IETF Logo Mail Archive

[km-fs-pcs] Re: MLS encrypted in TLS

Raphael Robert <ietf@raphaelrobert.com> Thu, 18 June 2026 16:51 UTC

Return-Path: <ietf@raphaelrobert.com>
X-Original-To: km-fs-pcs@mail2.ietf.org
Delivered-To: km-fs-pcs@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 869F510387D27 for <km-fs-pcs@mail2.ietf.org>; Thu, 18 Jun 2026 09:51:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1781801463; bh=zv/ZXIlFVfrIMQspZh6CLENL7cDqPbO0UooQEtn7NyU=; h=From:Subject:Date:In-Reply-To:Cc:To:References; b=SAyu23Kj4fc3pfsXC5/BJBpMpdx20d3iWTedwgrwi89HvfXk2TquZIecYszSpH50J jP/sfW0ZyGQtBPN+ZIBf8iPsunRAstK+Cm/yz8pbO2nm3Q3bF6yFniBINqBeSHaQYO TmW9gcO6qYc6UMhPGgO6gdeLeYWhJQ0VYDZ+1OZA=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=raphaelrobert.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eHPZYFGYVaKh for <km-fs-pcs@mail2.ietf.org>; Thu, 18 Jun 2026 09:51:03 -0700 (PDT)
Received: from mail-ej1-x644.google.com (mail-ej1-x644.google.com [IPv6:2a00:1450:4864:20::644]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 0281B10386E6E for <km-fs-pcs@ietf.org>; Thu, 18 Jun 2026 09:45:26 -0700 (PDT)
Received: by mail-ej1-x644.google.com with SMTP id a640c23a62f3a-bed2b9bfa02so163672966b.1 for <km-fs-pcs@ietf.org>; Thu, 18 Jun 2026 09:45:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=raphaelrobert.com; s=rr; t=1781801126; x=1782405926; darn=ietf.org; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:from:to:cc:subject:date:message-id:reply-to; bh=7JYQn+uuAQjTSdpbcqzTitHBzrA0TiJGsV0CSCS5d0U=; b=UjFScQxGSXOicD6iJU/BgzrRxCIOrY9KqkKwsfhmGmQ0DXbfWVs/06XzZmYJi4Z2vf bIj2zgYWZIKzYFXGWdo3YS5DWDFjL+PSLDQk6arTcNOY8Jd2tQg4o4W1xlkt8xDUVhwI VsRJ4xeUeuvK7gTowhyjyk3MllLyu4J8xOsWY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781801126; x=1782405926; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=7JYQn+uuAQjTSdpbcqzTitHBzrA0TiJGsV0CSCS5d0U=; b=Ypw7VlwsFnrYK0PHVzeO7rxHeB7EURAAP7/xmD8J4bUhFXu8QWmypBy+vcpQHD6fHQ VENPvkP7S8dwLpUIPpg8X/qrdhNVdRtnncL5j+2oodZsnpSXN62ap81oB4NPS3DkSxbE YbQzh6qR2BjRjK0ErhmeREvBQ2iHHtTpy5BCr+WZa0ht9JD0RnnOtguKUClV4Fxq/7IG gJQnnIsT853YBRuuMq4AkkRX6WfYMP4XM61tuK8bYOlReSSvITMtPpVU+O8+nxqCEs2K oMFPRaicOZRSuZlrG/0mOxzQzN4rHKnb+CQD6tpJ843Dmb0xfpPJm+DCJZmrNknQJ7Jw s3pw==
X-Gm-Message-State: AOJu0YxeR1w21O+Gs1CGq9Dn/xX43mR4CL2UHfZk2PuKe4pGJDipBRKK Y0BVofpAplh+w2/S3+jRevV4F41T9XdcLXiqJ5sivVpFwNuOd31aw2CNsc1WgnqNwGWzKjbXsYM JkwuVy7qrA6yh
X-Gm-Gg: AfdE7ckxLt5BZQAllv4tZjni8UayksmyuOaMToZpOR8m758uqZBCUg420X+uhOaUx/d yjyZXTH3RIFJwqFIbJwyp67i6KuSf3fHREgAGD9HN2VNYqfOmK1geqfGhuRoCjbru+r0TGdvpuE 7I1NLkuStyoC0jXxHNoW3arUtcSokvSX4UURa8FYrdyFXHwHhNAyHlhoLLcPtjL2xMmte4s7APe SNQ9cq3cZi9qVubaJKWCnLkDqlLx18COwPPErulPLlKAPPiaKEJ7sBD875fBsLwawHBejSRitIj xB1IKGbq27sa0zDsXee24CgkGl4c5iNHPjYyAZjrXLFeOOmNWj+cLIHR31F2cVG4e79nJEyVXTk h2pO39FJB4S1Js6hIIdAJ+1qcRqmLyjmtFUiQhGybjqTyxLGmoGy37n0+iFhlPPJV24458l8LFn eTo56IgYmF/nm10iAAyDNymYx2PQ8je6PuxjZl
X-Received: by 2002:a17:907:c26:b0:bff:3797:2cb8 with SMTP id a640c23a62f3a-c074cb2cd51mr244478266b.45.1781801124659; Thu, 18 Jun 2026 09:45:24 -0700 (PDT)
Received: from smtpclient.apple ([95.90.232.177]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-bfdb9013575sm994683066b.59.2026.06.18.09.45.24 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jun 2026 09:45:24 -0700 (PDT)
From: Raphael Robert <ietf@raphaelrobert.com>
Message-Id: <831B2272-DC87-432F-BF95-0BE539049D2E@raphaelrobert.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_1216A28A-9785-4188-BB78-F6774CADCA2E"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\))
Date: Thu, 18 Jun 2026 18:45:13 +0200
In-Reply-To: <CAMYged=M3L89_qTP0VUeeFkNrhcuebiYvroCXQ+00_Pofi2Zdg@mail.gmail.com>
To: Carlos Aguilar Melchor <carlos.aguilar.1998@polytechnique.org>
References: <CAMYged=M3L89_qTP0VUeeFkNrhcuebiYvroCXQ+00_Pofi2Zdg@mail.gmail.com>
X-Mailer: Apple Mail (2.3864.600.51.1.1)
Message-ID-Hash: 7NON4QRZM7GYAWYOMHCK2CRVKVLSIXY3
X-Message-ID-Hash: 7NON4QRZM7GYAWYOMHCK2CRVKVLSIXY3
X-MailFrom: ietf@raphaelrobert.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "km-fs-pcs@ietf.org" <km-fs-pcs@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [km-fs-pcs] Re: MLS encrypted in TLS
List-Id: Key management that provides forward security and post compromise security <km-fs-pcs.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/km-fs-pcs/8xa7Bquo7YULM_L_wTf4LI2yE24>
List-Archive: <https://mailarchive.ietf.org/arch/browse/km-fs-pcs>
List-Help: <mailto:km-fs-pcs-request@ietf.org?subject=help>
List-Owner: <mailto:km-fs-pcs-owner@ietf.org>
List-Post: <mailto:km-fs-pcs@ietf.org>
List-Subscribe: <mailto:km-fs-pcs-join@ietf.org>
List-Unsubscribe: <mailto:km-fs-pcs-leave@ietf.org>

The MLS architecture document is mostly meant as guidance for applications that want to use MLS. In this case we are looking at creating a new protocol (or several) and not an application, so the guidance does not apply necessarily. As with any guidance, we can diverge from it as long as we have consensus about it being a good idea.

Raphael

> On 18. Jun 2026, at 16:28, Carlos Aguilar Melchor <carlos.aguilar.1998@polytechnique.org> wrote:
> 
> Sorry for the newbie question,
> As I was re-reading the MLS Architecture RFC (https://datatracker.ietf.org/doc/html/rfc9750#name-assumptions-on-transport-se) I found this piece of text:
> "Recommendation: Use transports that provide reliability and metadata confidentiality whenever possible, e.g., by transmitting MLS messages over a protocol such as TLS [RFC8446] or QUIC [RFC9000]."
> 
> Is this really applied by MLS applications? (e.g. MIMI or any other application using MLS). If so, what will happen in the case of MLS+TLS? We would encapsulate in TLS the initial MLS messages and then send as a TLS session application messages through another connection? 
> 
> Carlos
> 
> _______________________________________________
> km-fs-pcs mailing list -- km-fs-pcs@ietf.org
> To unsubscribe send an email to km-fs-pcs-leave@ietf.org

v2.46.0 | Report a Bug | By Email | System Status