[TLS] Re: WG Adoption Call for Use of SLH-DSA in TLS 1.3

[tirumal reddy <[e-mail]>]

On Fri, 16 May 2025 at 21:17, Richard Barnes <[e-mail]> wrote:

> On Fri, May 16, 2025 at 11:25 AM Eric Rescorla <[e-mail]> wrote:
>
>> On Fri, May 16, 2025 at 8:19 AM Salz, Rich <[e-mail]> wrote:
>>
>>> I am not thrilled about adoption, for the reasons that EKR and Panos
>>> said. Further, I am concerned about us going back to the old days of
>>> “register every algorithm” which took years to evolve away from.
>>>
>>>
>>>
>>> We can assign code points based on drafts and let the world experiment.
>>>
>>>
>>>
>>> Can the authors -- or anyone actually -- provide a specific example of
>>> where they WANT to use SLH-DSA?  Not COULD as the draft currently says.
>>>
>>
>> This would be helpful to me as well.
>>
>
> It would also be useful to understand why an RFC adds value over just
> having an IANA code point.  Since the registry is Specification Required
> and FIPS 205 exists, someone could send email to IANA today and get code
> points as soon as Yoav/Rich/Nick response to email.
>

While SLH-DSA is defined in FIPS 205, its integration into TLS still
requires details that go beyond what FIPS specifies, including:

a) Providing guidance on deployment contexts where SLH-DSA is appropriate,
such as for long-lived TLS sessions or CA certificates, especially given
its large signature sizes but strong PQ security assurances.
b) Explaining why HashSLH-DSA is not included in this draft, since TLS
already hashes the handshake transcript.
c) Clarifying the use of deterministic versus hedged signing modes
d) Addressing the operational implications of the 2^64 signature limit.

We would like to see the draft adopted by the WG as lack of an RFC would
likely stall adoption in SDOs such as 3GPP, which prefer referencing RFCs
to advance their specifications.

Cheers,
-Tiru


>
> In general, the only value that algorithm registration RFCs add are (a)
> clarifying any technical points, and (b) setting the "Recommended" field to
> "Y".  It doesn't look to me like the draft makes any technical points (just
> says "do what FIPS 205 says").  Is "Recommended = Y" important enough to
> merit the work?  It seems like the algorithm proliferation points that
> others have mentioned militate against it.  Perhaps the best path is to
> register code points with "Recommended = N" (no RFC needed), see if anyone
> actually uses it, and then revisit the question of upgraded to "Y" after a
> while.
>
> --Richard
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>