IETF Logo Mail Archive

[TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3

Simon Josefsson <simon@josefsson.org> Mon, 13 October 2025 15:53 UTC

Return-Path: <simon@josefsson.org>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id DF59D7286D19; Mon, 13 Oct 2025 08:53:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.401
X-Spam-Level:
X-Spam-Status: No, score=-4.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=josefsson.org header.b="A3iZEAwW"; dkim=pass (2736-bit key) header.d=josefsson.org header.b="Y4Lhun2Z"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BGEGJRzdiPO6; Mon, 13 Oct 2025 08:53:56 -0700 (PDT)
Received: from uggla.sjd.se (uggla.sjd.se [IPv6:2001:9b1:8633::107]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id A99567286D0A; Mon, 13 Oct 2025 08:53:56 -0700 (PDT)
DKIM-Signature: v=1; a=ed25519-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=ed2303; h=Content-Type:MIME-Version:Message-ID:Date: References:In-Reply-To:Subject:Cc:To:From:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=g2YZrY3KT27GryNle3oX2LUSbxLxq6UHR+FzBzm4vKk=; t=1760370830; x=1761580430; b=A3iZEAwWJSYpTyr5wGU8CTCXTstDinW/ivWDjPU5iDH+WmJYVbYbBtHac2hWjPEVFNW7HmvpoPt GfRV+FMDyCw==;
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=rsa2303; h=Content-Type:MIME-Version:Message-ID:Date: References:In-Reply-To:Subject:Cc:To:From:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=g2YZrY3KT27GryNle3oX2LUSbxLxq6UHR+FzBzm4vKk=; t=1760370830; x=1761580430; b=Y4Lhun2ZgDzK8dFtb+NCgh8GtlCuIdVM0g3nlcHBogIVjb4GNzJcqtrz5mCU0pUA71CPfm+X50v ErfAL9+BZM/zUA5VQ6zEgucUpZW3R6NRLtJYN5RRKYA9ie9Ct+ooFuV+Aoi41DBJcPMcYyxg4TUSl nxRUIuaEnBLS4W3/Z+B+sWOZw3taeqZ7o8fr1hyE9SChiSRtP4V7LexNBwCAaSMf+MTt+v8oXf9pG AmoQ62E30MYPLPJSNjDseWo+M79Uh4rF8iMEJNJ6RmOW4XSud7+6Eq/NtMvPaFG/a+0g5Oqdgptaz urUkJN2YTfWvV/zV2zhUBvLubKuPEYZJBh2nfV9nWmhjYDnHugdF7bzO0IeEB3gutcsBrDnCtAuBl KtKayy1ul0L0yBI/YPVSajYbmgPsj22KL9eIovHbadHto7v9fh8Cv2Ub3l9uW6UdgZKtD+dfj;
Received: from [2001:9b1:41ac:ff00:6883:213e:a752:e61a] (port=38228 helo=kaka) by uggla.sjd.se with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from <simon@josefsson.org>) id 1v8Krk-008sje-Hr; Mon, 13 Oct 2025 15:53:40 +0000
From: Simon Josefsson <simon@josefsson.org>
To: Eric Rescorla <ekr@rtfm.com>
In-Reply-To: <CABcZeBNYd0XcdAXkjdUzWoX-cYAQPBi6Y=5JaMWdst3TS8TvRA@mail.gmail.com> (Eric Rescorla's message of "Mon, 13 Oct 2025 08:12:20 -0700")
References: <CAOgPGoA+c8kXDizwsvFG5tLz9+Kxk0HqiN1skKp5jMvvpxeu0Q@mail.gmail.com> <20251009160139.42473.qmail@cr.yp.to> <DM5PR18MB2326D93261B74BECF06061B4ABEFA@DM5PR18MB2326.namprd18.prod.outlook.com> <GVXPR07MB96787960DCEB12341CF0651789EFA@GVXPR07MB9678.eurprd07.prod.outlook.com> <CAMtubr1iJigyhRKaGdwoKsT_EuNy_aB795N2397aRdKCKabxdg@mail.gmail.com> <a3e63086fe2454597303c49eb05f3fc3f1de855b.camel@aisec.fraunhofer.de> <MN2PR17MB4031F0049A1FB8578E19EACDCDEAA@MN2PR17MB4031.namprd17.prod.outlook.com> <d7dd49bf7ce443d48ab4bf5e4388db7a0f9f2e16.camel@aisec.fraunhofer.de> <MN2PR17MB4031A84C3DCCD414B6B65DDBCDEAA@MN2PR17MB4031.namprd17.prod.outlook.com> <afeba42b74d3022a4d7ebb8bcb90357175132fe6.camel@aisec.fraunhofer.de> <CABcZeBNYd0XcdAXkjdUzWoX-cYAQPBi6Y=5JaMWdst3TS8TvRA@mail.gmail.com>
OpenPGP: id=B1D2BD1375BECB784CF4F8C4D73CF638C53C06BE; url=https://josefsson.org/key-20190320.txt
X-Hashcash: 1:23:251013:ekr@rtfm.com::/QYp9za6+v1uxKFu:25/8
X-Hashcash: 1:23:251013:rsalz=40akamai.com@dmarc.ietf.org::9yzqZ7ix0/RI40PY:7DdI
X-Hashcash: 1:23:251013:tls@ietf.org::zS+IJhdJmAPrF/6A:J5NV
X-Hashcash: 1:23:251013:thomas.bellebaum=40aisec.fraunhofer.de@dmarc.ietf.org::N+ju0j6CjvA94NZs:IeI5
Date: Mon, 13 Oct 2025 17:53:10 +0200
Message-ID: <875xcikdcp.fsf@josefsson.org>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Message-ID-Hash: UOMRW64ILIXOWAQON5L2XRFAVTWQWTX6
X-Message-ID-Hash: UOMRW64ILIXOWAQON5L2XRFAVTWQWTX6
X-MailFrom: simon@josefsson.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "Bellebaum, Thomas" <thomas.bellebaum=40aisec.fraunhofer.de@dmarc.ietf.org>, "rsalz=40akamai.com@dmarc.ietf.org" <rsalz=40akamai.com@dmarc.ietf.org>, "tls@ietf.org" <tls@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/GFWsOdE3_oRWAK7NbvOMqjTgf1g>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Eric Rescorla <ekr@rtfm.com> writes:

> The current document has Recommended=N for *all* the algorithms. Above, I
> proposed changing them to Y, which would also entail changing the document
> to be Proposed Standard. We've now heard a number of counterproposals,
> including (1) leave as-is (2) just mark X25519 Y (3) take out the NIST
> curves.
>
> At this point it's not clear to me that any of these has consensus, so that
> chairs need to work that out. However, given that there have been a number
> of objections to (3), I doubt very much that that would pass WGLC (and I,
> at least, would object to it.).

Do you have any technical argument against separating the widely
deployed X25519MLKEM768 (which I believe ought to be
StandardsTrack/Recommended=Y) from the more marginal NIST curves (which
I believe are more appropriate as Informational/Recommended=N)?

/Simon

v2.35.0 | Report a Bug | By Email | System Status