demo · v131

handshake bytes: classical vs hybrid

Pure X25519 keyshares are 32 bytes. Kyber768 keyshares are 1,184 bytes. The hybrid scheme concatenates them, so your ClientHello grows by ~1.2KB. That's typically fine for TCP but matters for QUIC's first-flight and for embedded IoT clients on tight buffers. Visualise the size delta.

classical TLS 1.3 (X25519)

→ ClientHello — key_share: X25519 (32B)
← ServerHello — key_share: X25519 (32B)
↔ Application data (encrypted)

client key_share size

32 bytes

hybrid TLS 1.3 (X25519 + Kyber768)

→ ClientHello — key_share: X25519 (32B) || Kyber768 (1184B) = 1216B
← ServerHello — key_share: X25519 (32B) || Kyber768 (1088B) = 1120B
↔ Application data (encrypted)

client key_share size

1216 bytes (38x larger)

why it still ships

1.2KB is well under typical MTU. TCP handles it transparently. QUIC's 1-RTT initial packets can fragment the ClientHello over multiple packets, which costs a half-RTT — but the trade-off (post-quantum confidentiality forever) wins. Embedded IoT is the one edge case to test.

see also

scenario focus

Select a scenario to focus its rendered example and summary.