cloudflare / cloudflare/quiche
ED25519 certificate causes handshake failure with CRYPTO_ERROR, while RSA2048 works
- Dominant language
- Rust
- Stars
- 11.8k
- Forks
- 1.1k
- Avg merge
- 21h 9m
- Merged PRs (30d)
- 6
Description
When using `tokio-quiche` with the provided example code, I encountered a handshake failure between the client and server. The issue occurs specifically when using an ED25519 certificate (generated via OpenSSL), resulting in the server returning a `CRYPTO_ERROR` (but `TimeoutError` in Rust code, #2274). However, switching to an RSA2048 certificate resolves the problem, and the handshake succeeds.
The issue appears to be specific to ED25519 certificates. When testing the same ED25519 certificate with `curl` (using HTTP/3), the handshake completes successfully and responses are received normally. A fix is requested to ensure compatibility with ED25519 signatures in QUIC handshakes in `quiche` h3 client.
Link #2186.
Contributor guide
Research direction
Reproduce the failure with the provided tokio-quiche example using the ED25519 certificate, then compare it with RSA2048 and the successful curl HTTP/3 case. Trace the quiche h3 client handshake path, using #2274 and #2186 for context; done means the ED25519 handshake succeeds without CRYPTO_ERROR or a Rust TimeoutError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100