picoquic — Server selects a key exchange group the client never offered

Pass

Responded correctly: aborted with illegal_parameter (alert 47) over a key_share naming a group it never offered, which is exactly what RFC 8446 §4.1.3 requires.

The client did what the clause requires.

What was measured

Client

picoquic — picoquic + picotls, 8162550

Test

Server selects a key exchange group the client never offered — t-group-not-offered

Clause

RFC 8446 §4.1.3, §4.2.8, RFC 9001 §4.8 (MUST)

Class

correctness — Rejected something invalid, with the code the RFC names.

Required behaviour

Abort with illegal_parameter. §4.1.3 is explicit that if the selected group was not offered, the client MUST abort — accepting it would let a server steer a client onto a group it deliberately excluded. The port names secp384r1 in its ServerHello against a client that offered only the hybrid, and leaves the payload exactly as generated: the only thing wrong is the name, so a client that aborts can only be aborting over §4.1.3 and not over a share it could not parse. What is judged is the abort, not the alert value. RFC 9001 §4.8 lets a QUIC endpoint replace any alert with a generic one — handshake_failure in place of illegal_parameter — expressly so that a client need not say what it objected to, so the code a client chooses is reported here and not scored. A handshake that ends without any CONNECTION_CLOSE is inconclusive rather than a failure: the group was certainly not accepted, but a close that was never sent cannot be told from one that was lost.

Measured

2026-09-18

Reproduce it

The suite is the judge, so the reproduction is to point the same client at the same test and let the server report what it saw.

SESSION=$(curl -sX POST https://conformance.pqcrypta.com/session | jq -r .id)
# then drive picoquic at the test URL and read the verdict:
curl -s https://conformance.pqcrypta.com/report/$SESSION.json | jq '.results["t-group-not-offered"]'