[TLS] Re: Composite ML-DSA

[Nico Williams <[e-mail]>]

On Thu, Apr 16, 2026 at 03:52:08PM +1000, Viktor Dukhovni wrote:
> On Thu, Apr 16, 2026 at 12:41:49AM -0500, Nico Williams wrote:
> > The composite is atomic.
> 
> Yes, that's how it should be.  This does of course make it difficult to,
> say, have PKCS#11 wrap-up two smart-card readers, one for each key, as a
> single logical composite smart-card, but that's a rather exotic
> hypothetical use-case.  The requirement would now be a single smart-card
> (or more capable hardware device) with a composite key.

Would it be difficult?  Surelygiven two public keys you can construct
the composite public key, and given two signatures you can construct the
composite signature.

Nico
--