[kitten] Re: [EXTERNAL] KEM support for PKINIT

[Simo Sorce <[e-mail]>]

On Wed, 2026-03-18 at 23:14 -0500, Nico Williams wrote:
> On Thu, Mar 19, 2026 at 02:17:18AM +0000, Steve Syfuhs (AP) wrote:
> > We got off on a tangent again. :D
> 
> Right, so bringing this back on topic, please see the point about FAST
> being an absolute requirement if you reject TLS and also insist on
> supporting legacy smartcards.

FWIW while I think modernizing Symmetric Key Distribution is a good
idea in abstract, I think we should decouple it from this PKINIT
discussion.

And while I think FAST is a good thing, there is no requirement that
comes from PKINIT, legacy cards can be used until a CRQC emerges, after
which they will be have long been replaced with new cards using PQ
signatures.

Pretending old cards public keys are somehow secret will not work
anyway. And new cars won't have the problem.

So I suggest we focus on the narrow problem of updating PKINIT to
ensure it can be used with both ML-KEM for the exchange and ML-DSA
(pure) for signatures, and the rest we'll handle in some other thread.

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc