colibri 0.12.0

colibri 0.12.0 makes the server prefer the CNSA 2.0 algorithms: ML-KEM-1024, AES-256-GCM and ML-DSA-87 (#115). It gives every server identity one shape, and RSA-PSS returns in that shape. The h3 server spends 38% fewer instructions a request. It pins chapulin 965668d2 and stdx 5fd03aa.

Breaking changes

• A server identity has one shape for every key (decision 147). tls.Key, tls.Identity, tls.SignatureScheme and tls.pem.key replace tls.P256Key and the names for each algorithm. tls.Server.identities takes a list of tls.Identity, at most one for each scheme. server.StartError adds IdentityRepeated, IdentityUnfilled and IdentityUnavailable.
• client.ConnectionPool.cancel takes now_ns (decision 146). The instant starts the drop of an h11 response that the caller left.
• Each TLS session is larger by about 300 bytes: tls.record.Server grows from 49,160 to 49,464 bytes, tls.quic.Server from 100,736 to 101,080, tls.record.Client from 49,800 to 50,104, and tls.quic.Client from 101,304 to 101,608. server.Endpoint at its default capacity grows from 52,422,080 to 52,433,296 bytes. docs/performance.md lists each size.

What's new

• The server selects ML-KEM-1024 when a client lists it, and sends a HelloRetryRequest for it when the client sent only an X25519MLKEM768 share.
• The server prefers TLS_AES_256_GCM_SHA384 when a client lists it.
• The server signs with ML-DSA-87 (draft-ietf-tls-mldsa-05, RFC 9881) when a client lists it, and tls.pem.key reads an ML-DSA-87 key.
• tls.pem.key reads an RSA key in PKCS #8, and the server signs with rsa_pss_rsae_sha256 when a client offers neither ML-DSA-87 nor ECDSA P-256. chapulin signs once with the key when it loads, so a key that does not match the leaf is refused there.
• client.Timeouts bounds the drop of an h11 response that the caller left: 256 KiB and 50 ms, and no drop when the response closes the connection (decision 146).
• tools/tls_openssl.sh checks each choice with OpenSSL's s_client over TCP and QUIC.

Fixes

• chapulin 965668d2 wipes the stack below each private call of its 64-bit RSA signer and each x86-64 AES-GCM seal and open.

Speed

The judge counted the h3 server's instructions over steps 29d.3 to 29d.8 (design §8):

• h3-many fell from 67,680 to 42,011 instructions a request.
• Each step won on h3-many and h3-bbr-many, and no h2 input lost.

Checked

GitHub's main workflow passed on 39b8cd6d (run 41763427588), and tools/ci.sh passed all 39 sections on it.