[TLS] Re: [EXTERNAL] Re: Fwd: New Version Notification for draft-yusef-tls-pqt-dual-certs-02.txt

[Ilari Liusvaara <[e-mail]>]

On Tue, Jul 14, 2026 at 09:10:43PM +0000, John Gray wrote:
> We need to support composite authentication in private PKI use-cases.
> In a private PKI, it is easy for us to issue composite certificates. 
> We have business to business applications which communicate via TLS
> and they make use our PKI issued certificates.  We need to be able
> to use composite authentication between them.

Sure, if the private PKI has associated security profile standard, that
should work.


> >With composite certificates, the combinatorial explosion occurs directly
> >in certificates, which is the absolutely worst place to have that in.
> 
> As Scott said, Composite signatures are just a signature algorithm,
> and they already have IANA registered OIDs. At the certificate level,
> they are just a signature.  The certificate logic doesn't need any
> changes.  

The issue is not in implementation, but in operations.


> By the way, I'm not against the multi-certificates draft either.  I
> don't agree that there has to be 3 PKI's in a transition...  
> Traditional - > PQ/T  -> PQ.     Once you are on a PQ/T, you don't
> need to be in a hurry to migrate away from it. If EC/RSA is broken
> by a CRQQ, then composite ML-DSA is close to as good as pure ML-DSA
> at that point, so why would you need to expend the effort to move to
> the pure ML-DSA when you are already essentially there?

Unfortunately, there is the zombie crypto risk.


> A word of caution:  When we originally designed composite signatures
> back in 2019, we tried to make it flexible in a similar way as
> multi-certs.   We defined s structure called composite that specified
> the algorithm identifiers for the algorithms that make up the
> composite. The LAMPS working group told us it was a "foot canon" and
> that implementors would choose the worst possible Insecure
> combinations, and that we needed to take the choice away.  

While that sort of design seems very problematic for other reasons
(which do not apply to dual certs), it is not because of folks picking
insecure combinations. In practice, insecure combinations seem to be
extremely rare at worst.




-Ilari