[TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3

[John Mattsson <[e-mail]>]

Hi,

- NIST has recently released SP 800-227 Recommendations for Key-Encapsulation Mechanisms, which "makes some requirements and recommendations for implementing and using KEMs in FIPS 140-validated cryptographic modules.". FIPS 203 already references SP 800-227 and states that: "For general definitions and properties of KEMs, including requirements for the secure use of KEMs in applications, see SP 800-227". TLS is one such application.
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-227.pdf

The draft should explicitly reference SP 800-227 and state that the requirements in SP 800-227 shall be followed. I don't think anyone wants standards or implementations violating NIST requirements. FIPS 203 and SP 800-227 should be viewed together.

- "This group supports use cases that require both shared secrets to be generated by FIPS-approved mechanisms."
"that require FIPS-approved mechanisms"

I think these sentences should be removed from the introduction. They give the reader the impression that X25519MLKEM768 is not FIPS-approved, which is incorrect.

- "while ML-KEM is considered next-generation"

[hybrid] defines next-generation as algorithms as "Algorithms that are not yet widely deployed". This clearly no longer describes ML-KEM in October 2025. Cloudflare Radar has periodically reported 50% ML-KEM adoption, dominated by X25519MLKEM768, with limited X25519Kyber768Draft00.
https://radar.cloudflare.com/adoption-and-usage#post-quantum-encryption

Cheers,
John Preuß Mattsson

From: Joseph Salowey <[e-mail]>
Date: Tuesday, 7 October 2025 at 15:46
To: <[e-mail]>
Subject: [TLS] Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3
This is the working group last call for Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLSv1.3. Please review draft-ietf-tls-ecdhe-mlkem [1] and reply to this thread indicating if you think it is ready for publication or not.  If you do not think it is ready please indicate why.  This call will end on October 22, 2025.

Please note that during the WG adoption call, Dan Bernstein pointed out some potential IPR (see [2]), but no IPR disclosure has been made in accordance with BCP 79.  Additional information is provided here; see [3].

BCP 79 makes this important point:

 (b) The IETF, following normal processes, can decide to use
   technology for which IPR disclosures have been made if it decides
   that such a use is warranted.

WG members can take this information into account during the working group last call.

Reminder:  This working group last call has nothing to do with picking the mandatory-to-implement cipher suites in TLS.

Cheers,
Joe & Sean

[1] https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
[2] https://mailarchive.ietf.org/arch/msg/tls/mt4_p95NZv8duZIJvJPdZV90-ZU/
[3] https://mailarchive.ietf.org/arch/msg/spasm/GKFhHfBeCgf8hQQvhUcyOJ6M-kI/