[TLS] Re: [EXTERNAL] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2025-11-26)

Yaakov Stein <ystein@allot.com> Sun, 09 November 2025 07:59 UTC

Return-Path: <ystein@allot.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 69CF9866352C for <tls@mail2.ietf.org>; Sat, 8 Nov 2025 23:59:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=allot.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qC-3FucEZrmz for <tls@mail2.ietf.org>; Sat, 8 Nov 2025 23:59:05 -0800 (PST)
Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023124.outbound.protection.outlook.com [52.101.72.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 9440D8663525 for <tls@ietf.org>; Sat, 8 Nov 2025 23:59:05 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BLTzCudQTFcBPh1Tf74FV+o57TWwbnDDM5BFWUbQgni7Uyph40R6fgrjNmdJi2/E+ytwNRiwPFJDIIs+1lFx56+6KErU9TqYLi3qMt6TtWJc4bdW2GJX5mDir+2rJisG2sUZ41zkPEZoz58IAXhpCa9gFDxJiHwObjmgwfV7l8sojIzXxI+IY9V2HWnlUBu3mo8uBpml+xjyBhx8h7nV1+tRPSe/qJkJbThMSjUTZxFOGsIai9OKr00+O0fscEsoHR0VKqVxVwLhiSLGTQljX1DcGVmC6d7eQ7sCjeeiQ9RSiSASoAEPJKouappXpgSEUbY6PrC8nOizo3SofgjL+g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=A9voYDh0QmYGvugsA3NBtvdy/iSETQ76EdQyArDcF4c=; b=UkV/u08zF6xd666zInMXxKQUvh7r9ChBiOW73QgbUCV+Hrs9PVaeX4DpoOfabClmLPG/f1w0J41OfUF5CdTeRh75aaQseETq57dsYyet7R5wVYJbcjp5P5vshsfbhAbznwVoTJD+lc5dRVVmvfYvOEe6gVQz1tmIEekpqIInpIHflmBtmXcTy0ax/xDqKaMcGKoAaSJkjtKcESJPOUky39olAI9VnfNff9po5GKo66sGykE0xjqp5El9Oj2lTpuVEw5g/LQsdHnOZKHjLMbHCQMjVfryHjMZfkaXGZSHD4GnOdZ1rhq2UCgsUc0iLZCVYVsxEY6vlR7Q9N50LVaGeg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=allot.com; dmarc=pass action=none header.from=allot.com; dkim=pass header.d=allot.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=allot.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=A9voYDh0QmYGvugsA3NBtvdy/iSETQ76EdQyArDcF4c=; b=kqv+Txc1XYojABwVQUacgJ4hj6mKIeDZq0D+YjraWwNUcwItLe8byee6ShDUFZBBWlAptyqWlGwKQH+nApMPV9Thiaoy0kqWJW/xplFqrsRFEP+j6zdC+v4npVLLj1orn8ooLfbMUWxtagI0AJ1rTcvB52o4kQ3N7fY4OTTD1/Q=
Received: from PA6PR08MB10707.eurprd08.prod.outlook.com (2603:10a6:102:3cb::5) by PAVPR08MB9882.eurprd08.prod.outlook.com (2603:10a6:102:32a::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9298.15; Sun, 9 Nov 2025 07:58:56 +0000
Received: from PA6PR08MB10707.eurprd08.prod.outlook.com ([fe80::ff02:9799:b729:ae6a]) by PA6PR08MB10707.eurprd08.prod.outlook.com ([fe80::ff02:9799:b729:ae6a%4]) with mapi id 15.20.9298.015; Sun, 9 Nov 2025 07:58:55 +0000
From: Yaakov Stein <ystein@allot.com>
To: David Adrian <davadria@umich.edu>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [EXTERNAL] [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2025-11-26)
Thread-Index: AQHcTq6OAbdtztNlwEy2j6E5eZerDbTp/gYA
Date: Sun, 09 Nov 2025 07:58:55 +0000
Message-ID: <PA6PR08MB107078E4C11A260C4C549729FD3C1A@PA6PR08MB10707.eurprd08.prod.outlook.com>
References: <176236867319.904123.10146982018394612684@dt-datatracker-5df8666cb-7l4w5> <CACf5n79zVkqqRynLdP+6DcDzQBunV1wfQjfXvqH53yw5Oyfyig@mail.gmail.com>
In-Reply-To: <CACf5n79zVkqqRynLdP+6DcDzQBunV1wfQjfXvqH53yw5Oyfyig@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=allot.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: PA6PR08MB10707:EE_|PAVPR08MB9882:EE_
x-ms-office365-filtering-correlation-id: b953a36f-0b56-4c7d-6697-08de1f65d4f8
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|10070799003|4022899009|376014|366016|1800799024|38070700021|13003099007|8096899003|7053199007;
x-microsoft-antispam-message-info: Q1hHqe/QWp2kEKXuI3uo54Gc31+siQlJD8Ngm6VYPIY7zb9fTK8oWho/0SydPgc3ZHPBlas1YjyV+lnZgZrUjNQ6ddyTy3UwaLyKNURsd+lkFrU4m5BZ+UHgKpootkxlpK2RGd3p3j/gRV2dXqrBMKLCHqLfQdMD2C5GZvkSI5/fx82sNMCBdUnsNIDwK1ZKjS0jp8zcLfsWfmFDKkbza26qvuGioq9Z1IgGyiU98vorEmRWLAfTWmZkHC6jKcylugVdv62Nefuz8zJHX8Kw9SKSsZGttRY5Va7R8lft1U9yXrKy94moyJ0ztQRF/oHDOosVRkx1wP6XQEYYYNdR2cYGTHX+XM5RhZ6JUnsNSEtDQRRYFtiUne9hCOUnbmWFcU3Z4RaXUkjzcBGKoJ+AbqBIKyTV9SEQVuwtM8b2Yk3diDQgtngDEpmT/+MYBrGJA7M1LulXtqEbJLcCtH93Y3FXzmwatI7bTCUMZiHlqIhZ3MD0Ck94lMPoTU+MwyB57lCfTi/aWN817mMa16R2rw7z6DksH0hd61YcwA4x5EIpX6jFnvFUJS/jewaCLKebZuZ4DMDq7UivJqacVSSWh2wFPMiYDisp/TvXWZ10AoLKqsG2itLSXAmAx/kgkcCZeFa2d5yd2PIhfote3yRs7i7i0iweNH7yD3xJXIG34FZeJbfV0RgYXNIFkq4IJmgHuLkBnmLkeCbyHx8o1xRPJaZari3kYzGqQba7SG+s3UW4VVFTaRFDiFQ/jfN6IDUvTdZOumilmuATCoTaWVdGa0PuIFATbJeQjpFQkvddXJep6m+uJtHIZX80Ct1WCxwuq4bjjtbL67+v1GYstLCIo9NmShWUyD5LzhAIt6nqxPF9NibpxZ0RcP8EWSfHm1WrASfhW6rNuP36R03hbX2V/DeHIUJjfku6SmIDPTgMbYM8vw/wC2xLqTcn7bXaQBOM9lPHhgHWaQa0VFfeVyAQFC2peozANT+sZ9Ccdvr098XNfecQ8j5ZRIU2meF5htPItcZWgf7UZu4lOBT3PEcTeYUB2g0mATKWASvmllMlHEWAB+N/1mB4i3m/Zy2DNRoTS/3FU/mD49A0pHKLJDwW7zxN89rSbpkV60DVmKtkIrRjrSYcXZ76Ww+Vr+oBaLSbBiN7qdmceapg0rWiVRh5vzVEfH9xBdZkHpl4RloHw3uTH1irtOcIDyv02NMt5yBoJstjD+ho5QH/bL+wIL0AtCzeps9buV5JuUoGoOSTah0D/jtiL7gP+i9UDWC98HNrEy/mU7Y9f+Z3TfSDLEdxTtDpum5zHfrXw5UIZBqKXz3pdw+8KzqHW2lnl/kCbBU5ROkoVxNF7QAth1XqJtqGxbpbU1uk96v+Hryki6sjKeRlWCt5PbLiFFbLyc7Pzd6XccQFW+eLjKHsgplH3f6UFRN6EKNUyhbG22vNf+4UeKd2gvw3znmn4vaoeARiTfvtkVV1a3wCilNyZEPgBLZnpq7UtqqTR00q4rVo2UfvjwSd9fhyDsVfsmHayu2HMaGH
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PA6PR08MB10707.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(4022899009)(376014)(366016)(1800799024)(38070700021)(13003099007)(8096899003)(7053199007);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: kz0m/AwHdK+5F66vrumC4kHvBKBr63XA5XUZ71MSCoFfD6Ax2Er8kqtS186wBQiuh8osjBod2PuGUavzJioRnVSL/3EGGpc7DWeg5cy7Ur0i1aKA06XiAaUNPW1n8xO3eQ8NobMll2ZpBHmA/MUSTAp8hA7VerJ6ncdU4eGtYe2xCAdotWYgQcpCN/X4alPeC84zbUIXbIOU/sxRcLi/Qj+80fbj/FoRpPsWQ4bpSpZQIA7oXhBKE/t5FluwnQ3wVEjjyZftoK5c0U6EksEoAKYDJ2bVbpZd5fcW1tzBo+ayuSqN28U6OlgvgPgXSWGn4GHexpebLqs+3OOBNxILtsWx4VPMpHlqll9CXQU+1M5UkWa8mIcFOBM+OhUwe+de3GcWuiTf/+1iMlsPtUQYC2aV0nLmGwu+7OuULr8oDbGGUrtFL7bq1uc9oMvyINaoHogoHKtsGy2nvJs/Ky+WXCKDkNbwEjscmWUAaAawlfiVetHOx1wwHhMd/RzCfbGCUHnhjMlLGUFvIs4Fz7IEb5Orgzn+NoAt9u/RMkG7GTsIHx4Kb1AyCOc/zLsrXicybpq4yAc500acQ7uu45NPW07hFdGsz38Ozv27zG3/MLxbWYWDevqUeWe8agd+eYV3z1u7jKhSzw2Ym9luAQfFG5JR9dMROojkin8ZOG0wBfwdPkoypIbZppqdWFTn7eGd/nlKNW0DWzFN2maySxyLWlg8ODKA7RYmhw3ah3Qq/xT2c+uTQzt4nYiq0c0srdfBm0SH5C8jwz0tl11MRpV6chfAkMWYoHBtdDXKVxyFNNTJgCASA/kHNlyZ9pp2nds4vdl8J3d6hGGgmmdF0hljD/vZniZyFdRXi9DfihB4gUV0cRdqwBgyTXwEat5kD+P7E4wZ1LW8Vz1QlgerCtleIxA4jJT2FrNWlHSpTv/W3SkIF82q4wTfkXqPAdz4cONtYR4142j1YXa9gQMDm8q/PC63GgcIPTMlkRe8Pn3whbKTGhLiN5i7frxnbydMttWaJM5rr2YcLwPtQTrYQjx4VfyF2Nt/FBlcPbfK5R3qk+uaGhzCRJGQ8zCXG4fIiGh8kf5VQvWuQFhQZEmpuE1uncTkYYYXxm0RInZDwuK6wc/NflQj2lT1oGD+PNgfIRPor59Y7GnQ4AmFae2LM4Kq/vjUv1l3HA1VLkVFRXmos70rMI4eJvPtZKebol6sg6QwyxQvxl4rnkqM7DLSVME0dQ+SuWAg1o5JopOfmRrA5fwY1AkUigcQx2Gd8gwsunT0WH6xTTMVcoHsunZpMCZh4b6j/zpQSP4MqNzfbTICrLfhNUcabTUtSLfGwP2Y8vlS30AOwXHtbHRjisjDGGvkt2y4Mb/inklt19HtH3ky6fUxz9j2E2kcOO+ie0fp8nNLO/m8bHdGPAzrqNDj7fQg08EP0p6y90xemAdDvY9i9x5gkpZRDI4N8irxMjAzpPP+Oqdnogr4lC+ebSvqfHEQCeVfbUa2Nqt8+tgLHUjmWC/E2NhJZdek4APkSL692IOTU6Pu+UTzsFzOigAKDtUj7wbFn54PhqHbu9OcmaJ3ySalJfcXHIgqytJV4zxWT9tmoaP3ahbaz8ZgsnZUg4OmndVetRI/fGvKe/pOknEyD4c=
Content-Type: multipart/alternative; boundary="_000_PA6PR08MB107078E4C11A260C4C549729FD3C1APA6PR08MB10707eu_"
MIME-Version: 1.0
X-OriginatorOrg: allot.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PA6PR08MB10707.eurprd08.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b953a36f-0b56-4c7d-6697-08de1f65d4f8
X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Nov 2025 07:58:55.8361 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 789e5ff8-0396-414e-803b-13a424e9f5d2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: mcW+hDkNmu0Fkm2fyWjn5SeaaOmC9UTC8QK30sUU7K22xesee18vaL1tl77a6X7EJjnXmMpU2QUUsYph/O58Ew==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVPR08MB9882
Message-ID-Hash: ARPAPIJO5NF45IEPYYM3QNSJDKD6H2SH
X-Message-ID-Hash: ARPAPIJO5NF45IEPYYM3QNSJDKD6H2SH
X-MailFrom: ystein@allot.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: [EXTERNAL] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2025-11-26)
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/StZ-Cg4p1BMqJYdp7O3-nCVxpRU>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

So, Chrome supports only pure MLKEM1024, while it supports the hybrid version with MLKEM768?

Is that because you believe pure MLKEM768 to be too vulnerable and needs beefing up with X25519?
Or is it a computational load issue with the hybrid being about twice as expensive as MLKEM768 alone,
so with the pure mode you can afford the larger size which increases the load by about 50%?

Y(J)S

From: David Adrian <davadria@umich.edu>
Sent: Thursday, November 6, 2025 1:46 AM
To: tls@ietf.org
Subject: [EXTERNAL] [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2025-11-26)


External Email: Be cautious do not click links or open attachments unless you recognize the sender and know the content is safe
I support the publication of this document, and note that 0x0202 is implemented (behind a flag) in Chrome.


On Wed, Nov 5, 2025 at 1:52 PM Sean Turner via Datatracker <noreply@ietf.org<mailto:noreply@ietf.org>> wrote:

Subject: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2025-11-26)

This message starts a 3-week WG Last Call for this document.

Abstract:
   This memo defines ML-KEM-512, ML-KEM-768, and ML-KEM-1024 as
   NamedGroups and and registers IANA values in the TLS Supported Groups
   registry for use in TLS 1.3 to achieve post-quantum (PQ) key
   establishment.

File can be retrieved from:
https://datatracker.ietf.org/doc/draft-ietf-tls-mlkem/

Please review and indicate your support or objection to proceed with the
publication of this document by replying to this email keeping tls@ietf.org<mailto:tls@ietf.org>
in copy. Objections should be motivated and suggestions to resolve them are
highly appreciated.

Authors, and WG participants in general, are reminded again of the
Intellectual Property Rights (IPR) disclosure obligations described in BCP 79
[1]. Appropriate IPR disclosures required for full conformance with the
provisions of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of
any. Sanctions available for application to violators of IETF IPR Policy can
be found at [3].

Thank you.

[1] https://datatracker.ietf.org/doc/bcp78/
[2] https://datatracker.ietf.org/doc/bcp79/
[3] https://datatracker.ietf.org/doc/rfc6701/



_______________________________________________
TLS mailing list -- tls@ietf.org<mailto:tls@ietf.org>
To unsubscribe send an email to tls-leave@ietf.org<mailto:tls-leave@ietf.org>
This message is intended only for the designated recipient(s). It may contain confidential or proprietary information. If you are not the designated recipient, you may not review, copy or distribute this message. If you have mistakenly received this message, please notify the sender by a reply e-mail and delete this message. Thank you.