Date: Sat, 28 Feb 2026 12:37:07 +1100
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
To: tls@ietf.org
Message-ID: <aaJGw5tPigD_aaqp@chardros.imrryr.org>
References: 
 <CAOgPGoDLVqAVesWjrrD9ZR8HMkqQVLMp69vOkXPkk87MzcsOSw@mail.gmail.com>
 <aaISiXnAwn2gxNF8@akamai.com>
 <CAFR824wriXUfiboCvNDYH4SR=SKxSunHotz_QrkZn_dtbyjp1Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: 
 <CAFR824wriXUfiboCvNDYH4SR=SKxSunHotz_QrkZn_dtbyjp1Q@mail.gmail.com>
Mail-Followup-To: <tls@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-ID-Hash: SZX3FJNABRYCH47NTGHHVATCC4LP2UJH
Precedence: list
Reply-To: tls@ietf.org
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_WG_Last_Call=3A_draft-ietf-tls-mlkem-05_=28Ends_20?=
	=?utf-8?q?26-02-27=29?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/ERJz-R4sKhDATXvScgpBf1KqUFk>

On Fri, Feb 27, 2026 at 08:29:39PM -0500, Deirdre Connolly wrote:

> # Security Considerations {#security-considerations}
>=20
>  This document defines standalone ML-KEM key establishment for TLS 1.3.
>  Hybrid key establishment mechanisms, which support combining a post-qu=
antum
>  algorithm with a traditional algorithm such as ECDH, are supported
>  generically via {{HYBRID}} with some concrete definitions in
>  {{ECDHE-MLKEM}}. Hybrid mechanisms provide security as long as at leas=
t one
>  of the component algorithms remains unbroken, such as combining
>  quantum-resistant and traditional cryptographic assumptions. Standalon=
e
>  ML-KEM relies on lattice-based and hash function cryptographic assumpt=
ions
> -for its security.
> +for its security. Proponents of hybrid PQ/T key establishment generall=
y
> +consider it a conservative approach to deployment of newer post-quantu=
m
> +schemes alongside older traditional schemes, retaining at least the
> security
> +currently offered by traditional algorithms.

Some might recall that I suggested and support rewriting the security
considerations.

And yet, I see the above as damning use of hybrid PQ with faint praise.
If this is to attain some support from the sceptics, it must
unequivocally acknowledge that at present hybrid is the strongly
recommended more concervative choice, and that pure ML-KEM is a more
risky choice that should not be made lightly.

--=20
    Viktor.  =F0=9F=87=BA=F0=9F=87=A6 =D0=A1=D0=BB=D0=B0=D0=B2=D0=B0 =D0=A3=
=D0=BA=D1=80=D0=B0=D1=97=D0=BD=D1=96!