[TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3

[Eric Rescorla <[e-mail]>]

On Mon, Oct 13, 2025 at 10:13 AM Robert Relyea <rrelyea=
[e-mail]> wrote:

> On 10/13/25 6:10 AM, Dennis Jackson wrote:
> > I support publication.
> >
> > I don't have strong feelings on which recommended bits are set, but
> > either X25519MLKEM768 alone, or all three, would make the most sense
> > to me.
> >
> > I don't think any other changes are warranted. Any additional choices
> > should be handled by a different document.
>
> I also support publication. I'm fine with any setting in the recommended
> bits. I would prefer that the NIST curves not be removed.
>
> The fact is what every IETF decides, our products will almost certainly
> implement X25519MLKEM768 as preferred and default, and implement the
> other two groups as optional and our customers will chose based on their
> business and certification requirements.
>

Your regular reminder to all (I know Bob knows this!) that the code
points are already assigned, so even if IETF removed these groups
and never published a new document defining them, they would still
be implementable.

-Ekr


> bob
>
> >
> > On 07/10/2025 14:46, Joseph Salowey wrote:
> >> This is the working group last call for Post-quantum hybrid
> >> ECDHE-MLKEM Key Agreement for TLSv1.3. Please review
> >> draft-ietf-tls-ecdhe-mlkem [1] and reply to this thread indicating if
> >> you think it is ready for publication or not.  If you do not think it
> >> is ready please indicate why.  This call will end on October 22, 2025.
> >>
> >> Please note that during the WG adoption call, Dan Bernstein pointed
> >> out some potential IPR (see [2]), but no IPR disclosure has been made
> >> in accordance with BCP 79.  Additional information is provided here;
> >> see [3].
> >>
> >> BCP 79 makes this important point:
> >>
> >>  (b) The IETF, following normal processes, can decide to use
> >>    technology for which IPR disclosures have been made if it decides
> >>    that such a use is warranted.
> >>
> >> WG members can take this information into account during the working
> >> group last call.
> >>
> >> Reminder:  This working group last call has nothing to do with
> >> picking the mandatory-to-implement cipher suites in TLS.
> >>
> >> Cheers,
> >> Joe & Sean
> >>
> >> [1] https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
> >> [2]
> >> https://mailarchive.ietf.org/arch/msg/tls/mt4_p95NZv8duZIJvJPdZV90-ZU/
> >> [3]
> >>
> https://mailarchive.ietf.org/arch/msg/spasm/GKFhHfBeCgf8hQQvhUcyOJ6M-kI/
> >>
> >>
> >> _______________________________________________
> >> TLS mailing list -- [e-mail]
> >> To unsubscribe send an email to [e-mail]
> >
> > _______________________________________________
> > TLS mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
>
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>