Hook up X25519MKLEM768 to the TLS 1.3 handshake

This does the following:

1) Adds a second key share prediction to the TLS 1.3 handshake.
   We only add one as we are unlikely to want to send more than
   one PQ one, and one classical one and are unlikely to waste
   bytes on a second PQ algorithm (anything that wants something
   else that we support can HRR to get it)

2) Adds X25519MLKEM768 (4588) to our list of supported groups.
   We add this to our preferred client and server key shares for TLS 1.3
   and we now have a separate list for TLS 1.2 which does not do this,
   cleaning up the old "full list" from the comments.

3) Updates the golden magic numbers in the regression tests to allow
   for the above two things changing the handshake, so the regress
   tests pass.

With this you can successfully hybrid PQ with servers and clients
that support it.

ok tb@ kenjiro@

1 files changed, 4 insertions, 1 deletions

diff --git a/src/lib/libssl/ssl_local.h b/src/lib/libssl/ssl_local.h
index 9921c3a730..7942c36dbd 100644
--- a/src/lib/libssl/ssl_local.h
+++ b/src/lib/libssl/ssl_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_local.h,v 1.34 2025/10/24 09:23:06 tb Exp $ */
+/* $OpenBSD: ssl_local.h,v 1.35 2025/12/04 21:16:17 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -490,6 +490,9 @@ typedef struct ssl_handshake_tls13_st {
         /* Certificate selected for use (static pointer). */
         const SSL_CERT_PKEY *cpk;
 
+        /* Client's extra predicted key share */
+        struct tls_key_share *key_share;
+
         /* Version proposed by peer server. */
         uint16_t server_version;