xquic — GREASE named group a client must tolerate

Inconclusive

The run did not exercise this test: the handshake failed (aborted by peer: the cryptographic handshake failed: error 40: remote error) for a reason other than the key exchange this port constrains.

The run did not establish what this client does here — either it was never put in the situation, or its answer admits more than one reading. Not a failure, and never counted as one.

What was measured

Client

xquic — Alibaba xquic + BoringSSL, 2060a44

Test

GREASE named group a client must tolerate — t-grease-group

Clause

RFC 8701 §4, RFC 8446 §4.2.7 (MUST)

Class

extensibility — Ignored something unknown and carried on.

Required behaviour

Ignore the unrecognised group and complete the handshake. RFC 8701 reserves these values precisely so that an endpoint meeting one learns to tolerate a future real group sharing the same shape. The value goes in the server's supported_groups in EncryptedExtensions, second in a list of real groups. RFC 8446 §4.2.7 permits a server to send that list — "regardless of whether they are currently supported by the client" — and requires that a client "MUST NOT act upon any information found in supported_groups prior to successful completion of the handshake". So the handshake must complete, and a client that aborts over a codepoint it was told not to act on has ossified against groups that do not exist yet. WHERE the value goes is the whole test, and getting it wrong the first time is on the record deliberately. It was built by naming a GREASE value in the ServerHello key_share, which is not an extensibility test at all: §4.1.3 makes a key_share naming any group the client did not offer illegal whatever the value is, so every conformant client correctly answered illegal_parameter — and an Extensibility test demanding tolerance scored all of them as failures. neqo caught it on first contact. It also duplicated t-group-not-offered, which measures that rejection properly. The honest version needed an extension rustls had no reason to send, so the fork's ServerExtensions gained a named_groups field. The port and the id never moved while it was unimplemented.

Measured

2026-09-18

Reproduce it

The suite is the judge, so the reproduction is to point the same client at the same test and let the server report what it saw.

SESSION=$(curl -sX POST https://conformance.pqcrypta.com/session | jq -r .id)
# then drive xquic at the test URL and read the verdict:
curl -s https://conformance.pqcrypta.com/report/$SESSION.json | jq '.results["t-grease-group"]'