handshake: Add ix_psk2_mlkem1024, IX with an ephemeral ML-KEM-1024 exchange in the psk2 slot

header/header.go

@@ -67,8 +67,19 @@ const (
 const (
 	HandshakeIXPSK0 MessageSubType = 0
 	HandshakeXXPSK0 MessageSubType = 1
+
+	// HandshakeIXPSK2MLKEM1024 is IX with an ephemeral ML-KEM-1024 exchange mixed
+	// in through the psk2 slot. Its messages exceed the MTU and travel as
+	// fragments (see handshake/fragment).
+	HandshakeIXPSK2MLKEM1024 MessageSubType = 2
 )
 
+// IsFragmented reports whether handshake messages of this subtype travel as
+// fragments.
+func IsFragmented(st MessageSubType) bool {
+	return st == HandshakeIXPSK2MLKEM1024
+}
+
 var ErrHeaderTooShort = errors.New("header is too short")
 
 var subTypeTestMap = map[MessageSubType]string{
@@ -88,7 +99,8 @@ var subTypeMap = map[MessageType]*map[MessageSubType]string{
 	Test:        &subTypeTestMap,
 	CloseTunnel: &subTypeNoneMap,
 	Handshake: {
-		HandshakeIXPSK0: "ix_psk0",
+		HandshakeIXPSK0:          "ix_psk0",
+		HandshakeIXPSK2MLKEM1024: "ix_psk2_mlkem1024",
 	},
 	Control: &subTypeNoneMap,
 }
@@ -199,7 +211,7 @@ func IsValidSubType(t MessageType, s MessageSubType) bool {
 	case Message:
 		return s == MessageNone || s == MessageRelay
 	case Handshake:
-		return s == HandshakeIXPSK0
+		return s == HandshakeIXPSK0 || s == HandshakeIXPSK2MLKEM1024
 	case Test:
 		return s == TestReply || s == TestRequest
 	case Control, CloseTunnel, RecvError, LightHouse:

header/header_test.go

@@ -96,7 +96,8 @@ func TestTypeMap(t *testing.T) {
 		Test:        &subTypeTestMap,
 		CloseTunnel: &subTypeNoneMap,
 		Handshake: {
-			HandshakeIXPSK0: "ix_psk0",
+			HandshakeIXPSK0:          "ix_psk0",
+			HandshakeIXPSK2MLKEM1024: "ix_psk2_mlkem1024",
 		},
 		Control: &subTypeNoneMap,
 	}, subTypeMap)
@@ -122,6 +123,7 @@ func TestIsValidSubType(t *testing.T) {
 	assert.False(t, IsValidSubType(Message, 2))
 
 	assert.True(t, IsValidSubType(Handshake, HandshakeIXPSK0))
+	assert.True(t, IsValidSubType(Handshake, HandshakeIXPSK2MLKEM1024))
 	// HandshakeXXPSK0 is defined but not a wire-valid subtype.
 	assert.False(t, IsValidSubType(Handshake, HandshakeXXPSK0))