[MLS] Re: Fwd: New Version Notification for draft-ietf-mls-pq-ciphersuites-01.txt

["Hale, Britta (CIV)" <[e-mail]>]

I would be very opposed to reverting the symmetric level to AES128 and discarding AES256.

If people have uses for the 128 level we can add them. This does lead to an expansion of options, but I will note that such a result is self-inflicted in this WG. TLS efforts for PQC have largely separated out the handshake ciphers and symmetric ciphers in discussion, e.g., such as in the following drafts which do not define anything regarding AES. It may be worth considering if we want to keep having the key exchange and symmetric channel ciphers so explicitly tied.
https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
https://datatracker.ietf.org/doc/draft-ietf-tls-mldsa/
https://datatracker.ietf.org/doc/draft-ietf-tls-mlkem/




From: Deirdre Connolly <[e-mail]>
Date: Tuesday, November 4, 2025 at 9:55 AM
To: Richard Barnes <[e-mail]>
Cc: Rohan Mahy <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: [MLS] Re: Fwd: New Version Notification for draft-ietf-mls-pq-ciphersuites-01.txt

NPS WARNING: *external sender* verify before acting.

I would be comfortable with this
On Tue, Nov 4, 2025, 12:54 PM Richard Barnes <[e-mail]<mailto:[e-mail]>> wrote:
I would like to discuss the symmetric parameters here.  I had a feeling of vague unease at the meeting yesterday, which was confirmed by some of the meeting chat raising the question of whether we need AES-256 for the 128-bit security level.

It seems like we should revert the 128-bit security level suites (MLKEM768+P256, MLKEM768+X2519, MLKEM768) to use AES128 and SHA256.  Would people have concerns with this?

--Richard

On Tue, Nov 4, 2025 at 12:48 PM Rohan Mahy <[e-mail]<mailto:[e-mail]>> wrote:
Hi,
If you want something different from what is in this draft, please create an issue, explain your motivation in a few sentences, and send to this list.

What I heard during the meeting yesterday.

- One request to make the ciphersuite with MLKEM768X25519 use AES128 instead of AES256

- One request to add one more ciphersuite MLS_256_MLKEM1024_AES256GCM_SHA384_MLDSA87

Thanks,
-rohan


---------- Forwarded message ---------
From: <[e-mail]<mailto:[e-mail]>>
Date: Tue, Nov 4, 2025 at 12:41 PM
Subject: New Version Notification for draft-ietf-mls-pq-ciphersuites-01.txt
To: Richard L. Barnes <[e-mail]<mailto:[e-mail]>>, Rohan Mahy <[e-mail]<mailto:[e-mail]>>


A new version of Internet-Draft draft-ietf-mls-pq-ciphersuites-01.txt has been
successfully submitted by Rohan Mahy and posted to the
IETF repository.

Name:     draft-ietf-mls-pq-ciphersuites
Revision: 01
Title:    ML-KEM and Hybrid Cipher Suites for Messaging Layer Security
Date:     2025-11-04
Group:    mls
Pages:    8
URL:      https://www.ietf.org/archive/id/draft-ietf-mls-pq-ciphersuites-01.txt
Status:   https://datatracker.ietf.org/doc/draft-ietf-mls-pq-ciphersuites/
HTML:     https://www.ietf.org/archive/id/draft-ietf-mls-pq-ciphersuites-01.html
HTMLized: https://datatracker.ietf.org/doc/html/draft-ietf-mls-pq-ciphersuites
Diff:     https://author-tools.ietf.org/iddiff?url2=draft-ietf-mls-pq-ciphersuites-01

Abstract:

   This document registers new cipher suites for Messaging Layer
   Security (MLS) based on "post-quantum" algorithms, which are intended
   to be resilient to attack by quantum computers.  These cipher suites
   are constructed using the new Module-Lattice Key Encapsulation
   Mechanism (ML-KEM), optionally in combination with traditional
   elliptic curve KEMs, together with appropriate authenticated
   encryption, hash, and signature algorithms.



The IETF Secretariat

_______________________________________________
MLS mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>
_______________________________________________
MLS mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>