[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Muhammad Usama Sardar <[e-mail]>]

Folks, sorry for the back and forth but I am seriously lost of what 
additional information we are providing in Sec. 3.3 given the consensus 
of RFC-to-be 9851, which is absolutely clear on this matter:

     > Put bluntly, PQC for TLS 1.2 will not be specified (seeSection 4
    <https://www.ietf.org/archive/id/draft-ietf-tls-tls12-frozen-08.html#iana>)
    at any time and anyone wishing to deploy PQC should expect to be
    using TLS 1.3.

I am listing my confusions below:

 1. Title of draft has TLS 1.3; suddenly there is a section on TLS 1.2
    which is quite weird to me given the title of draft.
 2. The section is titled "TLS 1.2" but it actually talks about "TLS 1.2
    or earlier versions" which is weird to me given the title of section.
 3. Section states an alert for TLS 1.2 but if we are "fulfilling the
    duty" (as Bas calls it), then we should fulfill the duty fully;
    namely, what are endpoints with TLS 1.1 and TLS 1.0 supposed to do?

I really feel something is missing here, which should be clarified to 
the readers. But if I am the only one being confused here, I can live 
with it.

On 10.04.26 16:36, Bas Westerbaan wrote:
> We have a duty to be clear and helpful to downstream users of our 
> standards.
Because of the above 3 points, I claim that in the draft, we are not 
fulfilling this "duty" and rather creating more confusion.
> Being explicit that ML-DSA is not supported in TLS 1.2 and before is 
> part of that.

That's already covered "bluntly" in RFC-to-be 9851. There is nothing new 
being brought on the table. If anything, the draft should cite RFC-to-be 
9851.

Best regards,

-Usama