From: Simon Josefsson <simon@josefsson.org>
To: Nadim Kobeissi <nadim@symbolic.software>
In-Reply-To: <5DFBF81F-4A98-4C5E-A060-580DC6960021@symbolic.software> (Nadim
	Kobeissi's message of "Wed, 27 May 2026 22:13:32 +0200")
References: <20260519112813.1254795.qmail@cr.yp.to>
	<CAGgd1Ocy8f4HeQy-qWauAJAxizznXdXA53kWVp_FV1QUVGuxWw@mail.gmail.com>
	<5DFBF81F-4A98-4C5E-A060-580DC6960021@symbolic.software>
OpenPGP: id=B1D2BD1375BECB784CF4F8C4D73CF638C53C06BE;
 url=https://josefsson.org/key-20190320.txt
Date: Wed, 27 May 2026 22:48:35 +0200
Message-ID: <87v7c8lgt8.fsf@josefsson.org>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Message-ID-Hash: TQPJTLR6WHQACN5233KP4OQXM74RR373
CC: tls@ietf.org, "D. J. Bernstein" <djb@cr.yp.to>,
 stndrds-inacio@andrew.cmu.edu, iesg@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_Complaint_to_ADs_and_IESG_regarding_TLS_WG_chairs_?=
 =?utf-8?q?falsely_claiming_WG_consensus_to_issue_an_RFC_for_draft-ietf-tls-?=
 =?utf-8?q?mldsa?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/HCJDS-ihYQQF1aUKQohjhLZ1lHM>

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Nadim Kobeissi <nadim@symbolic.software> writes:

> Signature schemes do not have the same compromise profile as key
> agreement schemes (I wrote about this [1]).
...
> [1] https://symbolic.software/blog/2026-04-13-hybrid-constructions/

"Soatok=E2=80=99s central observation is one that deserves wider uptake: the
harvest-now-decrypt-later (HNDL) threat that motivates hybrid KEMs has
no analogue for signatures."

Repeating that statement doesn't make it true.  The analog motivation
for doing PQ hybrids is Man-In-The-Middle attacks.  If your non-hybrid
PQ signature has a weakness (e.g., implementation bug), it facilitate
man-in-the-middle's.

There were times when man-in-the-middle's were as common as
harvest-now-decrypt-later are today.  I believe that MITM's are
generally worse than HNDL attacks.  Adding a pre-PQ signature in hybrid
with new PQ systems is low cost compared to the risks.  We did that for
PQ key agreement based on the HNDL argument.  We should do the same for
PQ authentication with the MITM argument.

/Simon

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQNoBAEWCgMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmoXWKQUHHNpbW9uQGpv
c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f
V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z
ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh
BLHSvRN1vst4TPT4xNc89jjFPAa+BQJp4fWRBQkOa+rdAAoJENc89jjFPAa+hWIA
/1lQvrJeGlQq50lP6tm99D1zDy7J1tQ3ha4x0Jx7rkFTAP9hpUKuTvm6m1fXyiZV
YZlu2+Id/Dq3CIAZvNF+XEr2BLgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx
I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0
+MTXPPY4xTwGvgUCaeCW1wUJDmqLVgCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R
cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE
8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J
ENc89jjFPAa+s7AA+gIIHpBApDpcDj1sKhzDngmpvwQf0VkHme6s+EG7qSgpAQDe
/XMrU0c0Pa3ji85cMqZhvzJOFI/soe662lzL0QY3Bbg4BFySz2oSCisGAQQBl1UB
BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA
JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJp4JbXBQkOaottAAoJENc89jjF
PAa+RNUA/2faQO/nFT06E+MlhlQdo/0chlQXC5TZMPTVvVBFwoLOAP9xLJK0ow5E
jTzYJB4K810AL/Iv6PEOAEgA4cPTHVlbCQAKCRBRcisI/kdFomzaAQD2sfaA6ylq
Owd0tZPlv5MqLSFKfK+C6uy6YHuwOzykZwEA2F5gZNsk+uwRxX598mu82civcowx
PcwhpNY+/Pxrogo=
=sPyO
-----END PGP SIGNATURE-----
--=-=-=--