[TLS] Re: Last Call: <draft-ietf-tls-mlkem-09.txt> (ML-KEM Post-Quantum Key Agreement for TLS 1.3) to Informational RFC

["Bellebaum, Thomas" <[e-mail]>]

Dear IESG members,

I have no doubt that the TLS chairs have been in a very difficult position, having to judge whether WG consensus for this document existed, and I am thankful for their service.
I believe the controversies surrounding this draft from adoption call up to now deserve to be mentioned, as a simple "WGLC successful" is insufficient to summarize the temperature on the mailing list.
So here is an attempt at a slightly richer picture, with emphasis on the main counterargument:

- Mailing list participation has seen many proponents as well as many opponents to this draft.
- The argument raised a lot of public interest, leading to many newcomers' voices being heard on list [0].
- Discussion of technical merits and concerns were insufficient to reach any wide-arching consensus, to the point where the people "in the rough" make up a sizable portion of people responding.
- The main philosophical concern unresolvable by technical arguments was whether this draft represents a security regression, coming from existing drafts specifying hybrid key exchanges.

Following the opponents (including, for transparency, me), it is known (and by now machine-verified at a symbolical level) that the widely deployed draft-ietf-tls-ecdhe-mlkem-05 provides some (limited[1]) security even if the ML-KEM implementation is not secure, due to either ongoing cryptanalysis or lack of implementation experience. In contrast, this draft does have no such benefits.
It is also known that both schemes are secure if ML-KEM is, and that standalone ML-KEM (this draft) has received substantial backing by people willing to implement it if (and sometimes only if) it becomes an RFC.
This direct chain between this draft becoming an RFC and the fear of a loss of the ECDHE-fallback has made any desirable form of consensus unlikely.

Given the heated debate, I kindly ask you to make your decision in light of this controversy.

-- TBB

[0] Some have phrased this as social media and/or three-letter-agency recruiting campaigns, which I believe can only represent the temperature of the argument. I have no reason to believe that someone who voiced their oppinion had no genuine interest in influencing the decision outcome, for either their own or their company's use of TLS.
[1] The scheme would fall back to the security of regular ECDHE based key exchanges. I.e. helpful for communication which is most vulnerable at present, yet vulnerable to store-now-decrypt-later once a quantum computer can break it.