Caddy 2.11's default post-quantum key exchange sends six times more handshake bytes
Caddy 2.10 switched on a post-quantum key exchange by default back in April, and I'd assumed, without checking, that "post-quantum" meant "slower". I ran Caddy 2.11.4 against a modern TLS client and measured the handshake instead of guessing. Post-quantum key exchange matters because a sufficiently capable quantum computer could break the classical Diffie-Hellman maths (X25519, the elliptic-curve…
Caddy 2.10 enabled a post-quantum key exchange by default in April, but the author assumed it would be slower. They ran Caddy 2.11.4 against a modern TLS client and measured the handshake, discovering that the hybrid group X25519MLKEM768 uses six times more handshake bytes compared to classical X25519. This increase is a real cost and can cause extra round trips on slow or lossy networks.
The CPU cost of ML-KEM-768 is minimal, about 37% slower than X25519 for key generation, but encapsulation is over twice as fast. Overall, the end-to-end performance difference is negligible. However, the byte cost is significant and can impact mobile-heavy audiences. The default remains compatible with older clients, which is a key advantage of the hybrid approach.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
