IETF Logo Mail Archive

[TLS] Re: Composite ML-DSA

Daniel Van Geest <daniel.vangeest@cryptonext-security.com> Wed, 15 April 2026 17:05 UTC

Return-Path: <daniel.vangeest@cryptonext-security.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 57F00DCFBE37 for <tls@mail2.ietf.org>; Wed, 15 Apr 2026 10:05:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1776272744; bh=Ncsd9SkVNxOgEALczolGhMFmNkaC4KLhABgKDIBJesw=; h=From:To:Subject:Date:References:In-Reply-To; b=IaAF6iFHtvq7JuLo37C/ntLViRqFfr3X05med8oL1XcHWZ0GR5fjsamhLEeR+i7Fr TODzJcfNqkwFV53NT2+HM4sTGpe41qk6IiaG4Lud/YATsfP+UfuzXU2HhO1FlKWJdS mMaO1rRT0qau9q0cPfI4hpWReG58d6PwpUnV4wKU=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cryptonext-security.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jZCOc2jo8GNS for <tls@mail2.ietf.org>; Wed, 15 Apr 2026 10:05:43 -0700 (PDT)
Received: from PAUP264CU001.outbound.protection.outlook.com (mail-francecentralazon11021089.outbound.protection.outlook.com [40.107.160.89]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 3DD14DCFAA37 for <tls@ietf.org>; Wed, 15 Apr 2026 09:59:58 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NnvZ9twozMUbMTJB1u+JjGk1oW1zM4rb8f2e97v/11fay/xL+g5EhxRLtuXrGYZ7abNkXRxG/fsP59heQw1l4XETAprgjgDzufOQIHE+CWSaWlqnbaXNkz7PCWY+bCm376lfoPDILy/Lc37B4ANFdo4NxS7PL0gyb8kAfv9n8SD8UE5/7vJsLd6m2pnF5d2hn3+Y3OgFbtYYbdHfotS07DTeH3Kj6hIfwBrINmad2eEl0vIFH7+Fm731vLL0P1Gm9+EPPmwqC5JWpnAaH9QaIigDQgl+XkKH2cMS7VwYyI40H17TXAvQho/PHMy3TCHjlpwugI/MyqwBKBmUNYYKzA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Ncsd9SkVNxOgEALczolGhMFmNkaC4KLhABgKDIBJesw=; b=R908Wi+NU4bQX0ykhOFMOCk9r73IL0XZewqf3qGzaZL+VKgfcqr3sPdMW8a8ftw8u7xYjuyttCDiM7/eORUendPay543t1LWdAEeeMMHy79eEuVG1+CLQVVqRztbwt7YlqQ2kTroMDSoGp34H2vceP3x5Tgyoav40K/MgIbTJb0KTPImziAQwEQrVi+VUHASWBQFp3aLdFKvHVisP2vm8HGHyD0+sivb+IJbTbzqK5B39UFTDhKDXYeuI6UpNN5gNVSIXSosj4bD1yRm/ZB1ozqjaZmQoDKt2JBPRbscCtmWEUYts0Sw6dfFIBX5E9VNsCa1+ICEdrgc2yHVHozBoA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cryptonext-security.com; dmarc=pass action=none header.from=cryptonext-security.com; dkim=pass header.d=cryptonext-security.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cryptonext-security.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ncsd9SkVNxOgEALczolGhMFmNkaC4KLhABgKDIBJesw=; b=SqnQ/gdniAtrxCjKeulCtL542MzrfISrn/CpycHfAorU08CcHYtWTQBpoW4NR68Akj+nwlMAtwyg7bUTJzbtM9WDqX3jxc3biVUJlk4/vK0U6NEhYJ1Hae8uxXoIz1LIFQni56PJA96Y1kfQtnp4FPTOW46eUIKY84FmFRydodiEOnnAUroTMA75WuhovUkgLBlEJyBTwJv9Oksfhky9pJ1Xu8AEV7dIkvlt7ziW4DGzFUpxqt21BZV+dlEw16UN80bc6JCEklwjhd/dQ3dmGdLd0HtqRPtwaWNcaZ4y1JY/aDHAU/Bkriw9JVGQd8E7SmLmnLtDweyYepGsJKmJLA==
Received: from PA0P264MB6925.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:55a::5) by PA3PPF2EE736344.FRAP264.PROD.OUTLOOK.COM (2603:10a6:108:1::62b) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9700.22; Wed, 15 Apr 2026 16:59:49 +0000
Received: from PA0P264MB6925.FRAP264.PROD.OUTLOOK.COM ([fe80::87e8:c70b:3b90:e83d]) by PA0P264MB6925.FRAP264.PROD.OUTLOOK.COM ([fe80::87e8:c70b:3b90:e83d%5]) with mapi id 15.20.9769.046; Wed, 15 Apr 2026 16:59:49 +0000
From: Daniel Van Geest <daniel.vangeest@cryptonext-security.com>
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] Re: Composite ML-DSA
Thread-Index: AQHczJtZg6Tgs606wkKBj0YG6pugRrXgEaiAgAASxfCAACO2AIAABVmAgAAFCICAAAVpMQ==
Date: Wed, 15 Apr 2026 16:59:49 +0000
Message-ID: <PA0P264MB692528BC9C79E9AF74968456B6222@PA0P264MB6925.FRAP264.PROD.OUTLOOK.COM>
References: <LV0PR21MB6623B48B1F3A05D745F5A79D8C242@LV0PR21MB6623.namprd21.prod.outlook.com> <ad0svakv_WUM3btz@chardros.imrryr.org> <CAF8qwaBU_YHWX2MsWeeaOJ8sutR1wMozvbiTJF5kyvTE8YjWWA@mail.gmail.com> <CACsn0c=GDta824UF7uJ3nw_4U_rT=XhYOGHRemMWa+2AdbsiAg@mail.gmail.com> <3a16c7c4-345e-48ce-af70-a3bf503c8caf@app.fastmail.com> <CACf5n7_0hdeHJXXucva9pb=+pjhcgveHRpjA8XAcXB3LsYUvaw@mail.gmail.com> <CAFpG3gcC+UfO7E=ADGhwr2En5PwipZiq_r6_RdqvmT-5nnh2jw@mail.gmail.com> <d69ba150-0257-4e64-9abb-9229d03a03a6@app.fastmail.com> <PA0P264MB69259DDB3DA252DC57E4B4EBB6222@PA0P264MB6925.FRAP264.PROD.OUTLOOK.COM> <MN2PR17MB40311654550B8396E7AC238BCD222@MN2PR17MB4031.namprd17.prod.outlook.com> <ad-6F830a4BQlu5R@chardros.imrryr.org> <MN2PR17MB403188430A245C75733C69B4CD222@MN2PR17MB4031.namprd17.prod.outlook.com>
In-Reply-To: <MN2PR17MB403188430A245C75733C69B4CD222@MN2PR17MB4031.namprd17.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-reactions: allow
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cryptonext-security.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: PA0P264MB6925:EE_|PA3PPF2EE736344:EE_
x-ms-office365-filtering-correlation-id: 809893ca-4998-474d-c6ec-08de9b1067a1
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|38070700021|18002099003|22082099003|56012099003|8096899003;
x-microsoft-antispam-message-info: qnEbhInOw5vPbcUHxLHTcilI/6CBUkjRrbBQFQH54ohQi+6VVfAdWroBruzCF1aCU9JuA62iaSsPQia+lEku95QiOC9s3dP0MUFX9HMFk/fcBxEwd6xA9WDztW6n4LNwGTVGzCg8kmEjOp1wIWL605sZEm+sK3/yRIw9hXFjITTaV6CAco7tWEIA+xR4EYqWy1Q+k9dm50XheTo1I371mKSKGsDDb0/Fi73HLTgJ+/cE+Hrl5XhQmRSRcwVxn+V2qDp3qnkXn3/7cHgja3d6XWr6M/d3VzqvufQxGF2MFT0UD1TsCcKhLJaOa4Aj/OY/NrgRNlWXJBvzWihzQbpMsP8OiEu/9dXlvoReP2mwwDpjsOLF4Rsic7ti4JFgqOx2XCzLzMrY/O0QPLkpumRA6/vm+uIvWi2ZP9T3rxh5/E3gI3qf36oBnfDgo6G/31QMu0BG3ajXHPnvm1ZCHnv0dTBm+Ilb6UYgXsw4gqPwYgNfTANO2oLMAxkMSvHGOr5P60tLfMrnVD6cq0iuFSb9M9qwJ4pwtbqxz+EjmrO7EgSPH9wBgDuYqRxg5JFlG2fPzmBUcXf47PVSJRt4zzEu0/Aj3HQ7jlOWrnb/Ld1q+FknHc++bBG1eqXCCLC6XM1PVapYTsLlhW8Rlu1DuawssivE41aR6YU67NTfq+7U6OxQzIAMjVCSfbgwiCWiK9W8xaFRAvctEr3k5DltdhceBnlC8/myHG/0yb2HZD2wURA=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PA0P264MB6925.FRAP264.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(38070700021)(18002099003)(22082099003)(56012099003)(8096899003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: szEMVJva9GM/qt0VaXbmGH0vAKnxd01QE0BNOFN3HmpwljXb5u13fHnh8fVRI/Q/Am0uZeDDztmqYd22sJ9UIO1Vq5+sVcQZyVp+lo13Sen1Fyg6IaNx8i4I6VWYS+Dc6oiVUmGHL9UA8Aco/lOvbO4nphh5w7KZ5aCW25AeEdOBLuKPlbzif4rctMoGLlssIuRLvVU6uEFLxNxjvOHeTSjJQbBXw5VrigJrjl1okODbVsHatavIDI46tg3aqiyfgj1fXVFlkHNDZuDK3N9rwa8UQrS3KmP7J5NQcSCNJ18P6KfpZET+5HDaHyBbWnXOqs8Gt1aCbmfy09aLnzyGofr1h3beHTHFObmQrP7RzpOwqD8imF6sGVp6pS0d+/wHQvfeXHtC8x2ssaIVK5KLFPrwfbr2rs/GJ3o8dsVv3DvtQymuUle/UOXZv24zF/ukUFv0x4ygkpFFK05WDkMRw6bNJNIMX4bgQegRhAtH1TjQA+kOPfvug5xBehHZP1d8TxcElVQUGsEB10Nxi8OoOJz9qk7Du2rP84cPO4Is3baF7WpwrvSyDjK/eZTPdboXwAKOID4R+HC6zKJcg1kK1sAZXPIi8tNKE1m/jlWEttFJCSFaPYJY6+0oDOqJEkfml6TIfpaCadV5KTVfWl+uIE3VF9Non58mhDM/SL9W3BCXL96O2sp0qmEzXQ5919n7m4kt2nq4K8YMQPgiELOJnqqNcw2aGzyeXrD+I6MdJk0Q6JTJH4z/OFvXlzlNtuQ6OkrMS7/xCt49w21X45q1fd/dAgHAHU7wv5AAbsqxypIWlqErxK6xY6qlqPyxEkOzfRvozW4QvU9iYB/rn3yPXsk0msXuVdwqTle1WRfQG1NoD2GYQJaenFLJ0bck/PQjO9n/MN/r6H/IQu/qIwq0WeQoFFQKxlF6TTGEltomWQJWphLq99Hv8fqOG5LyqWhe3eTnJWG8DhjNgySWsBZq84IPWf+5IgVILCD00XVGeW6mMqh4DC8abG36BC9L1L6R2/IyZ8pcxLkmI1oZVvBwu7l+PE2zP2l4DxckqUmxcwpRxFeqgo2S6oo0H2d8p06lUq0hxiHGhh8TGinYyt0YZHqvIPnB6Ezw7wqW6pmHEDNit1o/MsNxiNM/EEdHGMxykQEY0b6WHsgOiHNMiAArCW6ZJ1tvKzkIIvo7g+SF3GHxPeobRrwLKUuZtSDwCB35eZU20cIxmkRLvlWV/2KSPXwAPrVcaCqXPTgOhSjQ/2DDYwW+WSM8JtU41c9bQQDFG4pRgpR/Tm2wpRkFgurbtqIm2v4OmxlUHi1RER4Ufay4mDVoHP7SEAeYx4ePahoCrtv0OIAL2OcVJsY0T7/KmnZfXm0ymWA9b7hu6MJl/LVdVdx5k/8sD9rpjgCXfUMGfxeoJ/BVHtw5i+ouVUQn6N4zmInCnHZdwdRi31M4lE7OLp7e8NiwKQKmirOYYF/QZjtRjJ/8SXKE4p15zoFcgx7qbUzQkRW1EHNxhLix5S0aEejbqEYtZ0XE/2DGZ3rE3rTAzoqurYUsTBd9lDm0tDdzpX+9Lh7aNXCNq3VnD7W0HHPPeLJ8HLLQAPzH9LFm4MhwQUZ+SslSNWU23/aWnk85IceZcJBXQS3+kihGf/RlQKZ0WVsp7KD3NMvGPsH37YdnXm7fwQh+pFITTksgvJ33bMBE5QQBgXm7cIm/RHDUMiVCGrMgtEAQECaRfHI9oA9a8t6M/sdBBHQI+BRs8LxaioaEr5izOcVZbici8fQTlngRD10msfKjfGBH1DDBefZ6w3+L
x-ms-exchange-antispam-messagedata-1: M97H4ogzfb/B9A==
Content-Type: multipart/alternative; boundary="_000_PA0P264MB692528BC9C79E9AF74968456B6222PA0P264MB6925FRAP_"
MIME-Version: 1.0
X-OriginatorOrg: cryptonext-security.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PA0P264MB6925.FRAP264.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 809893ca-4998-474d-c6ec-08de9b1067a1
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Apr 2026 16:59:49.3616 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: da4a2df1-4b1b-489d-a7f4-224b58fd4200
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: HnTq3D2y5dnv4e3/12yso84Tt2kPMzsN3OWCtDObq7trCSmDQX8wAmWAmAFqFpGI80iJRx0nSYZROlnEbalLrk5sljnr0gRvCfYAGQyPPR1RrsMhX95vzA2HfYHmqTfu
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA3PPF2EE736344
Message-ID-Hash: J3PVXFCC5EZQN4FJJ6BZBQ6ORZUNOUOT
X-Message-ID-Hash: J3PVXFCC5EZQN4FJJ6BZBQ6ORZUNOUOT
X-MailFrom: daniel.vangeest@cryptonext-security.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: Composite ML-DSA
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/GOjzzznmCVqYrb15vYf22jQZzkM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Much of that paint has already dried in the pq-composite-sigs draft. That which is still m*ist seems to be a not-TLS problem. Hardware/software or hardware/different hardware is a concern worthy of some implementation abstraction.

Get Outlook for Android<https://aka.ms/AAb9ysg>
________________________________
From: Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org>
Sent: Wednesday, April 15, 2026 5:35:27 PM
To: tls@ietf.org <tls@ietf.org>
Subject: [TLS] Re: Composite ML-DSA

Thanks to EKR and Viktor, I’m now more sanguine about the complexity. This now “just” becomes a PEM-format issue (which will have its own shed-painting issues [seed, key, mu, etc]). But I wonder what happens if some keys are in software and some in hardware; I guess we’ll find out.

v2.46.0 | Report a Bug | By Email | System Status