lsquic — Hybrid key share with an intact X25519 half and a corrupt ML-KEM half

Pass

Responded correctly: did not complete the handshake (timed out). The shared secret is both halves through the key schedule, so a corrupt ML-KEM half must break it -- and this client did not fall back to the intact X25519 half.

The client did what the clause requires.

What was measured

Client

lsquic — LiteSpeed lsquic + BoringSSL, 4.9.4

Test

Hybrid key share with an intact X25519 half and a corrupt ML-KEM half — t-corrupt-hybrid-share

Clause

draft-ietf-tls-hybrid-design §3.2, RFC 8446 §4.1.3 (MUST)

Class

correctness — Rejected something invalid, with the code the RFC names.

Required behaviour

Fail the handshake. The hybrid secret is the concatenation of both shares fed through the key schedule, so corrupting either half must produce a transcript mismatch and a failed Finished verification. What is being looked for is the failure mode, not the failure: a client that falls back to the classical half alone has silently downgraded itself to exactly the security level the hybrid exists to avoid, and would do so against an attacker who can corrupt one half at will. The server share for X25519MLKEM768 is the 1,088-byte ML-KEM ciphertext followed by the 32-byte X25519 key. One bit is flipped early in the ciphertext and the classical tail is left untouched, so a client that still completes has used the classical half alone. A single bit rather than a scribble on purpose: ML-KEM decapsulation never fails, it returns an implicit-rejection secret, so the handshake has to die at Finished verification rather than at a decode error — damaging the length or the structure would test the parser instead.

Measured

2026-09-18

Reproduce it

The suite is the judge, so the reproduction is to point the same client at the same test and let the server report what it saw.

SESSION=$(curl -sX POST https://conformance.pqcrypta.com/session | jq -r .id)
# then drive lsquic at the test URL and read the verdict:
curl -s https://conformance.pqcrypta.com/report/$SESSION.json | jq '.results["t-corrupt-hybrid-share"]'