[TLS] Re: WG Adoption Call for ML-KEM Post-Quantum Key Agreement for TLS 1.3

["Bellebaum, Thomas" <[e-mail]>]

I am sorry for interrupting your argument, but as you are discussing this on-list:

> My previous email explained the obvious way the consensus was validly called. This  
> can be independently verified by anyone reading the email thread. The  
> fact that you are the only one questioning the consensus should be an  
> indication that your reasoning to doubt the consensus call might in fact  
> be erroneous.

He is not the only one. Using the independently verifiable mail thread, I actually did count by a rough look over the messages (sorry if I missed/misinterpreted someone):

Pro Adoption:
- Alicja Kario
- Andrei Popov
- David Adrian
- Filippo Valsorda
- Flo D
- Jan Schaumann
- John Mattson
- Joseph Birr-Pixton
- Kris Kwiatkowski
- Loganaden Velvindron
- Martin Thomson
- Quynh Dang
- Rebecca Guthrie
- Russ Housley
- Scott Fluhrer
- Sophie Schmieg
- Thom Wiggers
- Tirumal Reddy
- Uri Blumenthal
- Viktor Dukhovni
- Yaakov Stein
- Yaroslav Rosomakho

Against Adoption:
- Andrey Jivsov
- Dan Bernstein
- Rich Salz
- Rob Sayre
- Stephen Farrell
- Sun Shuzhou
- Thomas Bellebaum

I am counting 22 expressions in favor of adoption and 7 opposing adoption.
This amounts to about every fourth person objecting the draft in its current state at this time, which seems more than can be explained by mere blocking of few individuals.

I am not questioning that this is a sound majority, but consensus is a harsh word.
Neither am I threatening to appeal, but I do share the view that merely declaring concerns such as "hybrids are way more conservative" as hypothetical/irrelevant to whether or not to publish this is not a reasonable way forward. The feeling (I am not saying "the fact") of this happening is valid.
However, openly accusing others of playing games or ignoring procedures does not result in good specifications.

Raised points should be discussed and adequately addressed to reach a consensus (i.e. significantly better than 3 out of 4). We are not making a black-or-white decision on publishing or not, we are influencing many aspects of the document.

Going forward with the new WG item, here is my current wishlist:

- Much discussion stems from an insufficient understanding of the considerations leading so many to believe that pure-PQ algorithms are the better choice compared to hybrids, be that harsh requirements ("users that need to be fully post-quantum" -> Why? Regulations?) or implementation considerations (e.g. "minimalist code base"). Please collect and document them (preferably inside the document) so that we can reason about concrete requirements and applications rather than hearsay and hypotheticals.
- Give some guidance to implementations as to whether or not this should be implemented and/or available at runtime. Is this just for those with special considerations mentioned above? If so, consider recommended=D or Experimental to convey this. Or is this for general purpose use by all sorts of applications? If so, document how the considerations above apply to them and discuss the relation to hybrid constructions.

-- TBB