[MLS] review and editorial notes on draft-ietf-mls-combiner-02

[Carlos Aguilar Melchor <[e-mail]>]

Hello all,
I am writing to share some feedback on draft-ietf-mls-combiner-02. I have
reviewed the document and have compiled some comments and a list of
editorial nits/typos.

As I am new to the IETF process, please excuse me if this format is not
standard or if I am breaching any protocol norms. I am happy to learn the
proper workflow for future contributions, so please let me know if I should
handle this differently next time.

General opinion: This is in my opinion a relevant contribution. Given that
PQ KEMs (like ML-KEM/Kyber) and especially PQ Signatures (like
ML-DSA/Dilithium or SLH-DSA/Sphincs+) are significantly larger than ECC,
the "amortized" approach is a pragmatic engineering solution to a
real-world bandwidth problem. The core idea of "seeding" PQ security into a
traditional session via the Exporter Secret is sound in principle. It
allows the high-frequency traffic to remain lightweight (classical) while
periodically "ratcheting" the PQ security.

Main technical comment: I find interesting the possibility noted in 9.1 "a
single FULL Commit in PQ/T Confidentiality Only mode followed by PARTIAL
Commits from that point onwards", and I think quite a few users may use it.
However, at first I did not measure correctly the security consequences.
One can easily think "I will have HNDL resistance, and then when CRQC will
be closer to a reality I will deal with PQ-PCS by changing the periodicity
of the FULL Commits".  This is not true, once there has been a compromise,
the attacker can start doing HNDL, so basically you delay the
post-compromise decryption to the arrival of the CRQC. I think the security
considerations section should make more explicit that assuming CRQC arrive
one day, the PCS only delay the post-compromise attacks, instead of
nullifying them, only PQ-PCS provides real post-compromise security, and
that doing only one initial FULL commit results in a system that only
resists to HNDL until the first compromise happens.

Typos/nits:
  * APQInfo is sometimes named HPMLSInfo or HPQMLSInfo (some old naming?)
  * Broken formatting at the end of section 1
  * adresses the the harvest -> remove one the
  * terms from from MLS -> remove one from
  * commmits -> remove one m
  * occuring -> occurring
  * parcipating -> participating
  * duplictate -> duplicate
  * enial-of-service -> denial-of-service
  * can be achieve -> can be achieved
  * such a option -> such an option


Best,
Carlos