t-cert-compression-pq
· RFC 8879 §4, RFC 8446 §4.4.2 · discretionary · layer tls · udp/4518 · MAY
Passing this means: The RFC permits either behaviour; the report says which was chosen.
Anomaly type: transport
How each client answered
| Client | Version | Verdict | What happened |
|---|---|---|---|
| curl | libcurl/8.23.0 ngtcp2/1.25.0 | Inconclusive | The handshake ended (aborted by peer: the endpoint encountered an internal error and cannot continue with the connection) without a CONNECTION_CLOSE carrying a TLS alert, so nothing shows how far into the chain the client got. The client process had already exited 100ms in, before this test's reaction point at never observed, so the silence after that is not evidence either way. |
| quinn | noq fork (189b0ed) | Pass | Handled it: decompressed and parsed the 2-certificate, 15,430-byte ML-DSA-87 chain, then rejected it on trust (alert 42). That is the right answer to a private CA, and reaching it means the certificate message itself was handled. |
| aioquic | 1.3.0 (PyPI wheel) | Unsupported | The client was refused before a handshake existed (the cryptographic handshake failed: error 40: peer is incompatible: NoSignatureSchemesInCommon). The refusal is itself the measurement on this tier, but what the client lacked is not recorded in it: this endpoint constrains both the key exchange group and the certificate's signature algorithm, and the error names neither. |
| chromium | build 1248 | Unsupported | The client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all. |
| quic-go | quic-go v0.61.0 (h1:9So2anK4Tp22) | Unsupported | The client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all. |
| quiche | 0.30.0 (1c8e976) | Unsupported | The client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all. |
| neqo | 0.31.1 (cac2b74) | Pass | Handled it: completed the handshake against the 2-certificate, 15,430-byte ML-DSA-87 chain: the compressed certificate message was decompressed, the chain parsed, and a post-quantum signature verified. Note that a client run with certificate verification disabled reaches this point without trusting anything, so what this shows is that the chain was processed, not that it was trusted. |
| picoquic | 8162550 | Unsupported | The client was refused before a handshake existed (detected an error with protocol compliance that was not covered by more specific error codes: authentication failed). The refusal is itself the measurement on this tier, but what the client lacked is not recorded in it: this endpoint constrains both the key exchange group and the certificate's signature algorithm, and the error names neither. |
| ngtcp2 | 3c23148 | Pass | Handled it: completed the handshake against the 2-certificate, 15,430-byte ML-DSA-87 chain: the compressed certificate message was decompressed, the chain parsed, and a post-quantum signature verified. Note that a client run with certificate verification disabled reaches this point without trusting anything, so what this shows is that the chain was processed, not that it was trusted. |
| lsquic | 4.9.4 (2b30189) | Unsupported | The client was refused before a handshake existed (detected an error with protocol compliance that was not covered by more specific error codes: authentication failed). The refusal is itself the measurement on this tier, but what the client lacked is not recorded in it: this endpoint constrains both the key exchange group and the certificate's signature algorithm, and the error names neither. |
| xquic | 2060a44 | Unsupported | The client aborted with handshake_failure (alert 40), which it sends when the parameters cannot be agreed at all — on this port, most often the key exchange group. Nothing shows the certificate was reached, so this is not evidence either way about its handling of an ML-DSA-87 chain. |
| msquic | 2.7.0 (7e6525d) | Unsupported | The client was refused before a handshake existed (detected an error with protocol compliance that was not covered by more specific error codes: authentication failed). The refusal is itself the measurement on this tier, but what the client lacked is not recorded in it: this endpoint constrains both the key exchange group and the certificate's signature algorithm, and the error names neither. |
| quico | 0.7.0 (npm) | Pass | Handled it: decompressed and parsed the 2-certificate, 15,430-byte ML-DSA-87 chain, then rejected it on trust (alert 42). That is the right answer to a private CA, and reaching it means the certificate message itself was handled. |
What the clause requires
Decompress and parse an ML-DSA-87 chain, then judge it on its merits. Nothing here is graded: RFC 8879 is optional, no RFC requires support for ML-DSA certificates, and §4 expressly lets a receiver cap the decompressed size and abort. What the port reports is which of those a client does. The chain is deliberately issued by a private CA nobody trusts, and that is what makes the measurement work rather than spoiling it. A client that rejects it for its *trust anchor* — unknown_ca, or bad_certificate — has already decompressed a certificate message several times the size of a classical one, parsed ML-DSA-87 structures it may never have seen and got as far as chain building. That is the whole capability under test, and the rejection that follows is correct behaviour, not a failure. A client that cannot get that far answers differently: decode_error or a record-size abort says the compressed chain itself defeated it, which is the outcome the post-quantum migration needs to know about. Certificate sizes are the half of that migration nobody can configure their way out of — ML-DSA-87 signatures are 4,627 bytes each and every chain carries several.
Judged against RFC 8879, RFC 8446.
Run this one yourself
Every test is reachable from your own client. Nothing here needs an account.
curl -s https://conformance.pqcrypta.com/catalog.json \
| jq '.tests[] | select(.id == "t-cert-compression-pq")'