D04-MQ: Yes
Rationale
The selected QUIC profile already includes TLS 1.3 mutual certificate authentication with locally generated certificates explicitly trusted by counterparts. RFC 9001 section 4.4 supplies the TLS identity-authentication boundary, while RFC 8446 CertificateVerify proves possession of the corresponding private key. An application can supply another locally controlled key/certificate over an existing UDP/IP configuration; identity creation does not require another interface address or route.
Assessment method
Documentary selected-stack classification; no new network execution
Source context
Official specifications and versioned project documentation retrieved 2026-10-15; retained document hashes
Outstanding qualification
Credit the declared locally trusted certificate profile, not arbitrary public-Web PKI issuance or default client authentication. Peer trust approval remains necessary. QUIC connection IDs alone are not the identity being credited. Multipath and proactive repetition do not establish this property and are not newly tested here. Distinct ordinary socket bindings and private key stores may be needed.
Public sources
- https://www.rfc-editor.org/rfc/rfc9001.html#section-4.4
- https://www.rfc-editor.org/rfc/rfc8446.html#section-4.4.3
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round240-sources.json