neqo — Post-quantum certificate chain, compressed per RFC 8879

Pass

Handled it: completed the handshake against an ML-DSA-87 chain: the compressed certificate message was decompressed, the chain parsed, and a post-quantum signature verified. Note that a client run with certificate verification disabled reaches this point without trusting anything, so what this shows is that the chain was processed, not that it was trusted.

The client did what the clause requires.

What was measured

Client

neqo — neqo (Firefox), 0.31.1

Test

Post-quantum certificate chain, compressed per RFC 8879 — t-cert-compression-pq

Clause

RFC 8879 §4, RFC 8446 §4.4.2 (MAY)

Class

discretionary — The RFC permits either behaviour; the report says which was chosen.

Required behaviour

Decompress and parse a 55 KB ML-DSA-87 chain, then judge it on its merits. Nothing here is graded: RFC 8879 is optional, no RFC requires support for ML-DSA certificates, and §4 expressly lets a receiver cap the decompressed size and abort. What the port reports is which of those a client does. The chain is deliberately issued by a private CA nobody trusts, and that is what makes the measurement work rather than spoiling it. A client that rejects it for its *trust anchor* — unknown_ca, or bad_certificate — has already decompressed a 55 KB certificate message, parsed ML-DSA-87 structures it may never have seen and got as far as chain building. That is the whole capability under test, and the rejection that follows is correct behaviour, not a failure. A client that cannot get that far answers differently: decode_error or a record-size abort says the compressed chain itself defeated it, which is the outcome the post-quantum migration needs to know about. Certificate sizes are the half of that migration nobody can configure their way out of — ML-DSA-87 signatures are 4,627 bytes each and every chain carries several.

Measured

2026-09-18

Reproduce it

The suite is the judge, so the reproduction is to point the same client at the same test and let the server report what it saw.

SESSION=$(curl -sX POST https://conformance.pqcrypta.com/session | jq -r .id)
# then drive neqo at the test URL and read the verdict:
curl -s https://conformance.pqcrypta.com/report/$SESSION.json | jq '.results["t-cert-compression-pq"]'