t-hybrid-large-hello
· RFC 9000 §8.1, §14.1, RFC 9001 §4.4 · resilience · layer tls · udp/4513 · MUST
Passing this means: Recovered rather than giving up.
Anomaly type: transport
How each client answered
| Client | Version | Verdict | What happened |
|---|---|---|---|
| curl | ngtcp2/1.11.0 | Not run | Not attempted. |
| quinn | noq fork | Pass | Recovered and completed the follow-up request. |
| aioquic | 1.3.0 | Not run | Not attempted. |
| chromium | build 1223 | Pass | Recovered and completed the follow-up request. |
| quic-go | quic-go v0.61.0 | Pass | Recovered and completed the follow-up request. |
| quiche | 0.30.0 | Pass | Recovered and completed the follow-up request. |
| neqo | 0.31.1 | Pass | Recovered and completed the follow-up request. |
What the clause requires
Complete the handshake with a ClientHello that does not fit one QUIC Initial packet. An ML-KEM-768 key share is 1,216 bytes, which pushes a ClientHello past the 1,200-byte floor RFC 9000 §14.1 sets for an Initial, so the flight must be spread over more than one packet and every one of them padded to the full size. This is the concrete reason post-quantum TLS deployments fail in the field, and it interacts with the §8.1 anti-amplification limit: the server may not send more than three times what it has received, so a client that under-pads its Initials can stall the handshake without either side doing anything invalid.
Judged against RFC 9000, RFC 9001.
Run this one yourself
Every test is reachable from your own client. Nothing here needs an account.
curl -s https://conformance.pqcrypta.com/catalog.json \
| jq '.tests[] | select(.id == "t-hybrid-large-hello")'What this suite is · The full grid · All clients · All tests · Findings