[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Bas Westerbaan <[e-mail]>]

Hi Jake,

Adding reference to composites in this PR:
https://github.com/tlswg/tls-mldsa/pull/32


> > There is no value in deploying

> PQ if both ends don't support the same thing, and installing 20
> > certificates is not practical.
>
> Practicality seems rather subjective or at least highly contextual. Most
> of the HTTPS infrastructure would be impractical without the automation
> that is already in place. It is natural to extend that automation to
> cover this kind of problem as well, isn't it?


There are many other server operators on this list with an enthusiasm for
automation and not breaking their target audience. Let's hear from them.


> If browser vendors want to
> work everywhere, they'll likely need to support a set of cryptography
> that is global.


If everyone would accept all composites, then we can just pick one at
random. We can't because some are not acceptable to everyone. If that's
because of security then it's important to note that the verifier sets the
policy: it's what the browser accepts that determines security, not what
the server installs. Hence, if there is fragemtation because of security
concerns, then we must have browsers that accept some composites and not
others.


> My position is different. I do not mind a large number of variants, I
> care about the diversity of the variants, and other design factors. The
> primary and most important goal is to actually achieve security.


Your browser is only as secure as the weakest variant you accept. Thus
adding diversity decreases security.


> In draft-ietf-lamps-pq-composite-sigs the authors use the term Trad for

Traditional which is amusing and it fits. It seems that it would be nice
> if they also used the term Rad for the new, hopefully post-quantum,
> cryptographic primitives.


That's pretty funny :).


> One of the considerations is related to raw RNG outputs as I mentioned
> in my NIST comments that I cited in my previous email. I trust that
> you've read my comment to NIST[0] but if not, please consider doing so.


I trust you've also seen my comment on the same forum on the same matter on
April 29, 2023, hence it puzzles me you bring it up.


> Another perhaps more interesting consideration is to have geopolitical
> diversity.
>

I'd like to stay away from discussing malicious motivations as that makes
productive work difficult. I do hope you considered privately the question
what an actor would do that would have a keen interest in delaying the
adoption of PQC.

Best,

 Bas