[TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3

[Yaroslav Rosomakho <[e-mail]>]

On Fri, Oct 10, 2025 at 6:02 PM D. J. Bernstein <[e-mail]> wrote:

> Andrei Popov writes:
> > There are regulatory requirements that require NIST curves, whether
> > one likes them or not.
>
> Can you please point to the "regulatory requirements" you have in mind,
> and explain why you believe that the requirements prohibit X25519MLKEM*?
>

Sadly BSI TR-02102-2 does not list X25519 as a recommended elliptic curve
and current text of TR-02102-1 is vague when it comes to acceptable
classical components of hybrids. I can only hope that at some point they
will issue a new revision clearly adding X25519MLKEM768 to the recommended
groups list.

Also worth keeping in mind that for most organisations these are
recommendations rather than requirements. But unfortunately way too many
read them as "what is not listed as recommended must be prohibited".

-yaroslav

-- 


This communication (including any attachments) is intended for the sole 
use of the intended recipient and may contain confidential, non-public, 
and/or privileged material. Use, distribution, or reproduction of this 
communication by unintended recipients is not authorized. If you received 
this communication in error, please immediately notify the sender and then 
delete all copies of this communication from your system.