[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Eric Rescorla <[e-mail]>]

+100 to this.

With any luck, we can take a pause on the discussion of this topic on-list.
I am aware that there may be pending appeals, but we have a process for
addressing those that does not require on-list debate.

-Ekr


On Wed, May 6, 2026 at 6:23 AM David Benjamin <[e-mail]> wrote:

> Thanks, Deirdre, Joe, and Sean, for all your hard work in navigating these
> WG discussions!
>
> On Wed, May 6, 2026 at 9:09 AM Sean Turner <[e-mail]> wrote:
>
>> Replying to the original consensus call message.
>>
>>
>> RFC 2418 Section 3.3 lays out the criteria for “rough consensus”:
>>
>>    Working groups make decisions through a "rough consensus" process.
>>
>>    IETF consensus does not require that all participants agree although
>>
>>    this is, of course, preferred.  In general, the dominant view of the
>>
>>    working group shall prevail.  (However, it must be noted that
>>
>>    "dominance" is not to be determined on the basis of volume or
>>
>>    persistence, but rather a more general sense of agreement.) Consensus
>>
>>    can be determined by a show of hands, humming, or any other means on
>>
>>    which the WG agrees (by rough consensus, of course).  Note that 51%
>>
>>    of the working group does not qualify as "rough consensus" and 99% is
>>
>>    better than rough.  It is up to the Chair to determine if rough
>>
>>    consensus has been reached.
>>
>> In this case, during WGLC there was an almost 4:1 ratio for progressing
>> this draft, which we judge fits within the numeric “more than 51% and less
>> than 99%” range suggested by this text for “rough consensus” and represents
>> the “dominant view of the working group”.
>>
>> In assessing rough consensus, we also considered the nature of the
>> objections. In reviewing the list traffic, the majority of objections
>> related to the status of pure MLDSA versus composite MLDSA-ECC, including
>> (1) we should not publish a pure MLDSA specification at all; (2) we should
>> recommend composites over pure MLDSA; (3) we should publish the composite
>> and pure MLDSA specifications concurrently. While there was substantial
>> disagreement on these points, we believe that the discussion on-list
>> sufficiently aired the respective points of view and that the right
>> approach is fundamentally a judgement call based on weighing various
>> technical factors, which each WG participant needs to make for themselves.
>> We see no reason to believe that participants were not able to make
>> informed judgements.
>>
>> Conclusion: The chairs believe there is consensus to proceed with
>> publication of this draft as an RFC with Recommended=N for those people
>> that want to use this algorithm, and a future Standards Action will be
>> needed to make a change to Recommended=Y, if anyone has the willingness to
>> undergo this heated discussion again.
>>
>> For transparency purposes, the chairs note that we received a
>> complaint/appeal about the consensus call. The message was moderated due to
>> a previous notice of moderation; see [1], and the complaint/appeal contains
>> a derivative work notice. As a result, the message was not sent to the mail
>> list and we will not process the complaint/appeal as-is. If the message is
>> resubmitted without the notice, the message can be posted to the mail list
>> and we will process the complaint/appeal.
>>
>> The Chairs,
>> Deirdre, Joe, and Sean
>>
>> [1]
>> https://mailarchive.ietf.org/arch/msg/tls/no0lW8r_wIPGF1ZXWB3EaGywh9Q/
>>
>> On Apr 28, 2026, at 16:24, Sean Turner <[e-mail]> wrote:
>>
>> Hi! The chairs have judged that there is consensus to progress this I-D.
>> We will work with the authors to get a new version submitted and we will
>> get to work on the Shepherd Write-Up.
>>
>> The Chairs,
>> Deirdre, Joe, and Sean
>>
>> On Apr 9, 2026, at 15:30, Sean Turner <[e-mail]> wrote:
>>
>> This is the working group last call for Use of ML-DSA in TLS 1.3. Please
>> review draft-ietf-tls-mldsa [1] and reply to this thread indicating if you
>> think it is ready for publication or not. If you do not think it is ready
>> please indicate why. This call will end on April 23, 2026.
>>
>> REMINDER: If you have not done so recently, review the TLS WG's Mail List
>> Procedures; see [2].
>>
>> The Chairs,
>> Deirdre, Joe, and Sean
>>
>> [1] https://datatracker.ietf.org/doc/draft-ietf-tls-mldsa/
>> [2]
>> https://mailarchive.ietf.org/arch/msg/tls/ucdImHExlbOf4Q3BCG81gjzi2xE/
>>
>>
>>
>> _______________________________________________
>> TLS mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>>
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>