[TLS] draft-ietf-tls-rfc9147bis: PQC key share CH fragmentat ion vs stateless server

Big PQC key shares are problematic for servers that handle connections
statelessly until the return-routability cookie check completes.
Such a server cannot defragment the initial ClientHello statelessly.
A client MAY send an empty key share in the first ClientHello, but even the
post-HRR ClientHello can exceed the datagram limit, and a stateless server
cannot locate the cookie in a fragmented CH2 either.

Do you think it is worthwhile to enforce the following?

   1. CH1 cannot be fragmented.
   2. The CH2 cookie must be completely contained in the first fragment.

The problem is rule 1: it forces every client to omit the PQC key share
from CH1, so servers that don't prioritize statelessness pay an extra round
trip too.

I'd rather not see that cost become non-negotiable for everyone, so before
proposing text: have the authors already considered this case, and is there
a better answer than making all clients pay for the servers that need
statelessness?

Sincerely,
Marco

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]