[TLS] Re: RFCs on weakened crypto are not fixed by warnings

["D. J. Bernstein" <[e-mail]>]

Viktor Dukhovni writes:
> I don't agree that not publisheing is "safer" or accomplishes anything
> worthwhile.

I explained that every WG-issued RFC has a prominent claim of IETF
"consensus", and that people will interpret the RFC as IETF endorsement,
no matter how many warnings there are inside the RFC. Are you disputing
this?

Or are you saying that IETF endorsement wouldn't tend to increase usage
of non-hybrid PQ? Or are you disputing CECPQ2b as an example of ECC+PQ
providing more protection than non-hybrid PQ?

RFC 2418 says "conflicts must be resolved by a process of open review
and discussion". Blanket statements of disagreement aren't engaging in
discussion. We should be trying to understand and resolve the disputes.

> All that not publishing will do is to move the action elsewhere, where
> the caveats are more likely to be neglected.

My understanding of your argument here---please correct me if I've
misunderstood---is as follows: people saying (e.g.) "Don't use this"
shouldn't be opposing publication as an RFC, but instead should be
supporting publication as an RFC as an opportunity to include a "Don't
use this" warning inside that RFC.

But publishing a new problematic RFC along with a "Don't use this"
warning is strictly worse than rejecting the RFC and publishing a
separate "Don't use this" document, just like previous IETF documents
deprecating various other problematic cryptographic choices.

Of course, publishing the separate "Don't use this" document would
require WG consensus on "Don't use this". But including "Don't use this"
in the spec at issue would _also_ require WG consensus on "Don't use
this". If, hypothetically, there's WG consensus on "Don't use this",
then the WG can and should say so as a separate deprecation document.
Your argument doesn't claim any benefit compared to that.

If, on the other hand, the consensus doesn't exist, then the supposed
benefit that your argument is referring to, the benefit of the WG saying
"Don't use this", also doesn't exist. Non-consensual statements can't be
issued by the WG.

---D. J. Bernstein


===== NOTICES =====

This document may not be modified, and derivative works of it may not be
created, and it may not be published except as an Internet-Draft. (That
sentence is the official language from IETF's "Legend Instructions" for
the situation that "the Contributor does not wish to allow modifications
nor to allow publication as an RFC". I'm fine with redistribution of
copies of this document; the issue is with modification. Legend language
also appears in, e.g., RFC 5831. For further background on the relevant
IETF rules, see https://cr.yp.to/2025/20251024-rules.pdf.)