Re: quic and compatibility with cryptographic implementations

[Martin Thomson <[e-mail]>]

On Sun, Apr 26, 2026, at 11:01, Dimitri John Ledkov wrote:
> Would it help with
> interoperability with such strict cryptographic libraries if the
> destination connection ID had a recommended minimum length of 112
> bits? Note doing so is compatible with the current RFC wording as is,
> without needing a new version and a new salt value.

While you can ask people to make a value longer than 112 bits, the RFC only requires 64 bits, so those that are not updated might not meet your expectations.  So you can ask, but you will likely never cause every deployed implementation to choose 14 byte connection IDs to make your NIST FIPS requirements happy.

To be clear, this is a use of the algorithms that does not need FIPS certification.  We send the keys along with the ciphertext.  Though we can't expect every FIPS audit to appreciate this not-so-fine point, the point will remain.

> Has it been considered to upgrade this to AEAD_AES_256_GCM by default?

No.  For the same reason as above, this would not interoperate with existing clients.