Module transport 

Dialing a macula 12 station over QUIC, as macula-go’s transport does.

Raw QUIC (RFC 9000) with the ALPN "macula", TLS 1.3 only, and one key exchange group: SecP384r1MLKEM1024 (ML-KEM-1024, NIST category 5), as macula-go offers since 0.23.0. macula-pqc’s provider also carries SecP256r1MLKEM768 for peers that still lead with it; a dial keeps only SecP384r1MLKEM1024 from it. Offering one group is what refuses every other: rustls aborts a handshake whose ServerHello or HelloRetryRequest names a group the client did not offer (RFC 8446, 4.1.3 and 4.1.4), and a station that has no SecP384r1MLKEM1024 fails the handshake itself. The negotiated group cannot be read back afterwards: quinn 0.11 reports it only under a private test feature (macula-rust#18). A station’s certificate is self-signed, so it is not checked against a CA: macula-pqc’s KeyPossessionVerifier accepts exactly one certificate whose key is ML-DSA-87, then the station’s handshake signature under that key. That proves the station holds the key, not who it is: the handshake then checks the station’s TLS binding, which ties this leaf to the identity key whose node_id the target pins (see crate::handshake). A target without an expected node_id is refused before anything is dialed.

quinn protects QUIC Initial packets with the suite it finds in the rustls provider, and RFC 9001 fixes that suite at AES-128-GCM, which macula-pqc’s provider does not offer for the handshake itself; the configuration is therefore built with with_initial and macula-pqc’s quic_initial_suite.

Structs

Dialed

A dialed station: the QUIC connection, the endpoint it runs on, the leaf certificate the station presented (DER), and the target it was dialed as. The endpoint must live as long as the connection.

Target

A station to dial: where it listens, the profile the node runs, and the node_id the station must prove in the handshake.

Enums

DialError

Why a dial failed.

Constants

ALPN

The ALPN macula stations listen for.

IDLE_TIMEOUT

macula’s QUIC idle timeout and keep-alive: long enough to tolerate a real gap between frames, with pings often enough that a healthy connection is never mistaken for a dead one.

KEEP_ALIVE_INTERVAL

Functions

dial_target

Dials target: QUIC and TLS 1.3 with SecP384r1MLKEM1024 alone, the station’s certificate checked for an ML-DSA-87 key it holds.