IETF Logo Mail Archive

[TLS] Deployability of DTLS 1.3, HRR, and MLKEM512X25519

John Mattsson <john.mattsson@ericsson.com> Mon, 31 August 2026 10:39 UTC

Return-Path: <john.mattsson@ericsson.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 6483413225B44 for <tls@mail2.ietf.org>; Mon, 31 Aug 2026 03:39:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1788172743; bh=RPsiWS9757r+hCHmvgCGLB7dQjuxbVc2TS9OBXbo510=; h=From:To:Subject:Date; b=IgSDSt51/5TS0Q8PVbMv6yEAyQ1Ca3ENCktBtyBIXd/YqmpP97qyMQUaM5iiCo11c CcDMwdo8sbsjsoMG0wTloImsVkOryqzghoLNYJurQpAZOzxPbAjH4aoxF+8OVF5qDR PUOug0WAE3N13L3bBXhUKEySekbaBudOh8bosFlg=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=ericsson.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fJ_PjfJnyxvj for <tls@mail2.ietf.org>; Mon, 31 Aug 2026 03:39:02 -0700 (PDT)
Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11013018.outbound.protection.outlook.com [52.101.72.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C9A5E13225B3D for <tls@ietf.org>; Mon, 31 Aug 2026 03:39:02 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Hc//AzzcPBQrNCN+YpEMaU7rT8Dph1e/IUbJ6pfWE6g2e2i4gjHR2ygYOtDSvE7aZwpfe2/a2oKmu3tJ94lcRO6gRTpbTr5V2SJs/GGbHLIjANorho1xUSskpvjhSAmMbqySPvfi2oItIhRWbkZDAqPPJJBjeoPtd9YzGLHuLUCnfMnmhJKjHaVt23ertpwgCCO8foSQSSYRN0T6sdkIzcplsa9xWcSgFxqgb7kQsdnHiHlYEuVpYecFdQe9rQQZsW+0XwB/IZJF0HYoPrm//tD4Urp1GAddBF0XKwwTyCQakLa5p0yMgMOoB8VEv1E+MS5rqB7p2q/N0S2Opu8RpA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RPsiWS9757r+hCHmvgCGLB7dQjuxbVc2TS9OBXbo510=; b=hEi+0p0Wm0GMiN2QmL4iGSJh4PBeODEIaFuhaPYU6X0Awkoqw2a2TsricgL6EXsbBit6nWQi9ERWvcZ2JsuYGP6MSX+FjAhb7IZytscyt7Bfk27MwEPlmVi2slvPqEPjm779s16sX1hBso9OwaOnwdQ22G3kFAlv44s8iXUBc0cz0qUquflPErJhDl3koeISpC131xMpoTNEo7Fr5dWR2+3EQ82BGMuPlU4IlAcwUK32s74TP9rDLJCgUamtah9iwzfYnB9F+4I7TeYOl9s5NwUtMVFxqiLhgSNcevO7YDQqH5bdbCd1y5YwtbDpGt9trXoZCxajHqx3COwJEvCm3Q==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RPsiWS9757r+hCHmvgCGLB7dQjuxbVc2TS9OBXbo510=; b=g4TfWOPdA9ZJvRxn2wzV+TYsf61jOHkQuU6C089AMhT37h6n+peoS960B9JObemLRvmAQ1hmvysRIX3aUbtcsmKbx5QF2SJBbLTxts+bXZckd9wpL0BtdW3KC/ax8xMF6nvgDlmG1v8+JGZsLHP01CE8VHgyHXu30kZUz8gMTWmbinfkHKXFK5VCC3M/qPbcZrUYRks+FFklgDj6qvXS2Rq8aoicPOvl61u/hnDIZCGc8QDLEd9WDS5DV1XqMhfQmJSAcHpweg4fT1o+vAU65w/rG+2kaZkP9ZZq7NPnP92D1GGOyCGlVGILblUx6Mp9dSqgBVmXwkJ6prQLdJdndw==
Received: from AS4PR07MB8825.eurprd07.prod.outlook.com (2603:10a6:20b:4f3::15) by PR3PR07MB8289.eurprd07.prod.outlook.com (2603:10a6:102:17c::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Mon, 31 Aug 2026 10:38:54 +0000
Received: from AS4PR07MB8825.eurprd07.prod.outlook.com ([fe80::11a4:5f37:fa92:f174]) by AS4PR07MB8825.eurprd07.prod.outlook.com ([fe80::11a4:5f37:fa92:f174%5]) with mapi id 15.21.0360.003; Mon, 31 Aug 2026 10:38:54 +0000
From: John Mattsson <john.mattsson@ericsson.com>
To: "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: Deployability of DTLS 1.3, HRR, and MLKEM512X25519
Thread-Index: AQHdOSKstMnppxV90kmwzM0yzj7SPw==
Date: Mon, 31 Aug 2026 10:38:54 +0000
Message-ID: <AS4PR07MB882587C4F9F2AE3F9447B25189A92@AS4PR07MB8825.eurprd07.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-reactions: allow
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=ericsson.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: AS4PR07MB8825:EE_|PR3PR07MB8289:EE_
x-ms-office365-filtering-correlation-id: 6fc6d848-66de-44db-eb73-08df074c0df4
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|376014|10067099003|18002099003|8096899003|11063799006|56012099006|38070700021;
x-microsoft-antispam-message-info: 22T7QQiYxkEs/+bKn4HwX/8wQ8ULUaDv4QUkCGsrK5qno6K3sIJOaetALBQ0vSRwzHIbU16LuF9KeHK84GLuaz/ZsPXso/DHNRgkwZhZ++EfoEJVOz7MYcmnWZ4syntqVOk2JrNVefUBG48ZxcinxF6RgaoYIMAlc1p3BcS1qKJSmFh9+BvoxVcnndbu81JrvB/berf9Joo+kE2EgldwTAhdyEEgRNvOruwg/OFzfY26PownJ2c83Q8TKdCcVLNhKgw3xElAvYyw99yRXYQEpGIxw61daGwKnLsyedX21ESAMxyN1A5mun9RMDk9edZvPpK22H87JrnTmhu6H3X1H3Rld/4CPIKemQKWnnvQ2MCzOwuviC7ZiZ5dnu57x7L5VfdA5oqtzPCAGOV+IJZyJn38//MFEUxRjMjkVWKGbpzAF7o9S2YPZ1F5bgNhP+j5L6llRDvRY72JxewtyFrnye4P66Sr/AIEpPRDVbSDELsNNmwvyiG0TXQnUsvJ92sfeytDM2N3C/fq6V77PjEXwVM+0gppJgLLhKC3nHy9mfueSO9zZrcGQ5rMF8HKwAzAOVRcfHQ2wWJ1hz4xuxv893JHgCSJaldIPUTCUy+JNwQIa4JAkiQI6y5gv8HmlsyeTeJngGzTLuhlve3oy+YyabjWYEUB+WrUvc1oFSkMs/fkitu1r3cjyMdd6QC3IohUl/hT9IcJu/oHwvtoOg/ml6KJzTDYpPpR7PErtoSjVFQ=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS4PR07MB8825.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(376014)(10067099003)(18002099003)(8096899003)(11063799006)(56012099006)(38070700021);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 917VJYhjE2U97xKOJ3CWjNvLM87Hyg9WbmacZXmuu6jyThpWAV9ZFP2UOMrDiwm6pfvdElnWCeVlH8mch8YhG/I0Mxu6P7Fqj7Ofs0fIY3zSSQQNhFc1PbRM0urI2VCW4dxolZnKfa8PC6hjO/AlVfHCKtuaFDzKj0KEWQSg9LP+9MtoDldJNx2DZ+RW5RrCvqRoT/yh0h5EF3uMMZvVprVcZGIDtd1MiM0EBxaNJMIeixnl7SXHGPvq/Q9oRaj38rKlA1odYcJcZSWwXvyXlA96KLTX+gO4CavDJfoHhAvhd/DwIlAli9yefw3bQjsmgN/WYDik8RUrBsyeqjqWmgno6x8xCznKdtjbNJlSpJ3JlStY7R5eNaARQkmS3DsKm5MWITwef5JKSR0Krq6dfabm9mEAYPnNCM4tzrbI0mDw+DykyhiVKWgaOXcGEa3KI8Zk/YP/ZCvtzjz0EDx94MstRQvx8c+FgKGHoFrwcbMojG9xddTItRS3IDNBJuu3WjYWZktWskxhX4ReBv0SK/rZZmlKFX019w8plbBSwcxUninSoiYpPZJdK4tEn7uOjkWWQWHt+bhWXab/v1lg7ZWU7GRkmEux4rcnm+MZG5gAml9TuXiJF3BF1fXFOXomXPh/+kDjJXO43x20qmu/QXkFn1bvBpaBM4Q702tYK/dRJ6ldSvNxe75GYPB/hMSaiccQYyJgTl1ER82ZkCv4GX1cGAEi2IT2PLMrXPsWeCHS9DIDAG5d1AIHkGGEEiBzGN4g/yWNJ0qTJLBZYajfVZvhBmsULi37W/OClUuVGe5+vFR+YikabcOl/+L1jd1RzDEPEzlDdeaP6ENrHIpMGvkQj8bo6TLFWkOhbfdI2cW/zVOWH6A/lNKACW5VC92k+O7w2quN/RU7BtEgZm3b7vWNozZCsJORmQw+yobyj6UWkhpEQwe7fKJN/ey3iLxXZXyUKKFsiR7J1s9axv87qIa+ynbegM4z/HoFTRrkME6QrYpB6+l4JIeY6EYiVCv86tqoFxkn9Dp82CsVUROylca8NMG//ItZS+4zNrmNaNTo9KUTpMj0i6xV3NX5tMnYe/koSBNRGCK1OkZhgrEQ3flZugdvOxC+JPxg7pAPIAro1KkNI2fLk3x6oNU5i7B0N4r9y4EZ0K7QymC+1dk5ZWkEvE+vuL5ae6BzaR7j74eDEjrI+AlP8Xr+wJHdhBNKvcqTwgkg5NtOPAi+0ykk3YcDZrs8rh/56P+AscW6pfGrVH3qcHVq6cZLNCnYchVMHEFzCcdW9PS/YDfutX0+Z/bwTo/dyuRbx68hfZiSdO1RTZ4zPZCh24WbKzG527ebkNLRjfOtNUgF7hzOrRVV9zMyc+u3e8OhQ6ejCFxtfZN2PTG7z7xK0tvqkC3oSZug5k19PLFAmJjgIUVu+qfwoiysVrK/+ozAgg58xAxWTi4CuEbhr8d/DJ8Uu5jO8ANuiNUVyps0zletHsudbDCix596I2NKchsv13fSfRgjbtIg8F4MigCGVSIph7J6OE1fiRiLyX7KUzFnX/Y420Dptmj/00NDwTRerwVzuRnAGMqQd1SbL87XWByFVbsLVCjjmCavZ/wQQw6fsCz3vNgPz+PAkgzdOrY2Q2QSEEbvVy/7m3kJWnvXlwKkfgAbOhAojQAK1GHaGhaOt1L0yz1Kri4Iw6Ui8ozanwieHoFs0Vi97EnMf0qxBTvnhBfA4cdFEDnvj/g4sT80h9uNBeoD6OOoBjjh2rZn06tNGobb2hs=
Content-Type: multipart/alternative; boundary="_000_AS4PR07MB882587C4F9F2AE3F9447B25189A92AS4PR07MB8825eurp_"
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: AS4PR07MB8825.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6fc6d848-66de-44db-eb73-08df074c0df4
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Aug 2026 10:38:54.2589 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: ih2fkJhzDegjsQqfQlF4j8kAG3ZUL4hDlSd6DChXPymoctHsR4Jc26Sq/ZliucB7iGce7sm9rEtY/sm0f+Nok6ODUhfuFCLQIa3lXag1N4w=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3PR07MB8289
Message-ID-Hash: BBXA6IJ4VWHKXAFQBQNYDT2QJAB66JHU
X-Message-ID-Hash: BBXA6IJ4VWHKXAFQBQNYDT2QJAB66JHU
X-MailFrom: john.mattsson@ericsson.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; header-match-tls.ietf.org-1; header-match-tls.ietf.org-2; header-match-tls.ietf.org-3; header-match-tls.ietf.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Deployability of DTLS 1.3, HRR, and MLKEM512X25519
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/6ca1XMbTsd1m1qJPPRhD0bhQujs>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hi,

We frequently conduct interoperability testing using our internal test suite, CipherSnake. We recently expanded the test suite to cover DTLS 1.3 and HelloRetryRequest (HRR).

* DTLS 1.3 appears essentially undeployable in its current state. As far as I know, BoringSSL and wolfSSL are currently the only libraries claiming support for RFC 9147, and in our tests they do not interoperate. I assume we will have to wait for RFC 9147bis and subsequent implementation work before DTLS 1.3 can realistically be deployed.

* Relying on HRR for middlebox traversal of large ClientHellos is questionable. When discussing the need for ML-KEM-512, several people argued that it was unnecessary because HRR could be used instead. However, after testing HRR interoperability across 11 TLS libraries, our conclusion is that several libraries do not interoperate, making reliance on HRR problematic. It is therefore good to see that MLKEM512X25519 has recently been registered, although future library support remains uncertain. In contrast, support for standalone ML-KEM-512 appears to be good.

Cheers,
John Preuß Mattsson

v2.46.0 | Report a Bug | By Email | System Status