Subject: [lamps] [Technical Errata Reported] RFC9935 (9020)
From: [email-masked]
To: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked]
Cc: [email-masked], [email-masked], [email-masked]
Date: Tue, 30 Jun 2026 14:30:47 -0000
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>

The following errata report has been submitted for RFC9935,
"Internet X.509 Public Key Infrastructure - Algorithm Identifiers for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)"

--------------------------------------
You may review the report below and at:
https://errata.rfc-editor.org/eid9020/

--------------------------------------
Type: Technical
Reported by: Abel C. H. Chen <[email-masked]>

Section 9 says:

Original Text
-------------
For more detailed ML-KEM specific security considerations regarding this, randomness, misbinding properties, 
decapsulation failures, key reuse, and key checks, refer to [ML-KEM-SEC-CONS].

Corrected Text
--------------
For more detailed ML-KEM specific security considerations regarding this, randomness, misbinding properties, 
decapsulation failures, key reuse, and key checks, refer to [ML-KEM-SEC-CONS]. In the X.509 certificate, the 
digital signature should provide a security level equal to or higher than that of the KEM public key.

Notes
-----
I have observed a potential issue in some application scenarios, where the public key in the certificate may use an ML-KEM-1024 public key, 
while the corresponding signature is generated using ML-DSA-44. This could lead to a situation in which a lower-security-level digital signature is 
used to sign or endorse a higher-security-level public key.

In light of this, I would respectfully suggest considering an additional clarification in Section 9. Specifically, after the sentence: “For more detailed 
ML-KEM specific security considerations regarding this, randomness, misbinding properties, decapsulation failures, key reuse, and key checks, refer 
to [ML-KEM-SEC-CONS].”

It may be helpful to add the following statement: “In the X.509 certificate, the digital signature should provide a security level equal to or higher than that of the KEM public key.”

Instructions:
-------------
This erratum is currently posted as "Reported". Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC9935 (draft-ietf-lamps-kyber-certificates)
--------------------------------------
Title               : Internet X.509 Public Key Infrastructure - Algorithm Identifiers for the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM)
Publication Date    : March 2026
Author(s)           : S. Turner, P. Kampanakis, J. Massimo, B. E. Westerbaan
Category            : Proposed Standard
Source              : lamps (sec)
Stream              : IETF
Verifying Party     : IESG