t-hybrid-only
· RFC 8446 §4.1.4, draft-ietf-tls-hybrid-design · interoperability · layer tls · udp/4511 · MUST
Passing this means: Correctly decoded something valid but demanding.
Anomaly type: transport
How each client answered
| Client | Version | Verdict | What happened |
|---|---|---|---|
| curl | libcurl/8.23.0 ngtcp2/1.25.0 | Pass | Decoded it and completed the request. |
| quinn | noq fork (189b0ed) | Pass | Decoded it and completed the request. |
| aioquic | 1.3.0 (PyPI wheel) | Unsupported | The client offers no key exchange group this port will negotiate, so it was refused before a handshake existed (the cryptographic handshake failed: error 40: peer is incompatible: NoKxGroupsInCommon). That is a capability this client does not have, rather than something the run failed to measure. |
| chromium | build 1248 | Pass | Decoded it and completed the request. |
| quic-go | quic-go v0.61.0 (h1:9So2anK4Tp22) | Pass | Decoded it and completed the request. |
| quiche | 0.30.0 (1c8e976) | Pass | Decoded it and completed the request. |
| neqo | 0.31.1 (cac2b74) | Pass | Decoded it and completed the request. |
| picoquic | 8162550 | Pass | Decoded it and completed the request. |
| ngtcp2 | 3c23148 | Pass | Decoded it and completed the request. |
| lsquic | 4.9.4 (2b30189) | Pass | Decoded it and completed the request. |
| xquic | 2060a44 | Unsupported | The client offers no key exchange group this port will negotiate, so it was refused before a handshake existed (the cryptographic handshake failed: error 40: peer is incompatible: NoKxGroupsInCommon). That is a capability this client does not have, rather than something the run failed to measure. |
| msquic | 2.7.0 (7e6525d) | Unsupported | The client offers no key exchange group this port will negotiate, so it was refused before a handshake existed (the cryptographic handshake failed: error 40: peer is incompatible: NoKxGroupsInCommon). That is a capability this client does not have, rather than something the run failed to measure. |
| quico | 0.7.0 (npm) | Pass | Decoded it and completed the request. |
What the clause requires
Complete the handshake. A client whose first key share was classical must recover through HelloRetryRequest, which §4.1.4 requires it to answer with a second ClientHello carrying a share for the named group. A client that does not offer the group at all must abandon the attempt cleanly rather than stall — that is a correct outcome for a client without post-quantum support. A client that cannot negotiate the group at all never establishes a connection, so the server records no verdict and the result is `not run` rather than a pass or a failure. On this tier that reads as "no post-quantum key exchange", which is itself the finding: every other tier reaches `not run` only when the runner skipped something. curl/ngtcp2 1.11.0 lands here. This is the round trip that breaks first in a real migration, because it is the one that never happens until a server somewhere stops offering the classical group.
Judged against RFC 8446.
Run this one yourself
Every test is reachable from your own client. Nothing here needs an account.
curl -s https://conformance.pqcrypta.com/catalog.json \
| jq '.tests[] | select(.id == "t-hybrid-only")'