[panavenue]

Summary

Documents Post-Quantum Cryptography (PQC) TLS 1.3 key exchange (X25519MLKEM768) support in README.md and adds unit and mock-server handshake tests verifying default PQC negotiation, classical fallback, and GODEBUG=tlsmlkem=0 opt-out.

No production code changes are required: ConnectionInfo.TLSConfig() already configures MinVersion: tls.VersionTLS13 with empty CurvePreferences, so Go's crypto/tls automatically offers and negotiates X25519MLKEM768 (0x11ec) when built with Go 1.24+ and go >= 1.24 in the application's main go.mod.

Changes

• README.md: Add a Post-Quantum Cryptography (PQC) section covering default X25519MLKEM768 negotiation, the go.mod go >= 1.24 (tlsmlkem) language version rule, automatic fallback to classical X25519 when a server only offers classical groups, and opting out via GODEBUG=tlsmlkem=0 (or godebug / //go:debug directives).
• pqc_test.go & internal/mock/cloudsql.go & dialer_test.go: Add backwards-compatible ServerProxyOption helpers (WithServerCurvePreferences, WithServerConnectionStateHook) and end-to-end Dialer.Dial tests asserting negotiated TLS 1.3 version and CurveID on both client and server tls.ConnectionState:
  • Default connection, metadata exchange (MDX), and CAS SAN validation negotiate tls.X25519MLKEM768.
  • Classical-only servers (X25519 and P-256 via HelloRetryRequest) fall back cleanly and exchange data.
  • Client opt-out (GODEBUG=tlsmlkem=0) against a PQC-capable server negotiates classical tls.X25519.
• internal/cloudsql/instance_test.go: Assert ConnectionInfo.TLSConfig().CurvePreferences remains unset so Go's default hybrid post-quantum curves stay enabled.