curl-wolfssl quic-X25519MLKEM768 connection fails to nginx-aws-lc X25519MLKEM768:x25519-only server

[Zoey2936]

Version

v5.9.1-stable

Description

When I built curl with this Dockerfile: https://github.com/ZoeyVid/curl-quic/blob/2942619f2af48c5bb54d2de37e0f5d53a42c20b8/Dockerfile

and try to connect to nginx linked against aws-lc with ssl_ecdh_curve X25519MLKEM768:x25519; configured, I get this:

[zoey@pc ~]$ ./curl-x86_64 https://zvcdn.de -vI4 --http3-only
* Host zvcdn.de:443 was resolved.
* IPv6: (none)
* IPv4: 89.58.43.161
* HTTPS-RR: -
*   Trying 89.58.43.161:443...
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: none
* QUIC connect to 89.58.43.161 port 443 failed: Could not connect to server
* Failed to connect to zvcdn.de port 443 after 690 ms: Could not connect to server
* closing connection #0
curl: (7) Failed to connect to zvcdn.de port 443 after 690 ms: Could not connect to server

The same command works if:

• I use archlinux system curl command
• I append --curves X25519 to the command
• I enable secp521r1:secp384r1:prime256v1 in nginx

But then it will use http3 without X25519MLKEM768 in all three cases

If I use http2/http1.x it works without any changes but then it also wont use X25519MLKEM768

Not sure if this is an aws-lc or wolfssl issue or if I'm the issue

[anhu]

Hi @Zoey2936

You're getting into some really sophisticated stuff here. To be honest, I'm not sure if our quic stuff has gotten PQC support yet. Let me investigate for you. It might take a bit of time. Is this a very urgent matter or is this a low priority thing?

Warm regards, Anthony