[TLS] Re: draft-ietf-tls-rfc9147bis: PQC key share CH frag mentation vs stateless server

On Mon, Aug 10, 2026 at 02:46:08PM -0700, Sophie Schmieg wrote:

> We already have a similar problem as is, in that the client currently
> can really only afford to add one PQC keyshare, so if the server wants
> a different choice of parameters or a different algorithm altogether,
> there is a forced HRR roundtrip. From talking to various folks, PQC is
> currently only seen as feasible because of there being a single guess
> and that single guess usually succeeding.

FWIW, in applications that are not particularly latency-sensitive, e.g.
SMTP an extra HRR RTT is not a significant impediment.

Consequently, in order to work around a low, but AFAIK not yet entirely
negligible rate of middleboxes breaking connections with a multi-segment
CH, the default Postfix configuration includes X25519MLKEM768 only in
supported groups, and not as a predicted initial CH keyshare.  Thus we
get two arounds of client/server TLS hello below:

    posttls-finger: SSL_connect:before SSL initialization
    posttls-finger: SSL_connect:SSLv3/TLS write client hello
    posttls-finger: SSL_connect:SSLv3/TLS write client hello
    posttls-finger: SSL_connect:SSLv3/TLS read server hello
    posttls-finger: SSL_connect:SSLv3/TLS write change cipher spec
    posttls-finger: SSL_connect:SSLv3/TLS write client hello
    posttls-finger: SSL_connect:SSLv3/TLS write client hello
    posttls-finger: SSL_connect:SSLv3/TLS read server hello
    posttls-finger: SSL_connect:TLSv1.3 read encrypted extensions
    posttls-finger: SSL_connect:SSLv3/TLS read server certificate
    posttls-finger: SSL_connect:TLSv1.3 read server certificate verify
    posttls-finger: SSL_connect:SSLv3/TLS read finished
    posttls-finger: SSL_connect:SSLv3/TLS write finished
    posttls-finger: Verified TLS connection established to ...:25:
        TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
        key-exchange X25519MLKEM768
        server-signature ML-DSA-65 (raw public key)
    posttls-finger: SSL_connect:SSL negotiation finished successfully
    posttls-finger: SSL_connect:SSL negotiation finished successfully
    posttls-finger: SSL_connect:SSLv3/TLS read server session ticket

as opposed to a connection with default OpenSSL keyshare settings which logs:

    posttls-finger: SSL_connect:before SSL initialization
    posttls-finger: SSL_connect:SSLv3/TLS write client hello
    posttls-finger: SSL_connect:SSLv3/TLS write client hello
    posttls-finger: SSL_connect:SSLv3/TLS read server hello
    posttls-finger: SSL_connect:TLSv1.3 read encrypted extensions
    posttls-finger: SSL_connect:SSLv3/TLS read server certificate
    posttls-finger: SSL_connect:TLSv1.3 read server certificate verify
    posttls-finger: SSL_connect:SSLv3/TLS read finished
    posttls-finger: SSL_connect:SSLv3/TLS write change cipher spec
    posttls-finger: SSL_connect:SSLv3/TLS write finished
    posttls-finger: Verified TLS connection established to ...:25:
        TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
        key-exchange X25519MLKEM768
        server-signature ML-DSA-65 (raw public key)
    posttls-finger: SSL_connect:SSL negotiation finished successfully
    posttls-finger: SSL_connect:SSL negotiation finished successfully
    posttls-finger: SSL_connect:SSLv3/TLS read server session ticket

-- 
    Viktor.  🇺🇦 Слава Україні!

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]