MIME-Version: 1.0
From: tirumal reddy <kondtir@gmail.com>
Date: Wed, 10 Sep 2025 19:01:19 +0530
Message-ID: 
 <CAFpG3gdU5945E4rcHTLWvZdD_RFeER-dw9jXimb2_G6UPfqAUQ@mail.gmail.com>
To: ops-dir@ietf.org, Last Call <last-call@ietf.org>,
	draft-ietf-cose-dilithium.all@ietf.org, JOSE WG <jose@ietf.org>,
	cose <cose@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000c2faf0063e7271d3"
Message-ID-Hash: MWGWG6QMW5XFPY3MKA3UWJSAUXTDCBIC
Precedence: list
Subject: =?utf-8?q?=5BCOSE=5D_=5BOPS-DIR=5D_draft-ietf-cose-dilithium_call_Opsdir_rev?=
	=?utf-8?q?iew?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/cose/1-yzyM7d5Z18hzNjT12efw9y-qM>

--000000000000c2faf0063e7271d3
Content-Type: text/plain; charset="UTF-8"

Document: draft-ietf-cose-dilithium
Title: ML-DSA for JOSE and COSE
Reviewer: Tirumaleswar Reddy
Review result: "Ready with Issues"

Hi,

I have reviewed this document as part of the Ops Area Directorate's ongoing
effort to review all IETF documents being processed by the IESG. These
comments are written primarily for the benefit of the Ops Area Directors.
Document editors and WG chairs should treat them like any other Last Call
comments.

The draft is well-written and addresses an important need for PQC
migration.  I have a few operational and deployment-related observations
that may help improve the document:

1. ML-DSA produces significantly larger public keys and signatures compared
to traditional algorithms. This size increase can create challenges for
deployments with limited bandwidth, memory, or processing capacity.  I
suggest adding text to highlight it.

2. I suggest adding a reference to Section 8.3 of
draft-ietf-lamps-dilithium-certificates, which explains the rationale for
disallowing HashML-DSA.

3. It may be useful to add a note to explain why only the seed format was
chosen for private keys, given that the LAMPS WG selected the expanded
private key format to maximize interoperability with existing
implementations.

4. You may want to refer to the security considerations in
https://datatracker.ietf.org/doc/draft-ietf-lamps-dilithium-certificates/
and discuss if randomized signing is preferred over deterministic signing.

Cheers,
-Tiru

--000000000000c2faf0063e7271d3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Document: draft-ietf-cose-dilithium<br>Title: ML-DSA for J=
OSE and COSE<br>Reviewer: Tirumaleswar Reddy<br>Review result: &quot;Ready =
with Issues&quot;<div><br></div><div>Hi,<br><br>I have reviewed this docume=
nt as part of the Ops Area Directorate&#39;s ongoing effort to review all I=
ETF documents being processed by the IESG. These comments are written prima=
rily for the benefit of the Ops Area Directors. Document editors and WG cha=
irs should treat them like any other Last Call comments.<br><br>The draft i=
s well-written and addresses an important need for PQC migration.=C2=A0 I h=
ave a few operational and deployment-related observations that may help imp=
rove the document:<br><br>1. ML-DSA produces significantly larger public ke=
ys and signatures compared to traditional algorithms. This size increase ca=
n create challenges for deployments with limited bandwidth, memory, or proc=
essing capacity.=C2=A0

I suggest adding text to highlight it.<br><br>2. I suggest adding a referen=
ce to Section 8.3 of draft-ietf-lamps-dilithium-certificates, which explain=
s the rationale for disallowing HashML-DSA.<br><br>3. It may be useful to a=
dd a note to explain why only the seed format was chosen for private keys, =
given that the LAMPS WG selected the expanded private key format to maximiz=
e interoperability with existing implementations.</div><div><br></div><div>=
4. You may want to refer to the security considerations in <a href=3D"https=
://datatracker.ietf.org/doc/draft-ietf-lamps-dilithium-certificates/">https=
://datatracker.ietf.org/doc/draft-ietf-lamps-dilithium-certificates/</a> an=
d discuss if randomized signing is preferred over deterministic signing.=C2=
=A0</div><div><br></div><div>Cheers,<br>-Tiru</div></div>

--000000000000c2faf0063e7271d3--