Paper (S47): TLS Preflight: smaller, faster and more private handshakes
slides-pqws-s47-00

Dennis Jackson (Mozilla)

Post-quantum (PQ) cryptography makes TLS handshakes substantially larger [1]. Merkle Tree Certifi-
cates (MTCs) [2] shrink the certificate chain. KEMTLS [3] goes further by replacing the handshake
signature with a much smaller KEM ciphertext, but requires invasive changes to the TLS state machine,
which have proven a barrier to deployment. Meanwhile, Encrypted Client Hello (ECH) [4] would
further inflate TLS handshake size if it were naively switched to PQ primitives.

TLS Preflight aims to address the issues blocking deployment of KEMTLS and PQ ECH. It achieves size
reductions similar to KEMTLS while being much easier to implement, and brings PQ security to ECH
without inflating the handshake. It also lets clients make zero round-trip (0-RTT) connections on their
very first contact with a server, which TLS 1.3 cannot do today, cutting latency on first connections