
Classical FFDHE	ffdhe2048, ffdhe3072, ffdhe4096	ffdhe2048, ffdhe3072, ffdhe4096

Configure PQC key exchange groups for EAP-TLS

Configure the key exchange groups that an EAP-TLS profile uses for dynamic MACsec authentication.

When no group list is configured, IOS XR uses the default group list provided by CiscoSSL. In FIPS mode, IOS XR considers only FIPS-approved groups during EAP-TLS negotiation. If a group list is configured, non-FIPS groups remain in the configuration but are not used while FIPS mode is active.

Note

FIPS mode is enabled systemwide. If the router operates in FIPS mode, use only FIPS-approved key-exchange groups. For FIPS mode prerequisites, enablement, and operational guidance, refer to Configuring FIPS Mode.

Before you begin

Identify the TLS trustpoint to be used.
Ensure you have determined a group list that both EAP-TLS peers support.

Follow these steps to configure PQC key exchange groups for EAP-TLS:

Procedure

Enter EAP profile TLS configuration mode.

Example:

Router(config)# eap profile <profile-name>
method tls
pki-trustpoint <trustpoint>

Associate the EAP profile with the Dot1x profile.

Example:

Router(config)# dot1x
profile <dot1x-profile-name>
eap profile <eap-profile-name>

Configure the colon-separated key exchange group list.
Example:
```
Router(config)# key-exchange-groups <colon-separated-list>
```
To verify your configuration, display detailed Dot1x information for the interface to check TLS version, cipher suite, key exchange type, and group.
Example:
```
Router# show dot1x interface <interface-name> detail
```
Display the configured groups in the EAP profile.
Example:
```
Router# show running-config eap profile <profile-name>
```

Changing the configured key exchange groups resets affected EAP-TLS and MACsec sessions and starts reauthentication.

What to do next

Configure the same or an overlapping group list on the EAP-TLS peer to ensure successful negotiation.

Troubleshoot EAP-TLS key exchange group negotiation

Identify and resolve mismatches in negotiated TLS key exchange groups causing EAP-TLS authentication failures.

When EAP-TLS authentication fails, IOS XR provides session-specific TLS failure hints in Dot1x output and may display FIPS warnings if FIPS mode excludes a configured key exchange group.

Before you begin

Identify the affected interface.
Collect the configured EAP profile and MACsec policy names.

Follow these steps to troubleshoot EAP-TLS key exchange group:

Procedure

Check for DOT1X-3-AUTH_TLS_FAILURE or DOT1X-3-SUPP_TLS_FAILURE and their TLS failure hints. When FIPS excludes a configured non-FIPS group, check for DOT1X-4-FIPS_WARN.
Display detailed Dot1x information for the affected interface.
Example:
```
Router# show dot1x interface <interface-name> detail
```
Check the TLS Fail Info field for a no-common-key-exchange-group hint or another session-specific TLS failure reason.
Display the configured key exchange group list.
Example:
```
Router# show running-config eap profile <profile-name>
```
Compare the configured list with the group list on the peer and confirm that the lists overlap.
Enable EAP method debugging when additional TLS handshake detail.
Example:
```
Router# debug eap method
```
The debug output reports ClientHello supported groups and versions, proposed cipher suites, and ServerHello selected values.

The diagnostic output identifies the TLS parameters that the peers proposed or selected and indicates whether configuration mismatch or FIPS filtering caused the failure.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.