[TLS] Re: Confirming PQ+T Signatures Consensus

[Ryan Appel <[e-mail]>]

1. Should the WG work on PQ + T Hybrid Signatures for TLS?

Yes

2. Should the WG only work on one: -pqt-dual-certs or -composite-ml-dsa?

Yes

3. Should the WG work on: -pqt-dual-certs?

No

4. Should the WG work on: -composite-ml-dsa?

Yes. And as a question, has anyone considered serializing the composite, rather than parallelizing it? 

IF ML-DSA gives SUF-CMA over anything that it signs, wouldn’t it be plausible to sign something with ECDSA:

Sig_E = ECDSA(key, message)

And then combine that with the message to produce the signature for ML_DSA?

Message_2 = message || Sig_E

Sig_M = ML-DSA(key, Message_2)

Then the output would be SIG = SIG_E || SIG_M

Verification can happen in parallel and we get the benefit of PQ/T hybrid, plus we get SUF-CMA. 

Thoughts?


Thank you,
    Ryan Appel

> On Sep 30, 2026, at 3:12 PM, Jan Klaußner <[e-mail]> wrote:
> 
> 1. Should the WG work on PQ + T Hybrid Signatures for TLS?
> 
> Yes
> 
> 2. Should the WG only work on one: -pqt-dual-certs or -composite-ml-dsa?
> 
> Yes
> 
> 3. Should the WG work on: -pqt-dual-certs?
> 
> No
> 
> 4. Should the WG work on: -composite-ml-dsa?
> 
> Yes