Return-Path: X-Original-To: tls@mail2.ietf.org Delivered-To: tls@mail2.ietf.org Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id EC384BE4E88B for ; Wed, 25 Feb 2026 16:23:38 -0800 (PST) X-Virus-Scanned: amavisd-new at ietf.org X-Spam-Flag: NO X-Spam-Score: -1.848 X-Spam-Level: X-Spam-Status: No, score=-1.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0iLMcFfMns73 for ; Wed, 25 Feb 2026 16:23:38 -0800 (PST) Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 87EC4BE4E87A for ; Wed, 25 Feb 2026 16:23:38 -0800 (PST) Received: by mail-qk1-x733.google.com with SMTP id af79cd13be357-8c711959442so134674285a.0 for ; Wed, 25 Feb 2026 16:23:38 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1772065412; cv=none; d=google.com; s=arc-20240605; b=AG+r/HWjEkHUDAC62K7Km2qqGzg7LSkXj8EH6yDfrGIAIQZwLy9b4GcqMD7wemRpVj mpIO35DxtmRE70qF/0QHL07Cc5DtB7K6pORzN+EkVXUS0ivYkO9u+iRpuRVOwAnr7Czx dfKPXGLbsD3k7CGaCutNFxCR/ysdr1e8L6OyTQCOZSLPemAs4z+1+nUaXHkWZm4oOqhe 3RQ0J1fr1fyrYFTOtcyau2mpI7hTkrCg0lY2SxxzYMcCvrqcUwafA8EgpLzW10Jjd/FK 2LhA8HLQW849EngbAOpA4Z78njwRgW7zDItY9kMmJvLm6loKadoMyRtDe2fqGhG0jac8 dkGQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=waHU+InzhvFyGgm/HWkj/9E+QQ96uMTPeQCbt3r2pbQ=; fh=nYDJsvXfBwRbWLyD9mazeraSJDZPEY++NUtKpBUBi+k=; b=QWXMPco4StyDW0RTCaPvIMeULFRwk2vCCMVCSoaHJKbG+91qRguPvd203/ILYXh4IV kNGnUf7xY4M4GxF8x+tFagKJmb+bE6iRkZa2SqeWOvUoYiQgktLjYhW6aPysROztY72B N0vffKFkabwkUc2aIsz3hF7SOAJMPHrsCkSUAozx8IAkVMpWR+5osPuZlDMBTyi7nFhr C0Hxmm0CpeLD8QoCJqlKbJ8f+OIwXlLy6hSlaqsbldLzFfnokzAQUuRO6ouVnU4Fz09i 9vx8j3L7LMHfhrYRpPj/1LCZ0phSS8XREy5c1OR3GEiZBbvRTqTrpjD5LSaOFEnHs7R+ ND9Q==; darn=ietf.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772065412; x=1772670212; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=waHU+InzhvFyGgm/HWkj/9E+QQ96uMTPeQCbt3r2pbQ=; b=CrnBetKYqu/JPZLpjRyuGqFqqix2Mz/21cU0TWtpZFot9QSxQZTF6VEmWOxgvHN5OW 4/qYSSOdLPPtQfzIvt0hDp5oMIjkmfTCDn+xe9uz9krGplJy6KclQgR46dshhokP93+Z 8v/qHaQJsjd33DGWplnwhz5QGZ48ShGa/OBQzM0avgSI2Jkjx2Q/tuH01bQoXf7CbIRD T+Hyr1mp3snrcZJQ8bEar87F79Gygnui8ydioPM7siHdE8MxnZvo3mVdi2CikL8/svTy IGg1q3X8ad1ZPXIwoHtrIkEcF+701fDlV6YpqWbhrk0rhp6p7c9a2waIFAw4r8kkpQUd Pskg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772065412; x=1772670212; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=waHU+InzhvFyGgm/HWkj/9E+QQ96uMTPeQCbt3r2pbQ=; b=pIzkDjVKa5hTl5hYWLO/yIMbxyYaeqmIsVmSHWzsuYeLn2hQIFRVXmzb224/0jVJNO xhVasVf85ARYmEhWm1iAX3U/ukDv4iZenhRx8exP8X095XMvqqpdttHyIlI3bEFim6M2 dzAqXvZ9Jsnr5aqKvFeJu5rPTOtI6nEig9xQSdrQqGpJz3KjuF3s51XSp67G9E1CupVv kmMSikwmRYPgGXKEvUjux2FukAfrEMZGVO0HtjSywP/rdG/HYht3AajgHJoa2mKBGlwR 7ouNxpKYah8ZnZ5oNMHLfXrGKi9NzvfkVxIyAGemtn0Ekn1utAo91g+qeQ8Je8YeIdN+ gTFQ== X-Forwarded-Encrypted: i=1; AJvYcCVAhO5Y+LS1XOuslULM7/RtkdC838ySvVVHsd5JuY6xQ2P4D6kbyfHy2HunNYqoTBAzOF8=@ietf.org X-Gm-Message-State: AOJu0Yw4RsFdL0eIVuEI/6cLlp4ZLs09O2NJTCuRBqys6ZOw3M62bjYU hMXDq1/LAOApfyyn4JRivTDK+/zq+Tk+CmQr/ngmndnJQYcpYwywX3tHTbMTy090udZb+wsqhy9 B2uW+AFKROuYX0OSwMRnxtND9kfhEicU= X-Gm-Gg: ATEYQzwq2br0u6MNcjtQuDRbVH7Tls+WlD0CrYhPCmUW9xHOMs+FGgExlicgFpSvnJI erOyIFoHaJExi80p0mFnj1g9nDV4qFE/JDK+/KjlZ787if++G/DpqILLwV0gSS4OY+4ImIAjrWj feifg02IljT7IA3Q48tK3plAgy7R7p+epA7yxVEoOguZy85o78qhfhEwdSdThnK5ozSt89nSa9a wy573rG2dobH4Y69iP6Md2i+vpGjF9B26PuwTiASK9GUR4sbIg7QptWKl8r3cVZ1KaNbIkzTsfH ZCfnl/jB X-Received: by 2002:a05:620a:1a1b:b0:8cb:1e3c:96fa with SMTP id af79cd13be357-8cbbf366078mr130888985a.11.1772065411704; Wed, 25 Feb 2026 16:23:31 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Deirdre Connolly Date: Thu, 26 Feb 2026 00:23:19 +0000 X-Gm-Features: AaiRm53RLmbmoANSQYo2Ce0KkLipWaksP6WCKCi7uzFxEF7VUDpLhb8e_ftNzjg Message-ID: To: Rob Sayre Content-Type: multipart/alternative; boundary="000000000000622c8d064baf21fc" Message-ID-Hash: GICV5MWTYZRPAJL63CY3URQSGS2NVTR6 X-Message-ID-Hash: GICV5MWTYZRPAJL63CY3URQSGS2NVTR6 X-MailFrom: neried7@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: DA PIEVE Fabiana , "TLS@ietf.org" X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5BTLS=5D_Re=3A_=5BEXT=5D_Re=3A_WG_Last_Call=3A_draft-ietf-tls-mlk?= =?utf-8?q?em-05_=28Ends_2026-02-27=29?= List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --000000000000622c8d064baf21fc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Many cryptographic designs across all areas have been broken classically. There is a reason there was a ~ten year international competition that started with 88 ~new schemes that was whittled down to ~4 (the NIST PQC series). There was also a NIST competition to select a new block cipher, with 15 submissions, two of which were broken in the process. There is nothing special about the post-quantum-ness in this regard On Wed, Feb 25, 2026, 11:57=E2=80=AFPM Rob Sayre wrote: > Hi, > > I think the argument was that many of the PQ algorithms have been broken > by non-quantum computers, so the hybrid approach is better. > > It's named after a distant relative (we are all related), so I know it: > > https://en.wikipedia.org/wiki/Sayre%27s_law > > I don't see any reason for a non-hybrid approach. > > thanks, > Rob > > > On Wed, Feb 25, 2026 at 2:27=E2=80=AFPM Blumenthal, Uri - 0553 - MITLL < > uri@ll.mit.edu> wrote: > >> >> Admittedly your answer (reported here below) was not addressing my >> concerns. >> >> > . . . . . >> >> > A hybrid still has a chance of being secure if old good crypto would b= e >> successfully attacked, so your argument does not stand. >> >> >> Let me repeat myself. If the data must *remain secure for a long time*, >> then the Classic part does not help, and the security of that data lies >> solely within the PQ component. Which part of this =E2=80=9Cdoes not st= and=E2=80=9D? >> >> > >> > Isn't the point that the pure PQ ones might be broken by conventional >> computers >> > (and they have in the past)? That's my understanding of the argument. >> >> The point is that if the data requires protection against CRQC =E2=80=94= then if >> =E2=80=9Cpure=E2=80=9D PQ is broken, the data is compromised no matter w= hat. Because the >> Classic component will protect it *at best* until CRQC, at worst =E2=80= =94 even >> before that. >> >> Many algorithms, both Classic and PQ, have been broken in the past. The >> current standards (Classic and PQ) haven=E2=80=99t. >> Please take a look at the timeline table in the email you were respondin= g >> to. >> > _______________________________________________ > TLS mailing list -- tls@ietf.org > To unsubscribe send an email to tls-leave@ietf.org > --000000000000622c8d064baf21fc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Many cryptographic designs across all areas have bee= n broken classically. There is a reason there was a ~ten year international= competition that started with 88 ~new schemes that was whittled down to ~4= (the NIST PQC series). There was also a NIST competition to select a new b= lock cipher, with 15 submissions, two of which were broken in the process. = There is nothing special about the post-quantum-ness in this regard

=
On Wed, Fe= b 25, 2026, 11:57=E2=80=AFPM Rob Sayre <sayrer@gmail.com> wrote:
Hi,

I think the argument was that many of the PQ algorithms have been broken= by non-quantum computers, so the hybrid approach is better.

=
It's named after a distant relative (we are all related), so= I know it:


I don't= see any reason for a non-hybrid approach.

thanks,=
Rob


On Wed, Feb 25, 2026 at 2:27=E2=80=AFPM = Blumenthal, Uri - 0553 - MITLL <uri@ll.mit.edu> wrote:
=
>> Admittedly your answer (reported here below) was not addressin= g my concerns.

=C2=A0> . . . . .

> A hybrid still ha= s a chance of being secure if old good crypto would be successfully attacke= d, so your argument does not stand.=C2=A0


Let me rep= eat myself. If the data must remain secure for a long time, then the= Classic part does not help, and the security of that data lies solely with= in the PQ component.=C2=A0 Which part of this =E2=80=9Cdoes not stand=E2=80=9D?

<= /blockquote>
>
> Isn't the poi= nt that the pure PQ ones might be broken by conventional computers
> (and they have in the = past)? That's my understanding of the argument.

The point is that if the data requires protection agains= t CRQC =E2=80=94 then if =E2=80=9Cpure=E2=80=9D PQ is broken, the data is c= ompromised no matter what. Because the Classic component will protect it at best=C2=A0until CRQC, at worst =E2=80=94 even before that.

Many algorithms, both Classic and PQ,= have been broken in the past. The current standards (Classic and PQ) haven= =E2=80=99t.=C2=A0
Please take a look at the timeline table in the email you were respondin= g to.
_______________________________________________
TLS mailing list -- tls@ietf.org
To unsubscribe send an email to tls-leave@ietf.org
--000000000000622c8d064baf21fc--