I still remember checking my email that morning and seeing the subject line something like "Congratulations LFX Mentorship." I read it twice before it actually landed. Out of everyone who applied I got in, to work on CBOMKit, a project I'd only vaguely understood a few weeks earlier when I first read about post-quantum cryptography and thought wait, all of our current encryption is going to be broken someday? Also a huge thanks to Aditya koranga(my mentor for choosing me).
That was genuinely one of the best days I've had this year. Not because mentorships themselves are rare, if you look around there's plenty. It felt good because this one was specific. I'd been reading about PQC on my own out of pure curiosity not because a class told me to and suddenly I had a mentor, a real codebase and a real problem sitting in front of me instead of just articles.
This post is about what that problem actually is, what I've picked up so far and honestly what I still don't fully understand. There's a lot.
What I Thought OpenSSL Was and What It Actually Is
Going into this I genuinely thought OpenSSL was one thing. Like one library one job. Turns out it's four separate pieces that just happen to travel together. libcrypto which does the actual math (hashing digital signatures ciphers) libssl which is built on top of libcrypto to run the actual TLS and DTLS handshakes (this is the part that lets something like Zoom encrypt a live call) a command line tool and the EVP API which I now understand is the modern interface most serious codebases should be using partly because it was built with post-quantum support in mind. I didn't know any of this three weeks ago.
