[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Robert Relyea <[e-mail]>]

On 4/15/26 10:11 AM, Bas Westerbaan wrote:
>
>     If amost all TLS cerificates live less than 2 or 3 years, or even
>     just months, it seems that the risk to use pure PQ certificates is
>     much less. This may be possible as ACME is getting popular now.
>
>
> In case you're worried about a weak algorithm, then it's not the 
> lifetime of the certificate that's important, but rather the lifetime 
> of the root certificate. Or rather: the ability to update the roots 
> that a client trusts. These considerations, of course, are not 
> specific to ML-DSA.

If you are worried about the 'lifetime' of the root, we are already in 
trouble because existing algorithms have root certs with very long 
lifetimes. The effective lifetimes of these roots are really tied to 
time it takes to effectively revoke them. In the use case of the web, 
the demonstrated revocation time is roughly multiple days to weeks. 
Other use cases may be able to revoke these certs as quickly (the root 
cert in your imbedded device with no firmware update, for instance - in 
that case it's effectively the lifetime of the device).

bob