[TLS] Re: Composite ML-DSA

[Nico Williams <[e-mail]>]

On Thu, Apr 16, 2026 at 02:20:44AM +1000, Viktor Dukhovni wrote:
> On Wed, Apr 15, 2026 at 04:06:27PM +0000, Andrei Popov wrote:
> 
> > The complexity argument is implementation-dependent. On Windows, the
> > PKI stack encapsulates the multiple keys involved, so the use of a
> > composite cert looks no different to the TLS stack (and other apps)
> > than the use of any other cert.
> 
> Likewise in OpenSSL, the real complexity is having to implement and
> support the algorithms, when it is not clear who's going to use them,

But you do support the underlying algorithms, and adding composites is
simple enough.  I suspect the real difficulty will lie on the
certification authority side of things:

> and whether supporting them is a disservice to the community because it
> breeds balkanisation through too many choices only some of which will be
> supported by some of the stacks.  I see it as a Pandora's box I don't
> want to open without good cause.