[TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3

[Paul Wouters <[e-mail]>]

On Tue, 7 Oct 2025, Eric Rescorla wrote:

> Date: Tue, 7 Oct 2025 10:51:50
> From: Eric Rescorla <[e-mail]>
> Cc: "<[e-mail]>" <[e-mail]>
> To: Joseph Salowey <[e-mail]>
> Subject: [TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM
>      Key Agreement for TLSv1.3
> 
> I have reviewed this document and I think it is ready to go with
> one exception, namely the Recommended column.
> 
> The RFC 8447 standard for "Recommended=Y" is:
> 
>    Per this document, a "Recommended" column has been added to many of
>    the TLS registries to indicate parameters that are generally
>    recommended for implementations to support.
> 
> I think there's a general expectation that we want people to
> implement and deploy these algorithms, and I would expect
> that the X25519 and P-256 versions to be widely deployed,
> at least on the Web. Therefore, I think we should mark all of
> these as Recommended=Y. I note that this would require
> advancing this document as Proposed Standard. We should do
> that as well.

Eric,

As has been previously found, the problem of discussing the RECOMMENDED
Y for each draft separately, instead of periodically as a group, leads to
relitigating these things over and over again. One new algorithm appears
and people want to rediscuss the other algorithms in the updated context
again. Would you really be opposed to letting the current drafts get
published with N while starting a dedicated document setup similarly to
how other WGs have do this, eg RFC 8247/8221/8624.

I also believe the documentation that such RFCs can describe by talking
about all other algoritms and comparisions and evaluations in one
document to provide a much better context with clearer direction and
advise to implementers.

It also makes the IETF process easier, as one only needs to update 1 RFC
to revise the guidlines in the future, instead of keep needing to Update:
a bunch of documents.

Work on such a draft could start right away.

Paul