cloudflare / cloudflare/quiche

ED25519 certificate causes handshake failure with CRYPTO_ERROR, while RSA2048 works

Open
#2,339 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
11.8k
Forks
1.1k
Avg merge
21h 9m
Merged PRs (30d)
6

Description

When using `tokio-quiche` with the provided example code, I encountered a handshake failure between the client and server. The issue occurs specifically when using an ED25519 certificate (generated via OpenSSL), resulting in the server returning a `CRYPTO_ERROR` (but `TimeoutError` in Rust code, #2274). However, switching to an RSA2048 certificate resolves the problem, and the handshake succeeds.

The issue appears to be specific to ED25519 certificates. When testing the same ED25519 certificate with `curl` (using HTTP/3), the handshake completes successfully and responses are received normally. A fix is requested to ensure compatibility with ED25519 signatures in QUIC handshakes in `quiche` h3 client.

Link #2186.

Image

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the provided tokio-quiche example using the ED25519 certificate, then compare it with RSA2048 and the successful curl HTTP/3 case. Trace the quiche h3 client handshake path, using #2274 and #2186 for context; done means the ED25519 handshake succeeds without CRYPTO_ERROR or a Rust TimeoutError.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cryptography, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.