I’m evaluating a Kyber-768 + X25519 hybrid in TLS 1.3 for a messaging backend and want real-world data hake latency and client compatibility. If you’ve tried this behind nginx 1.25 or HAProxy 2.8, what failed first — middlebox interference, HelloRetryRequest loops, or oversized cert chains — and how did you mitigate without weakening the cryptographic guarantees?
Running X25519Kyber768 on nginx 1.25 (BoringSSL) and HAProxy 2.8 (OpenSSL 3 + oqs-provider), ‘middlebox interference’ broke first whenever the ClientHello > about 1250 B and fragmented — like trying to shove a sofa through a narrow door. We fixed it by advertising the single hybrid group (not two shares), keeping ECDSA/Ed25519 certs to avoid chain bloat, and trimming ALPN/cipher lists so the CH fits one packet; HRR loops vanished and p95 handshake added about 4–8 ms on mobile. If you can use QUIC it’s even cleaner; Cloudflare’s notes helped a lot: https://blog.cloudflare.com/post-quantum-key-agreement — what client mix are you targeting?
I’ve had fewer breakages when I “keep the ClientHello under about 1200 B”: offer only X25519+Kyber768, trim supported_groups/sigalgs, switch to P‑256 ECDSA certs, and enable TLS certificate compression (RFC 8879) if your stack supports it — otherwise it’s like pushing a sofa through a dog door… For HRR loops, ensure your top supported_groups matches the single key_share you send and avoid multiple hybrids. Have you tried a mobile-heavy client mix behind enterprise proxies; Cloudflare’s notes mirror this: https://blog.cloudflare.com/post-quantum-hybrid-key-agreement/.
We cut failures from oversized chains by enabling TLS certificate compression (RFC 8879) with brotli — Certificate shrank about 50–60% and middleboxes stopped choking, no change to X25519+Kyber768; worked for us on HAProxy 2.8 and nginx+BoringSSL with Chrome clients. @grobertson56 does your mix skew BoringSSL enough for brotli to negotiate? RFC 8879: TLS Certificate Compression.
We killed ‘HelloRetryRequest loops’ by pinning X25519Kyber768Draft00; some stacks map IDs differently. Which clients?
Quick data point from nginx 1.25 + oqsprovider: the only consistent breakages were corporate TLS interceptors dropping unknown group IDs, so we fingerprinted those (JA3/SNI) and routed them to a classical-only pool while keeping everyone else on X25519+Kyber — like a bouncer for the handshake. p95 handshake cost rose about 0.8–1.1 ms on x86; Cloudflare reported similar numbers here: https://blog.cloudflare.com/post-quantum-hybrid-key-agreement/. Caveat: disable 0‑RTT during rollout to avoid weird resumption mismatches with clients that don’t persist the hybrid group.