crypto/tls: no way to check if a connection uses x25519Kyber768Draft00

[torntrousers]

Go version

go1.23.0 windows/amd64

Output of go env in your module/workspace:

set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\tornt\AppData\Local\go-build
set GOENV=C:\Users\tornt\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\tornt\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\tornt\go
set GOPRIVATE=
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLCHAIN=auto
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.23.0
set GODEBUG=
set GOTELEMETRY=local
set GOTELEMETRYDIR=C:\Users\tornt\AppData\Roaming\go\telemetry
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=C:\CQ\gopqc\go.mod
set GOWORK=
set CGO_CFLAGS=-O2 -g
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-O2 -g
set CGO_FFLAGS=-O2 -g
set CGO_LDFLAGS=-O2 -g
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=C:\Users\tornt\AppData\Local\Temp\go-build1302039288=/tmp/go-build -gno-record-gcc-switches

What did you do?

Trying the new x25519Kyber768Draft00 support from #67061 that came out in go1.23

What did you see happen?

There is no way i can find to find if a TLS connection is using x25519Kyber768Draft00

What did you expect to see?

Provide a way ? There is a very hacky approach in the curveID function here: https://forum.golangbridge.org/t/go-1-23-pqc-quantum-safe-tls/36126/2?u=torntrousers

[gabyhelp]

Related Issues and Documentation

• x/net/quic: tests broken by d0edd9acc8 crypto/tls: implement X25519Kyber768Draft00 at go directive 1.23+ #67783 (closed)
• crypto/tls: implement and enable X25519Kyber768Draft00 #67061 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[dmitshur]

CC @FiloSottile, @golang/security.

[rolandshoemaker]

Essentially a duplicate of https://go.dev/issue/67516, which is planned for 1.24.

[seankhliao]

Duplicate of #67516

[torntrousers]

...hope the testingOnlyCurveID field will be maintained until 1.24 then :)

[rolandshoemaker]

Yup, we have no plans to remove it, we use it in our own internal TLS testing currently.