Chapter 11 — Networks and protocols
Lesson map
Lesson 11 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["11.1 TLS 1.3"]
N2["11.2 Size and the network"]
N3["11.3 Other protocols"]
N4["11.4 Ossification"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 TLS 1.3"]
N2["11.2 Size and the network"]
N3["11.3 Other protocols"]
N4["11.4 Ossification"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX021"]
[Learning outcomes]
|
v
[11.1 TLS 1.3]
|
v
[11.2 Size and the network]
|
v
[11.3 Other protocols]
|
v
[11.4 Ossification]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) trace a TLS 1.3 handshake and identify where key exchange and authentication happen; (2) explain how packet size, MTU and fragmentation interact with larger post-quantum messages; (3) describe IKEv2, SSH and DNSSEC from a migration viewpoint; and (4) recognize middlebox ossification. It prepares integration (Chapter 34) and performance (Chapter 36).
11.1 TLS 1.3
In TLS 1.3 (RFC 8446) the client sends a ClientHello with key shares for one or more groups; the server replies with its share, and both derive keys from the shared secret. The server then sends its certificate chain and a CertificateVerify signature, encrypted. Key exchange protects confidentiality against recording; certificates and signatures provide authentication at the time of connection. Hybrid groups such as X25519MLKEM768 (RFC 10024) change only the key-share part: the client share grows from 32 to 1,216 bytes, the server's to 1,120 bytes.
11.2 Size and the network
An Ethernet path typically carries 1,500-byte IP packets, about 1,460 bytes of TCP payload. A ClientHello with a hybrid share often exceeds that and needs two TCP segments. TCP handles this transparently, but some middleboxes and servers inspect only the first packet. Google reported such incompatibilities when Chrome began offering hybrid Kyber (Chromium Blog 2023). Over UDP (QUIC, DTLS, IKEv2) larger messages raise fragmentation and amplification-limit issues that protocol designers handle explicitly.
Testing therefore covers the whole path, including proxies and load balancers.
11.3 Other protocols
IKEv2 VPNs add post-quantum key exchange through additional exchanges (RFC 9370 defines multiple key exchanges in IKEv2). SSH implementations have deployed hybrid key exchange methods combining a lattice KEM with X25519. DNSSEC is mostly a signature problem: post-quantum signatures are much larger than today's ECDSA signatures, which strains UDP responses.
Each protocol needs its own plan. BPA's site-to-site VPN can add an ML-KEM exchange through RFC 9370 once both gateways support it; SSH administration can switch to a hybrid method with a configuration change on servers and clients; DNSSEC must wait for standards that fit large signatures into DNS responses, so it stays in the inventory as a tracked dependency.
11.4 Ossification
When middleboxes assume protocol fields never change, new values break connections. TLS 1.3 introduced GREASE (RFC 8701) — random reserved values — to keep implementations tolerant. Post-quantum migration is a test of ossification: the protocol allows it, but deployed equipment may not.
BPA's test plan sends hybrid ClientHellos through every inspection device on the path to partner portals before enabling them. A device that resets the connection is logged with its firmware version, and the vendor is asked for a fix. This turns ossification from a surprise outage into a list of known items with owners and dates.
11.5 Worked example
BPA's terminal staff report that the shipping-line portal fails through the old inspection proxy after enabling a hybrid group. Packet traces show the proxy resetting connections whose ClientHello spans two segments. Options: update proxy firmware, bypass inspection for that destination, or temporarily disable the hybrid group only on that path while the vendor fixes it — keeping it everywhere else.
The targeted exception is the right choice because the proxy fault affects only one path, while the harvest risk applies to all traffic. The exception is recorded with an expiry date and an owner, so it cannot become permanent. Once the vendor's firmware is installed, the test from the lab is rerun before the hybrid group is enabled again on that path.
11.6 Common errors and limits
- Assuming hybrid key exchange also migrates certificates.
- Forgetting UDP protocols' size limits.
- Rolling back PQC globally for a local middlebox fault.
Hybrid key exchange protects recorded traffic but leaves authentication on RSA or ECDSA certificates, which need their own migration. UDP protocols such as QUIC and IKEv2 must handle size explicitly because they lack TCP's segmentation. A global rollback for one proxy throws away protection for every other path, as the shipping-line portal case showed; a time-limited exception for that one path keeps everything else protected.
Exercises
- EX021 — Segment count. A ClientHello is 540 bytes without key shares. How many 1,460-byte segments with an X25519-only share (32 B) and with X25519MLKEM768 (1,216 B), counting ~4 B overhead per share? Rubric: 3 = 1 and 2 segments with arithmetic.
- EX022 — Protocol map. For TLS, IKEv2, SSH and DNSSEC, state whether migration is mainly key exchange, signatures or both. Rubric: 3 = correct with one-line reasons.
Synthesis
Hybrid key exchange changes message sizes, which networks and middleboxes may mishandle; each protocol has its own migration shape, and ossification, not cryptography, is often the obstacle.
Continue studying — chapter 11 of 50
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →