[TLS] Re: Composite ML-DSA

[Viktor Dukhovni <[e-mail]>]

On Wed, Apr 15, 2026 at 03:54:59PM +0200, Simon Josefsson wrote:

> If your protocol allows a man-in-the-middle attack, it is REALLY bad.

This assumes significant deployment of an already broken by adversaries
non-hybrid PQC TLS signature scheme.  But nothing of the sort is
happening.

Rather, essentially ever TLS deployment (a few bleeding-edge hobbyist
systems aside) is still using classical certificates, and no mainstream
CA issues PQC certificates for TLS, and until PLANTS is complete no
realistic scale deployment.  That gives us some years before we have to
worry about whether pure ML-DSA (or a competitive replacement) is good
enough, and perhaps by that time a more clear indication of whether the
classical component is likely to provide any value.

Catastrophic failure of today's RSA or ECDSA certificates is widely and
credibly assumed to not yet be an issue.  Nobody has yet cashed in
Satoshi's coins. :-)

My personal server sporing an ML-DSA certificate as a "dogfood" (or be
it "gunfoot") exercise is not a reason to jump from the frying pan into
the fire and deploy composite certificates in TLS now.  I remain
strongly inclined to NOT implement composite certificates in TLS.

-- 
    Viktor.  🇺🇦 Слава Україні!