IETF Logo Mail Archive

[TLS] Re: Confirming PQ+T Signatures Consensus

Yaroslav Rosomakho <yrosomakho@zscaler.com> Thu, 01 October 2026 01:11 UTC

Received: from mail-ot1-x32f.google.com (mail-ot1-x32f.google.com [IPv6:2607:f8b0:4864:20::32f]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mx.ietf.org (Postfix) with ESMTPS id 020754B for <tls@ietf.org>; Thu, 01 Oct 2026 01:11:38 +0000 (UTC)
Authentication-Results: mx.ietf.org; dkim=pass header.d=zscaler.com header.s=google header.b=O93Roe27; dmarc=pass (policy=reject) header.from=zscaler.com; arc=pass ("google.com:s=arc-20260327:i=1"); spf=pass (mx.ietf.org: domain of yrosomakho@zscaler.com designates 2607:f8b0:4864:20::32f as permitted sender) smtp.mailfrom=yrosomakho@zscaler.com
Received: by mail-ot1-x32f.google.com with SMTP id 46e09a7af769-8198a3a54d7so2202043a34.1 for <tls@ietf.org>; Wed, 30 Sep 2026 18:11:37 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1790817091; cv=none; d=google.com; s=arc-20260327; b=r4AgKOboVyELDK6eI0c21kzoeFVx/l71nNtQr5OP/66QIfAhyW7cI2k4Qygw3TGrA3 rBJay74PMACafAFFooxn+u5/s90mvepJtqPIZRGf7/QpyCA1WENrKeRJKi3o3+PPqcEQ UkUUFOR2TuZMRgMvYODfY1RenZLdUSmHuBy1682rcL66CABycuay6pLw6XwGkWVLImv9 fVLaMPpA1+kTUrP8Ncm2XN2mC9Vg79E+mKxfvvAVYWwZPcE2a4kDd3JTD/SZeT4Mlnlw 2nHSZv72VCC68lZxJSQtQdcrriBdqwGxFojTgbk388Fb0wrEQycrViuRglEMXdGguJF9 kmDA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=mQyQn0kMEq1QxybC4bvMtkhLMeJJXrfRKFoy1LQbdxM=; fh=aBFklM+lbEhsMqu3XqvyuE4JizogVOdYr3XggxEskYc=; b=WgFkBCFy4UNedcXH99XaCeW6bo7WUwyOwrXTfQibKvmx5xm7KddnHDgNxlK2Xawqsk s9kO8IfejmTvqS6Kf++S6pqIK550aOCqmfUPV9OXiRahhrrnHbn/SZgTwk9PD7biuQuE SLU5yVwXiGCPNo6ECHhEEmsxKLfoTHW01s5hoFNyabB+YMYoezlB0I6Bepc++xIgy3yC ZqBNHHMK8Kb1sJ2nxnEAbWDT2aboSxMkZBCRvTh7jYeF8qxvcXpI9s7Qy7fUITrh9hdP E8GAXvfg/5BPiq77RRG87SuesyAcrcxcF8nCsCrpycGqbrMmdqlXHJK6xtf7Z9QLH8D3 nFwQ==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zscaler.com; s=google; t=1790817091; x=1791421891; darn=ietf.org; h=content-type:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:from:to:cc:subject:date:message-id:reply-to :content-type; bh=mQyQn0kMEq1QxybC4bvMtkhLMeJJXrfRKFoy1LQbdxM=; b=O93Roe27VSAwYzM7RE2WEyP/wmJ6csWX/IJIaKBOKO4FCwhpzFS/jyxStbka/TzSZu bEaWSLdjABVXSkxsq0PRJVpfXQmEXPce+GzbcEGQrpJCNL4cE8DEkmTCE+ypVBZWrvy5 9Vs7J4NTmNNqllNx4u5nyUpObyFSnugnTJ5fE=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790817091; x=1791421891; h=content-type:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=mQyQn0kMEq1QxybC4bvMtkhLMeJJXrfRKFoy1LQbdxM=; b=EaHXbdnjAZhLLVsiJj5EcpMLui5K2FidjUQs88dPIU/y6uTZp3bUsaP8Q7AUVxgnXk X5duQzFEJANnnnDpIoHH3BBD6BGt1bLHAcf85CHW1UKj3SKKCMOKUnfVPC+STBCqIL7M MMkStLITwRyJLT/Xk60nsvoCpHuX1/pTR5sH4dilfUsYOsg+8F8fCzhvKJ26JHUVtFV3 wSweeVVsuveLVgRrI3xBVJGc1eZIoQn2P/oO2FIsVPdj2M7wIaT49zRzbNnEu9R1FWua v63a0pYxhoTbhnDv+uDQI47tzul5sZr+zWyBa7mj5zQ5NyU3qE37pp2jENRdaygeadz4 k8ow==
X-Gm-Message-State: AFuF++n5fXyryx2Hnjd1A0eMnML/+zM5mZna73AHDO35SdgIz60Ovvd5 uxcTnYeNIzI+yruIS5/DHUUOplE+z+/v45WScxAJSAvnL1ByRxKWNzqXV71l2EmDGTyKcturxcG 760lKG6d4vGNU1SkGZNdohbSExGt66ltEZiEW3f0zeqST7bG2jfGw5tK5gc32CLGEa/Y3HNOHsv DxWuA5XjK6pIWmx/GuAbF2qQ4JpHw=
X-Gm-Gg: AYBFou23K+WJ53WfXynhkV1KvDI+nSyzNlc4YDN4l62p7IuufAM4U6Ho+anQYi3dxcF qOXeCT2WeNiGFB28keqiFbekPFd1QibM8j86VD9CQtFy/S+oSFDzpNCnX7Hrsuevx0ut4Mh6Oy+ Pnz5PvKEKIu7rMfz89i0mYg9LCRsKaiPJjSAQUbyP10koOyACYen7l1zSX0EL4cuwz8Kd9jJ62T 94RcDZldfSllLcxWTM3h5wD18EnmrY1xkGr61nRD6+L0bq07Oahwg3Hs00Wl9c7kKqTgfjdwMrd VqNE0LZKVkJ5+JYAqUw7BUH83K28zvSFF8yze7wRjar21nzP5jDxBKSDhxZumkC1xd0DRii1W5U 7tAj24bilMApckDzH2Mf1RQwxvkWnqEzd812eXMRFcqLe0UZ7kWvdTP1hizWFwgHua5tTmQk=
X-Received: by 2002:a05:6820:1526:b0:6b6:f384:9c7f with SMTP id 006d021491bc7-6ddbb1b91a5mr1296168eaf.29.1790817091132; Wed, 30 Sep 2026 18:11:31 -0700 (PDT)
MIME-Version: 1.0
References: <A383CF85-CF66-4A3D-AFBC-3F2CCFEE265C@sn3rd.com>
In-Reply-To: <A383CF85-CF66-4A3D-AFBC-3F2CCFEE265C@sn3rd.com>
From: Yaroslav Rosomakho <yrosomakho@zscaler.com>
Date: Thu, 01 Oct 2026 10:11:20 +0900
X-Gm-Features: AclHuK94CUs-yN-DYdnbIFXzX7TLxjDPY-k-uPJWpAbmxzH9iWGscrAH30cJZcU
Message-ID: <CAMtubr2_5n=RTGUw2RQEOe7BRm3VSq23+ttxDcD16n+C8GtLog@mail.gmail.com>
To: Sean Turner <sean@sn3rd.com>
Content-Type: multipart/alternative; boundary="00000000000093516f065cbd1885"
X-Spamd-Bar: ---
Message-ID-Hash: 6FW3N4WGBWT5BG3B6XMTV6SYNZ65FVGL
X-Message-ID-Hash: 6FW3N4WGBWT5BG3B6XMTV6SYNZ65FVGL
X-MailFrom: yrosomakho@zscaler.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-tls.ietf.org-0; header-match-tls.ietf.org-1; header-match-tls.ietf.org-2; header-match-tls.ietf.org-3; header-match-tls.ietf.org-4; header-match-tls.ietf.org-5; header-match-tls.ietf.org-6; header-match-tls.ietf.org-7; header-match-tls.ietf.org-8; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: TLS List <tls@ietf.org>
X-Mailman-Version: 3.3.10
Precedence: list
Subject: [TLS] Re: Confirming PQ+T Signatures Consensus
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/NAnY30KLISyt4JtLT4erzCfRJeM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

On Tue, Sep 29, 2026 at 1:53 AM Sean Turner <sean@sn3rd.com> wrote:

> 1. Should the WG work on PQ + T Hybrid Signatures for TLS?
>

Yes, but only if the straightforward IANA codepoint assignment is
insufficient.


> 2. Should the WG only work on one: -pqt-dual-certs or -composite-ml-dsa?
>

Yes


> 3. Should the WG work on: -pqt-dual-certs?
>

Yes, since this approach avoids creating and maintaining extra composite
PKIs that would need to run alongside classical PKI (needed for the long
tail of the legacy clients) and pure PQ PKI (needed for modern clients
compatible with PQ only, such as Chromium 150+ and upcoming Firefox).


> 4. Should the WG work on: -composite-ml-dsa?
>

No. Register a codepoint and move on. If "RFC" is required, explore the ISE
route.



-yaroslav

-- 


This communication (including any attachments) is intended for the sole 
use of the intended recipient and may contain confidential, non-public, 
and/or privileged material. Use, distribution, or reproduction of this 
communication by unintended recipients is not authorized. If you received 
this communication in error, please immediately notify the sender and then 
delete all copies of this communication from your system.

v2.46.0 | Report a Bug | By Email | System Status