t-cert-compression-pq
· RFC 8879 §4, RFC 8446 §4.4.2 · discretionary · layer tls · udp/4518 · MAY
Passing this means: The RFC permits either behaviour; the report says which was chosen.
Anomaly type: transport
How each client answered
| Client | Version | Verdict | What happened |
|---|---|---|---|
| curl | ngtcp2/1.11.0 | Inconclusive | The run did not exercise this test: the client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all, which is a fact about it rather than a gap in the run. |
| quinn | noq fork | Inconclusive | The run did not exercise this test: the client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all, which is a fact about it rather than a gap in the run. |
| aioquic | 1.3.0 | Not run | Not attempted. |
| chromium | build 1223 | Inconclusive | The run did not exercise this test: the client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all, which is a fact about it rather than a gap in the run. |
| quic-go | quic-go v0.61.0 | Inconclusive | The run did not exercise this test: the client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all, which is a fact about it rather than a gap in the run. |
| quiche | 0.30.0 | Inconclusive | The run did not exercise this test: the client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all, which is a fact about it rather than a gap in the run. |
| neqo | 0.31.1 | Pass | Handled it: completed the handshake against an ML-DSA-87 chain: the compressed certificate message was decompressed, the chain parsed, and a post-quantum signature verified. Note that a client run with certificate verification disabled reaches this point without trusting anything, so what this shows is that the chain was processed, not that it was trusted. |
| picoquic | 8162550 | Inconclusive | The run did not exercise this test: the client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all, which is a fact about it rather than a gap in the run. |
| ngtcp2 | 3c23148 | Pass | Handled it: completed the handshake against an ML-DSA-87 chain: the compressed certificate message was decompressed, the chain parsed, and a post-quantum signature verified. Note that a client run with certificate verification disabled reaches this point without trusting anything, so what this shows is that the chain was processed, not that it was trusted. |
| lsquic | 4.9.4 | Inconclusive | The run did not exercise this test: the client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all, which is a fact about it rather than a gap in the run. |
| xquic | 2060a44 | Pass | Handled it: aborted over the certificate with TLS alert 40. Reported rather than graded: RFC 8879 §4 lets a receiver cap the decompressed size and abort, and no document requires ML-DSA support of anyone. |
| msquic | 2.7.0 | Inconclusive | The run did not exercise this test: the client's signature_algorithms named nothing that can verify an ML-DSA-87 chain, so this endpoint refused before sending one. Post-quantum certificates are not reachable for this client at all, which is a fact about it rather than a gap in the run. |
What the clause requires
Decompress and parse a 55 KB ML-DSA-87 chain, then judge it on its merits. Nothing here is graded: RFC 8879 is optional, no RFC requires support for ML-DSA certificates, and §4 expressly lets a receiver cap the decompressed size and abort. What the port reports is which of those a client does. The chain is deliberately issued by a private CA nobody trusts, and that is what makes the measurement work rather than spoiling it. A client that rejects it for its *trust anchor* — unknown_ca, or bad_certificate — has already decompressed a 55 KB certificate message, parsed ML-DSA-87 structures it may never have seen and got as far as chain building. That is the whole capability under test, and the rejection that follows is correct behaviour, not a failure. A client that cannot get that far answers differently: decode_error or a record-size abort says the compressed chain itself defeated it, which is the outcome the post-quantum migration needs to know about. Certificate sizes are the half of that migration nobody can configure their way out of — ML-DSA-87 signatures are 4,627 bytes each and every chain carries several.
Judged against RFC 8879, RFC 8446.
Run this one yourself
Every test is reachable from your own client. Nothing here needs an account.
curl -s https://conformance.pqcrypta.com/catalog.json \
| jq '.tests[] | select(.id == "t-cert-compression-pq")'What this suite is · The full grid · All clients · All tests · Findings