Subject: [TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3
From: Falko Strenzke <[email-masked]>
To: Andrei Popov <Andrei.Popov=[email-masked]>, "Scott Fluhrer (sfluhrer)" <sfluhrer=[email-masked]>, Muhammad Usama Sardar <[email-masked]>, Kris Kwiatkowski <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Tue, 14 Apr 2026 07:50:02 +0200
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>

I also see the need for ML-DSA composite signatures in TLS and thus 
would support adoption of draft-reddy-tls-composite-mldsa. The demand 
for composite arises clearly in the European context, where – as should 
be well known – multiple national information security authorities have 
set the use of PQ/T hybrids as the standard.

Falko

Am 13.04.26 um 18:30 schrieb Andrei Popov:
>
> Just to weigh in on this: I would support adoption of 
> draft-reddy-tls-composite-mldsa. There is customer demand for 
> composite certs, and I would like to get these implemented in the 
> Windows TLS stack.
>
> Cheers,
>
> Andrei
>
> *From:*Scott Fluhrer (sfluhrer) <sfluhrer=[email-masked]>
> *Sent:* Monday, April 13, 2026 12:30 AM
> *To:* Muhammad Usama Sardar <[email-masked]>; 
> Kris Kwiatkowski <[email-masked]>; [email-masked]
> *Subject:* [EXTERNAL] [TLS] Re: Working Group Last Call for Use of 
> ML-DSA in TLS 1.3
>
> If you would prefer hybrid authentication, then I would suggest you 
> publicly endorse either draft-reddy-tls-composite-mldsa (composite 
> signatures; that is, the cert has both classical (e.g. RSA) and pq 
> public keys (e.g. ML-DSA) and both are used to sign in a single 
> logical signature operation) or draft-yusef-tls-pqt-dual-certs (the 
> server sends both a classical certificate  and a pq certificate, and 
> TLS generates two signatures using the two public keys)
>
> Both are currently individual drafts; public support would be useful 
> to make them working group items.
>
> My opinion: composite would be easier to for the working group; 
> composite signature algorithms (and composite certificates) are very 
> close to becoming an RFC (draft-ietf-lamps-pq-composite-sigs).  From 
> the TLS perspective, all that would be needed in addition are code 
> points (because it could just treat the signature algorithm in the 
> composite draft as just another signature algorithm).
>
> ------------------------------------------------------------------------
>
> *From:* Muhammad Usama Sardar <[email-masked]>
> *Sent:* Sunday, April 12, 2026 8:54 PM
> *To:* Kris Kwiatkowski <[email-masked]>; [email-masked] <[email-masked]>
> *Subject:* [TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3
>
> TL;DR: My concern has been addressed and I am happy to step back from 
> opposition to no opinion on this WGLC. I would have preferred 
> standardizing hybrids.
>
>
> _______________________________________________
> TLS mailing list [email-masked]
> To unsubscribe send an email [email-masked]
-- 

*MTG AG*
Dr. Falko Strenzke

Phone: +49 6151 8000 24
E-Mail: [email-masked]
Web: mtg.de <https://www.mtg.de>

------------------------------------------------------------------------

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>