[Plants] Re: Call for adoption: draft-gray-plants-mtc-deploy-use-cases-01 (Ends 2026-10-02)

["[e-mail]" <[e-mail]>]

Michael,
> RFC9915 is necessary, but I don't think it is sufficient.
Agreed.
> {If we want non-MTC PKI to work with browsers, such as for Quantum-Safe Enterprise (private) PKI, then we'll need to make sure that the non-MTC does not go away.  > I think that there is a real risk}
I am talking about public PKI.   Enterprises have many unmanaged clients.  It is also not a small scale.   JPMorganChase reports 86.6 million Consumer & Community Banking customers, 75 million digitally engaged customers, and 11.1% of U.S. retail deposits. The Blue Cross Blue Shield system covers more than 115 million people, approximately one in three Americans. Their public websites and Internet services authenticate through public PKI to unmanaged customer devices. These organizations cannot ask tens of millions of customers to install a new CA root before banking, obtaining insurance information, or accessing healthcare services.
But, I do not want to hijack this adoption call.   I have written this up as a paper for the upcoming PQC IAB workshop.  If it is not accepted, then I will see if I can do something in SAAG.
Sorry to authors of mtc-deploy-cases.  I will stop talking now!!!
Thanks,
Chief Technology OfficerOutside the Stacks, Inc.https://www.outsidethestacks.com

Chief Operating OfficerIndustry Network Technology Councilhttps://www.industrynetcouncil.org 

    On Wednesday, September 23, 2026 at 12:57:09 PM PDT, Michael Richardson <[e-mail]> wrote:  
 
 
[e-mail] <[e-mail]> wrote:
    > The problem is that I was not able to make a cert with ML-DSA work
    > correctly without importing the root cert.  Try it yourself with
    > mldsa.digicert.com.  I, personally, feel this is not something which is

Nalini, this is true for every algorithm.

If/When the public anchors move to MLDSA (or MTC or 3ROT13), then those
anchors will be commonly present.

RFC9915 is necessary, but I don't think it is sufficient.

{If we want non-MTC PKI to work with browsers, such as for Quantum-Safe Enterprise
(private) PKI, then we'll need to make sure that the non-MTC does not go
away.  I think that there is a real risk}

--
Michael Richardson <[e-mail]>  . o O ( IPv6 IøT consulting )
          Sandelman Software Works Inc, Ottawa and Worldwide

**      My working hours and your working hours may be different.        **
** Please do not feel obligated to reply outside your normal working hours **




_______________________________________________
Plants mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]