[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2026-02-27)

[Viktor Dukhovni <[e-mail]>]

On Mon, Feb 23, 2026 at 04:27:11PM +0200, Marc Penninga wrote:
> Hi,
> 
> I support publication of this document. As has been remarked before, the code points have already been allocated so the question is really only whether we want to document them.
> 
> I think that OpenSSL's decision, as described by Viktor, to include
> pure ML-KEM but hide it behind a compiler flag, is the right choice:
> that way it's available for people who need it and won't bother anyone
> else. I guess that other TLS libraries and web browsers will take the
> same approach.

For the record, sorry if my earlier post was unclear, the ML-KEM-only
groups are not *by default* disabled at compile time, though a user
building OpenSSL from source can choose to do that.

Rather, the default *runtime configuration* does not include these among
either the server's or the client's supported groups.  To use these,
both the server and the client (if both are OpenSSL) have to choose
non-default supported group settings:

    $ openssl s_server -tls1_3 -enable_server_rpk -cert apps/server.pem -groups mlkem768 \
        -accept 12345  -naccept 1 -brief
    Protocol version: TLSv1.3
    Client cipher list: TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
    Ciphersuite: TLS_AES_256_GCM_SHA384
    Signature Algorithms: mldsa65:mldsa87:mldsa44:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ed25519:ed448:ecdsa_brainpoolP256r1tls13_sha256:ecdsa_brainpoolP384r1tls13_sha384:ecdsa_brainpoolP512r1tls13_sha512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:rsa_pkcs1_sha256:rsa_pkcs1_sha384:rsa_pkcs1_sha512:sm2sig_sm3
    Own signature type: rsa_pss_rsae_sha256
    No peer certificate or raw public key
    Supported groups: MLKEM768
    Peer Temp Key: ML-KEM-768

    $ openssl s_client -tls1_3 -expected-rpks apps/server.pem -groups mlkem768 \
        -connect 127.0.0.1:12345 -servername localhost -brief </dev/null
    Connecting to 127.0.0.1
    CONNECTION ESTABLISHED
    Protocol version: TLSv1.3
    Ciphersuite: TLS_AES_256_GCM_SHA384
    Peer used raw public key
    Signature type: rsa_pss_rsae_sha256
    Verification: OK
    DANE TLSA 3 1 0 ...a9f0a16595938d0203010001 matched the peer raw public key
    Negotiated TLS1.3 group: MLKEM768
    DONE

-- 
    Viktor.  🇺🇦 Слава Україні!