MIME-Version: 1.0
References: 
 <CAOgPGoDd=qhg-mGzB8mrFOGVKHY_9uz+_EO3P_i0_e8TG6v0Mw@mail.gmail.com>
 <3256af6a-db98-42c7-839e-e96802cae2dd@cs.tcd.ie>
 <f03a0f9f-bb6c-4955-8e4b-359b3bad01cc@tu-dresden.de>
 <7272e373-0e4c-4c66-8f42-e015afaa5d4b@app.fastmail.com>
In-Reply-To: <7272e373-0e4c-4c66-8f42-e015afaa5d4b@app.fastmail.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Sun, 22 Mar 2026 15:06:38 -0700
Message-ID: 
 <CABcZeBMP46dzcTCB5yx=cZLuL6saqYqhDw73mHjMrwGjWgA64w@mail.gmail.com>
To: Filippo Valsorda <filippo@ml.filippo.io>
Content-Type: multipart/alternative; boundary="0000000000000e3253064da42473"
Message-ID-Hash: ZEDJ3Y55OI5FF57SKVEKBSHEP3T4GOMO
CC: tls@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_Status_of_ML-KEM_WGLC?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/0-wa7XVNyi6LkShJwYvWp3rEWVQ>

--0000000000000e3253064da42473
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Mar 22, 2026 at 2:56=E2=80=AFPM Filippo Valsorda <filippo@ml.filipp=
o.io>
wrote:

> 2026-03-22 22:23 GMT+01:00 Muhammad Usama Sardar <
> muhammad_usama.sardar@tu-dresden.de>:
>
> Hi Joe and Sean,
>
> I have the same concern as Stephen. Please precisely specify the binary
> outcome of the WGLC.
>
> Moreover, please add the following to the list:
>
>    - Bring an attestation of ML-KEM from Crypto Review Panel [0] of CFRG
>
>
> I=E2=80=99m sorry, what is a Crypto Review Panel =E2=80=9Cattestation,=E2=
=80=9D what is it
> expected to bring over the multi-year, international NIST competition, an=
d
> why would an IRTF opinion be blocking for an IETF document?
>

FWIW, I agree with you in the specific case of ML-KEM.

To the broader question, I think that the IETF should avoid adopting
algorithms
that haven't seen a sufficient level of vetting. This could be provided by
CFRG
or, as you observe, by a multi-year international NIST competition.

-Ekr

--0000000000000e3253064da42473
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g=
mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Sun, Mar 22,=
 2026 at 2:56=E2=80=AFPM Filippo Valsorda &lt;<a href=3D"mailto:filippo@ml.=
filippo.io">filippo@ml.filippo.io</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><u></u><div><div>2026-03-22 22:23 GMT+01:0=
0 Muhammad Usama Sardar &lt;<a href=3D"mailto:muhammad_usama.sardar@tu-dres=
den.de" target=3D"_blank">muhammad_usama.sardar@tu-dresden.de</a>&gt;:</div=
><blockquote type=3D"cite" id=3D"m_-4960808755334518967qt"><p>Hi Joe and Se=
an,</p><p>I have the same concern as Stephen. Please precisely specify the
      binary outcome of the WGLC.</p><p>Moreover, please add the following =
to the list:</p><ul><li>Bring an attestation of ML-KEM from Crypto Review P=
anel [0] of
        CFRG</li></ul></blockquote><div><br></div><div>I=E2=80=99m sorry, w=
hat is a Crypto Review Panel =E2=80=9Cattestation,=E2=80=9D what is it expe=
cted to bring over the multi-year, international NIST competition, and why =
would an IRTF opinion be blocking for an IETF document?</div></div></blockq=
uote><div><br></div><div>FWIW, I agree with you in the specific case of ML-=
KEM.</div><div><br></div><div>To the broader question, I think that the IET=
F should avoid adopting algorithms</div><div>that haven&#39;t seen a suffic=
ient level of vetting. This could be provided by CFRG</div><div>or, as you =
observe, by a multi-year international NIST competition.</div><div><br></di=
v><div>-Ekr</div><br></div></div>

--0000000000000e3253064da42473--