However, the proposal seems to apply only to RELAY cells, not EXTEND2 or CREATE2 cells. How, then, would Tor support PQC during circuit creation and extension? In other words, what would happen if a PQ KEM caused EXTEND2, CREATE2, or similar cells to become too large to fit within the current fixed-length cell format?
Proposal 340 is a prerequisite for us to implement before we can implement any handshakes that are larger than the current cell size limits. That’s basically all of them. Proposal 340 wasn’t designed only with PQC in mind though. It was also relevant when we were looking into the first iteration of UDP support, which was postponed to after we are in an Arti Relay world.
A more interesting overview to the post-quantum situation can be found in 355-revisiting-pq - Tor design proposals where the prerequisite is also mentioned as footnote number 2.
Thank you for your response! I’ve read through the proposal you shared. If I understood the materials and your response correctly, it seems that (1) cell fragmentation will eventually be applied to all relevant cell types, rather than only to RELAY cells, and (2) all of the PQ handshake variants you’re currently considering require this cell fragmentation. Is my understanding correct?
Additionally, I’d like to ask whether using variable-length cells could address this problem, and whether you’ve considered this approach. Personally I believe that variable-length cells may not be an ideal solution in terms of either privacy (e.g., an increased risk of deanonymization) or efficiency (e.g., practical constraints such as the MTU would limit how much the cell size could actually be increased).
