[TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3

[Eric Rescorla <[e-mail]>]

On Mon, Oct 13, 2025 at 12:23 PM Joseph Birr-Pixton <[e-mail]>
wrote:

> Hello,
>
> I think this is ready for publication and should not be further delayed.
>
> In my view the question of whether X25519MLKEM768 should be Recommended=Y
> is an inconsequential one. In my opinion, the TLS WG has a storied
> tradition of choosing atrocious MTI and recommended algorithms, and
> departing from that at this point is likely to cause confusion. I would
> prefer it if the WG stopped doing that altogether, but I doubt that is a
> view shared by others. However, I think having a Recommended=N algorithm
> nonetheless now used for a third of web traffic is saying
> something unflattering about the value added here.
>

Just so we're all clear, Recommended=N has nothing to do with MTI.
It's purely about whether we think it's reasonable to implement.

I don't necessarily disagree with you about some of the MTI decisions
but I actually think the Recommended column is pretty reasonable.

-Ekr


> Thanks,
> Joe
>
> On Tue, 7 Oct 2025 at 14:47, Joseph Salowey <[e-mail]> wrote:
>
>> This is the working group last call for Post-quantum hybrid ECDHE-MLKEM
>> Key Agreement for TLSv1.3. Please review draft-ietf-tls-ecdhe-mlkem [1] and
>> reply to this thread indicating if you think it is ready for publication or
>> not.  If you do not think it is ready please indicate why.  This call will
>> end on October 22, 2025.
>>
>> Please note that during the WG adoption call, Dan Bernstein pointed out
>> some potential IPR (see [2]), but no IPR disclosure has been made in
>> accordance with BCP 79.  Additional information is provided here; see [3].
>>
>> BCP 79 makes this important point:
>>
>>  (b) The IETF, following normal processes, can decide to use
>>    technology for which IPR disclosures have been made if it decides
>>    that such a use is warranted.
>>
>> WG members can take this information into account during the working
>> group last call.
>>
>> Reminder:  This working group last call has nothing to do with picking
>> the mandatory-to-implement cipher suites in TLS.
>>
>> Cheers,
>> Joe & Sean
>>
>> [1] https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
>> [2]
>> https://mailarchive.ietf.org/arch/msg/tls/mt4_p95NZv8duZIJvJPdZV90-ZU/
>> [3]
>> https://mailarchive.ietf.org/arch/msg/spasm/GKFhHfBeCgf8hQQvhUcyOJ6M-kI/
>>
>> _______________________________________________
>> TLS mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>>
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>