[lamps] [Technical Errata Reported] RFC9935 (9020)

[[e-mail]]

The following errata report has been submitted for RFC9935,
"Internet X.509 Public Key Infrastructure - Algorithm Identifiers for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)"

--------------------------------------
You may review the report below and at:
https://errata.rfc-editor.org/eid9020/

--------------------------------------
Type: Technical
Reported by: Abel C. H. Chen <[e-mail]>

Section 9 says:

Original Text
-------------
For more detailed ML-KEM specific security considerations regarding this, randomness, misbinding properties, 
decapsulation failures, key reuse, and key checks, refer to [ML-KEM-SEC-CONS].

Corrected Text
--------------
For more detailed ML-KEM specific security considerations regarding this, randomness, misbinding properties, 
decapsulation failures, key reuse, and key checks, refer to [ML-KEM-SEC-CONS]. In the X.509 certificate, the 
digital signature should provide a security level equal to or higher than that of the KEM public key.

Notes
-----
I have observed a potential issue in some application scenarios, where the public key in the certificate may use an ML-KEM-1024 public key, 
while the corresponding signature is generated using ML-DSA-44. This could lead to a situation in which a lower-security-level digital signature is 
used to sign or endorse a higher-security-level public key.

In light of this, I would respectfully suggest considering an additional clarification in Section 9. Specifically, after the sentence: “For more detailed 
ML-KEM specific security considerations regarding this, randomness, misbinding properties, decapsulation failures, key reuse, and key checks, refer 
to [ML-KEM-SEC-CONS].”

It may be helpful to add the following statement: “In the X.509 certificate, the digital signature should provide a security level equal to or higher than that of the KEM public key.”

Instructions:
-------------
This erratum is currently posted as "Reported". Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC9935 (draft-ietf-lamps-kyber-certificates)
--------------------------------------
Title               : Internet X.509 Public Key Infrastructure - Algorithm Identifiers for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)
Publication Date    : March 2026
Author(s)           : S. Turner, P. Kampanakis, J. Massimo, B. E. Westerbaan
Category            : Proposed Standard
Source              : lamps (sec)
Stream              : IETF
Verifying Party     : IESG