[TLS] Re: Confirming PQ+T Signatures Consensus

[Rifaat Shekh-Yusef <[e-mail]>]

+1

The two proposals target different use cases and deployments, with pros and
cons to each.

Regards,
 Rifaat



On Tue, Sep 29, 2026 at 2:19 AM tirumal reddy <[e-mail]> wrote:

>  Hi all,
>
> As co-author of both drafts:
>
> 1. Yes
> 2. No, the two address different deployments.
> 3. Yes
> 4. Yes. If the WG prefers a single solution, I can live with composite for
> now.
>
> On the technical points raised against composite: SUF-CMA depends on the
> traditional component. Composites with Ed25519 or Ed448 are SUF-CMA; those
> with ECDSA are not (see Section 5 of -12).
>
> Most importantly, TLS requires only EUF-CMA: the signed transcript is
> unique to each TLS connection, so the same transcript is never signed
> twice, and the signature is verified once during the handshake. A second
> valid signature over an already signed transcript cannot be reused, in this
> TLS connection or any other.
>
> Cheers,
> -Tiru
>
> On Mon, 28 Sept 2026 at 22:23, Sean Turner <[e-mail]> wrote:
>
>> At IETF 126, the chairs conducted a series of polls [1] to determine the
>> way forward for PQ+T hybrid signatures after hearing from the
>> -composite-mldsa [2] and -pqt-dual-certs [3] authors; you can watch the
>> setup, authors presentations, and the polls at [4] from around 0:16:47
>> until 1:08:00. The polls' results showed in-room consensus to 1) work on PQ
>> + T Signatures for TLS and 2) work only on -composite-mldsa. The chairs now
>> need to confirm this consensus on list. We are going to do this by asking
>> the four questions that follow. Please take note of the take note of the
>> following:
>>
>> 1. Framing of the questions is found in this deck [5]; in case it is/was
>> not clear a "Yes" on Question 1 implies WG adoption of a draft.
>> 2. Again, a "Yes" for 3 or 4 implies you are in favor of adopting the
>> associated draft as a working group item.
>> 3. Based on the responses we got during the session we only asked the 1st
>> 4 questions in [5].
>>
>> Please provide your answers to the following questions by 12 October 2026:
>>
>> 1. Should the WG work on PQ + T Hybrid Signatures for TLS?
>> 2. Should the WG only work on one: -pqt-dual-certs or -composite-ml-dsa?
>> 3. Should the WG work on: -pqt-dual-certs?
>> 4. Should the WG work on: -composite-ml-dsa?
>>
>> Cheers,
>> spt (for the chairs)
>>
>> [1] https://datatracker.ietf.org/doc/polls-126-tls-202607241600/
>> [2] https://datatracker.ietf.org/doc/draft-reddy-tls-composite-mldsa/
>> [3] https://datatracker.ietf.org/doc/draft-yusef-tls-pqt-dual-certs/
>> [4] https://www.youtube.com/watch?v=Qp1s1UMmhTI
>> [5]
>> https://datatracker.ietf.org/meeting/126/materials/slides-126-tls-framing-pq-t-signatures-for-tls-00
>> _______________________________________________
>> TLS mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>>
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>