[Last-Call] Re: Last Call: <draft-ietf-tls-mldsa-03.txt> (Use of ML-DSA in TLS 1.3) to Informational RFC

[John C Klensin <[e-mail]>]

Rich,

Sorry for the delay -- took me this long to figure out how to explain
the problem with your analogy and I think the principle is important.
Inline below.

--On Thursday, May 21, 2026 13:59 +0000 "Salz, Rich"
<[e-mail]> wrote:

>   *
>   The problem is
>   *
> that, if we are aware of problems -- even if the significance or
>   *
> details of the problems is controversial -- that should inform the
>   *
> choices people make.
> 
> The significant and details of the problems is so​ controversial
> that we have not been able to achieve consensus. It has not been
> helped by the tactics that have been used, repeated appeals,
> threats of appeals, flooding draft repositories with multiple
> issues that say the same thing, repeating the same damn arguments
> over and over in multiple working groups.

First of all, I completely agree with the above.  With RFC 9945
published in February after approval in October and the call for
volunteers issued in mid-March, I hope the IESG gets around to
announcing the initial panel soon and that it (and we) can figure out
effective and efficient ways to deal with tactics like we have
experienced here and that you have summarized above.

That said,...

> Here's an imperfect analogy. The speed limit is 30 (mph or kph
> whatever). PQ-car-makers are confident that their car can handle
> the limit; Hybrid-car-makers are confident that their car can go up
> to twice the limit. Should the IETF say anything?  Next
> complication consider that the 30 limit can vary for each set of
> roads. Now should the IETF say anything? Hint: 30 stands in for
> whatever the local evaluation and deployment considerations are.

Suppose the IETF had a collection of standards that specified the
design and/or behavior of automobiles, including ones that specified
-- for either technical or safety/policy reasons or both, that
driving them at unlimited speeds was not a good idea.  If we then had
unresolvable disagreements about any of 

 (i) whether different speed limits should apply to different
	 types of vehicles
 (ii) or different types of roads
 (iii) or drivers with different years of experience or other 
    qualifications or certifications
 (iv) or drivers with different driving records
 (v) and/or, more generally, how speed limits should be set

my answer would be, "yes, we have some obligation to document the
disagreement and positions taken" rather than assuming that
jurisdictions making decisions would understand the positions about
which there is disagreement and, to the degree we could describe it,
the tradeoffs, strengths, and weaknesses of each.  That would be true
regardless of which of those positions were taken, noting that, for
speed limits different jurisdictions have adopted different positions
on each other (i)-(iv).  For example, and pushing yours a bit
further, substitute "heavy-truck-makers" for "PQ-car-makers" and
"passenger-car-makers" for "Hybrid-car-makers".  Easy, no, but, if
the arguments leading to disagreements had actually been made, and
made with at least reasonable coherency, then I think we would be
obligated to try to explain the disagreements rather than assuming
that decision-makers would understand all of the possibilities and
suggested criteria by virtue of being able to read our standards.

best,
    john