[TLS] Re: Charter complaint to ADs regarding draft-ietf-tls-mldsa and draft-ietf-tls-mlkem

[John Mattsson <[e-mail]>]

>Both of you are saying "IESG bad”

I have never said that the IESG is bad. On the contrary, I think the IESG is doing a great job. What I said is that I believe there was a charter violation in LAMPS, and that the IESG failed to catch it. That does not make the IESG bad. However, I do think it completely undermines Bernstein’s claim that the IESG intentionally allows charter violations for standalone algorithms. I also think Bernstein is incorrect in claiming that there have been charter violations in TLS.

Cheers,
John Preuß Mattsson

On 2026-09-22, 13:19, "Nico Williams" <[e-mail]> wrote:

On Tue, Sep 22, 2026 at 06:45:19AM +0000, John Mattsson wrote:
> >But surely a WG's charter binds the WG, not the IETF?
>
> The IESG is ultimately responsible for ensuring that documents
> published by a WG comply with the WG’s charter. In the case of
> draft-ietf-lwig-curve-representations (Internet Area), the charter

That one doesn't sound like a LAMPS work item.  The ADs could decide
that it ought to be a LAMPS WG work item, of course, but it doesn't
strike _me_ as such.

My point is very narrow: a work item does not fall into a WG then the
WG's charter does not apply.

> violation was caught by the Transport AD. In the case of
> draft-ietf-lamps-pq-composite-sigs (Security Area), nobody appears to
> have caught it.
>
> LAMPS is chartered to specify only the use of quantum-resistant
> algorithms from NIST or algorithms vetted by the CFRG.
> draft-ietf-lamps-pq-composite-sigs specifies the use of new
> quantum-resistant algorithms that are neither from NIST nor vetted by
> the CFRG.

draft-ietf-lamps-pq-composite-sigs specifies composites of ML-DSA.  That
seems to be squarely in-charter.  If you mean that the resulting
composites are not secure, that's another story:

> The document in question specifies new quantum-resistant algorithms
> with new algorithm identifiers and substantially different
> cryptographic properties from the NIST algorithms. In particular,
> these algorithms introduce two distinct malleability vulnerabilities
> and destroy the BUFF properties. The absence of such properties has
> contributed to significant practical vulnerabilities in the past. The
> composites do not even qualify as hybrids under EU and Canadian
> definitions. These new algorithms have not been vetted by the CFRG.

But your point was that it was outside the LAMPS WG charter.  Is it?

> This casts serious doubt on Bernstein’s accusation that IETF
> leadership intentionally violated WG charters to publish standalone
> algorithms, which he describes as “playing procedural games to damage
> security at NSA’s request.” The apparent facts point in a rather
> different direction: IETF leadership appears to have allowed a WG to
> pursue the publication of composite algorithms in violation of its
> charter, apparently by mistake.

That's a subtle distinction.  Both of you are saying "IESG bad", but for
different reasons.  My point was very narrow and not directly relevant
to that debate.

> If the IESG takes formal procedures and WG charters seriously, which
> it should, it should stop publication of
> draft-ietf-lamps-pq-composite-sigs as a LAMPS WG document under the
> current charter.

That requires a careful legalese reading of the charter.

Nico
--