IETF Logo Mail Archive

[TLS] Re: PQC Continuity draft

"Kampanakis, Panos" <kpanos@amazon.com> Mon, 02 February 2026 16:05 UTC

Return-Path: <prvs=4869b647e=kpanos@amazon.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 403BEB0ACECB for <tls@mail2.ietf.org>; Mon, 2 Feb 2026 08:05:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.095
X-Spam-Level:
X-Spam-Status: No, score=-2.095 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=amazon.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DCyfG6YDZr0Y for <tls@mail2.ietf.org>; Mon, 2 Feb 2026 08:05:49 -0800 (PST)
Received: from pdx-out-003.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-003.esa.us-west-2.outbound.mail-perimeter.amazon.com [44.246.68.102]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 9832CB0ACE5E for <tls@ietf.org>; Mon, 2 Feb 2026 08:05:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1770048326; x=1801584326; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=NvnkL4E/nWy4j9LjkImNsK1PMZMhMvipphfL4UQSP3A=; b=UFgzV3D4T32UuHbpao5NQMXeRzhNM7j6zolk8refvzHjawzREtkNadUk O3nXYzKpvAiLxywVSL2f99czyyWiwxguZd2e8a9NutJtOdYrTXalHxpYt QEIkFBbdDGtrBvyLRGCOu3mVXGmhZDaMu+egVn0uUGJAGfqtB8pZIZAcq twbOl/gE1It5p13lE9HQg+H5IKQi0f114zJCxTlKnf1SS4CS0bf8FwOta WMw+V2/StsmDxzbe8LqZpnke4Tn8yvON2qylWG9eqZOfsI9TiAwD8b2Nz CekRsIiinj1X+wMKHLo2Cx4KskY9w7ahzzukeN9g6zJJaba05zVtfbg25 g==;
X-CSE-ConnectionGUID: Jw5PUCUZQ9KXpbXgfuWJpA==
X-CSE-MsgGUID: MjWFx6poTl68iMYK3iQNug==
X-IronPort-AV: E=Sophos;i="6.21,269,1763424000"; d="scan'208,217";a="12108056"
Received: from ip-10-5-0-115.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.0.115]) by internal-pdx-out-003.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Feb 2026 16:05:23 +0000
Received: from EX19MTAUWC001.ant.amazon.com [205.251.233.105:23809] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.29.153:2525] with esmtp (Farcaster) id 376dc92b-04e8-472a-b2b0-f4ff8879161c; Mon, 2 Feb 2026 16:05:15 +0000 (UTC)
X-Farcaster-Flow-ID: 376dc92b-04e8-472a-b2b0-f4ff8879161c
Received: from EX19EXOUWC002.ant.amazon.com (10.250.64.172) by EX19MTAUWC001.ant.amazon.com (10.250.64.174) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.35; Mon, 2 Feb 2026 16:05:15 +0000
Received: from EX19EXOUWC001.ant.amazon.com (10.250.64.135) by EX19EXOUWC002.ant.amazon.com (10.250.64.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.35; Mon, 2 Feb 2026 16:05:15 +0000
Received: from CH4PR07CU001.outbound.protection.outlook.com (10.250.64.206) by EX19EXOUWC001.ant.amazon.com (10.250.64.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.35 via Frontend Transport; Mon, 2 Feb 2026 16:05:15 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=taSGJmzSQOUSdY8QH/e/FK4kbp8V/d/6uIPVkOko7r02cjYlM4Han+wnssmpeR2bNYTaQLLWkIHeGaGxR3BPyDJiG13MCMyY6zQ/mOEFOxpkywkyneSA0upxzMUqUim4g0ilJcG8lDtq/cfXftAvgUPMoDiUyTC3VDY9QWABHb0fs9nOpz2bEQ4rhhJt2GsP+xKr96LG7eSXuj3lRKa7SA6HaRehtiVUiW8dxdcRAOBSkf8OzZmlsMUbPAe0Nj2M1DJNZ1eTTNn/Rof9Wxx52jnLWEivj+vw2Pny/i5Hj73uGUILpIQdOsGfTKy7hTjvvqht5GC7OhSHM3EP0KGmFQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=NvnkL4E/nWy4j9LjkImNsK1PMZMhMvipphfL4UQSP3A=; b=P+mZ49nL3FL/iGJpqM7CwkzNmSvp3GMyBWRegfqT5XRwXnk1pnHkASx8/ehjc8iNKqwAzwQljgXnmHK48UIyQQHlH3qYpzMtbKYfSjLQ4Yuw0YH/8TlnQXROTugz/lFZzmaPzQjihS74p8a4QuIe5d7GuzNa+Qg6Z+5WNsmV9MptBTFscu9xwSo6C0K1AbkiWBQnPHnNwbIvD+Rm6XTG8JD8nbTKOKCgSVHsiZU9dOwj87OkahrMX4iArd6BWtLutByMODeMHqIvA7b1MnUL/KpzxV3TMGVuCOlJwuSeR/46gvA15jrZ4MHzFMyl1DTpxHevlYFGjQMD9dpX+ONFlA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amazon.com; dmarc=pass action=none header.from=amazon.com; dkim=pass header.d=amazon.com; arc=none
Received: from DM6PR18MB2859.namprd18.prod.outlook.com (2603:10b6:5:166::13) by BL1PR18MB4343.namprd18.prod.outlook.com (2603:10b6:208:315::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9587.12; Mon, 2 Feb 2026 16:05:11 +0000
Received: from DM6PR18MB2859.namprd18.prod.outlook.com ([fe80::c904:3601:a13c:510f]) by DM6PR18MB2859.namprd18.prod.outlook.com ([fe80::c904:3601:a13c:510f%7]) with mapi id 15.20.9587.010; Mon, 2 Feb 2026 16:05:11 +0000
From: "Kampanakis, Panos" <kpanos@amazon.com>
To: Yaron Sheffer <yaronf.ietf@gmail.com>, TLS WG <tls@ietf.org>
Thread-Topic: [TLS] PQC Continuity draft
Thread-Index: AQHclF212IuDktxaf0C2fzkqyWx2xg==
Date: Mon, 02 Feb 2026 16:05:11 +0000
Message-ID: <DM6PR18MB28597D58553B966E9418660FAB9AA@DM6PR18MB2859.namprd18.prod.outlook.com>
References: <FRWP195MB2764043A4C7B03B8145A455FA99DA@FRWP195MB2764.EURP195.PROD.OUTLOOK.COM>
In-Reply-To: <FRWP195MB2764043A4C7B03B8145A455FA99DA@FRWP195MB2764.EURP195.PROD.OUTLOOK.COM>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=amazon.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: DM6PR18MB2859:EE_|BL1PR18MB4343:EE_
x-ms-office365-filtering-correlation-id: e857d95a-c777-47a9-d679-08de6274d844
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|10070799003|366016|1800799024|13003099007|38070700021|8096899003|7053199007;
x-microsoft-antispam-message-info: gQYSS5GSrBi+wEzn03djM8oRIqhDpN5mJxiQR9c7/Bcubz0GDI5xj/MIHF9pxsX6MKq/pczehaJBZgA1q+Ehv3INhEcgtk6ALbXPe/uGVPKOHMne0Iy9b1+0qvVQTE2iTobySURy3nVI9Sz8+1qFCiXs7P8ybkDlcqWXJC9Pky6igCpS1SgBZObazqw75lCPm6QoFOeFXX+9kO8D6TFMYApfP9nyfIJAfApi3+h9Sa661eU20Y0349nph7b2i569L9Wd/7D35qw/0+sBUunCYNYtwZJ85Gublrp16/aQAdMjwu0Fybvgu8ahnon/ZXfOzfObly2lOi6etAA1sg+GlrxsghxmZ8LwCG6V1a9qwJ5GV35gNOkmQfqbqVrARfoekvVQV50AwjGnYBINbqa23/EzYS2au37WBRAksqqdSYFQ9dmBJ5aMTxvJNEKae0U8wwvPnqpyumuTP13CJJuIDfnx9iQrcNfu9w2o7Ld0BLnKpV0Pi4nWSiy+pDRw2ZJ4AJbuxq7ZOqOz943in1naWn+YAl0yhk4LDbJQLi0vY3vSe1GfchcRTmwyYKUVswpcfQD4wK97PQf/L26WTzgaiqPem70G4IFqEXX5/j+kfbpSGFQMKhD5KCh7t2ApuhOTbRxoov7lcchLK8d+v0wChD4k56ZPbczIUgupxH6I9XOnlyTjvkhZ9mocG/0HsuFMgw5ErD6sUOx1b1t3OgwyYJU9fg40mla0U+ZPgTduFO8VzOJnV4HQh7km9+gMrObDZQzVIkukalqsjo4KtZG65RM7uHwSmBMKYZtNJh5nQ47SRG6T409p9zJqLMRupqrkjMkf18Mh2i8yzQl2gvCgwaK8FfugnsgeETQWW7p+C6es5vjO8IXCZ+UnuRDCSCBwerPz+dZxyHjgc//bL0xZ5cJ87jCzFUdYRr5ianMdpZm+hWA8pLJ8/ai9PR2KUDdajQIGlNFYspBjcIm+5wSsE27r22sogF56md+SZhGCwROnxc4Zz91pkIdkSXkRb1IYjD2ZJ2vRujJcEeSSrlBkm896Wa4kStDhGDx2UQe54cOWP6BTSh3oHEoTYVJO4gYVc2z92XU9Q0FfBFcf6h5W6TnY56cmSm2DxENGyiFFrYWTUuyqncK6N8KggNFb1tbB27JrOOVxEYjslSbJIwUgidyC9ReAddxAHKYbkIeRleewT03pDE3DWZ4T6V/yOwQPGpXRrNVYEfI3YqcpPo6wIRVPlXHck9EMPQMSTESjNq5IbLqTu+g9uC7wDgmbzzbH+yoMKx1Duk0A2d+Bv4UvvtqqLR58jGCe4dS+NO5rPKf1yaHpVR07gtHIHyAitryE5BG/X6gTiUxPtU5+XzWic7Yb4DPYDy400z7zVKuWz3Hvfgn5dFjy7CsVDUhj7OTtP/WHjEY6yPuZkzKs1DiktmmX1nbFktKRCVWccY/ewktnAz+PllxeqUBoj1+leipGCnWWgbjS0idgB6XUd9SsmjtGpNXjcqw7uHiQ5cTO9KDQDVTCVoGz9y7z0tXivlbFmUkkqYs/UZAdn84Q8b9oOJC+vpFsFfvwKDdb4Twp3RQZ7KVIMTgsG3yqjEkWFktzU9DeT/sr7Bg5OCzSs2RNCrbSUblRrR+7l5OZIAN3rl8=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM6PR18MB2859.namprd18.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(10070799003)(366016)(1800799024)(13003099007)(38070700021)(8096899003)(7053199007);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: THuv/a41b1ezdJTL9PcjeyLzquOn8dD8CR2eT3DlnksQE5P8PKTs9oVOlk2+Maf9oJQTFzkdSvpdnq3fzXv+BHZRg3X47U4lxDwLwYjbeiVxSccIO9hg+1FGFPP8wJb0jEW3iwbwqquOF3l6XFYcm68XcOZnfSOwUsuG5bFxJpT/TNnW4PeEoTJKsMOd7w5fbjPVMAhKtAr/iLnIet6LRncci5CYsZb0mId0idfsa+wqKJvaMhoEo8ZaKHp3Qit349NbdqFKWgN/R9HVpXycU19q5rTMGAo/6k5jpe7FtdLMLwtJldIjlrTZJce4D9dh+lUO4gW/9V8YO/g3COvutUg4/8wJ8gxZomq3CB/zNK8hi+oB3CFvRkCJ9tGCMF7XsHA7IymhFGq8LFwSIt1UUM8OjIrJWFa27u0oUmADriivRPS4HZi6AtTL1PuVpr1EMLiLcDE7yi8piksqE66my7M6sHKsNbpNJ3PUv0Gk+pY5+XcRECWDoMIG8ZoUjGw4g6MccO2iRfJ1nkjwjrOayczqdPBEdNDEnxr7xo9hnTJyxngoPncbXL3M8D8EcTKG3/k9xYwDu8kq4b31OgkkDlt47Oj6Q+AYHlU4IBlhZV10QuvkylasTBtD4g9EhAQxy0vI1X29tllmhGG1Vo35yq7lQQ0bPhNLWU7cZ0ji6i4MLVCs+FBlKNr+iTh68R8qz483aHjnTjLp+v7ZFhqK6WshFm5mSJuQwlBDo3noLm94dbcYt/2nmMT6AgHYb+F/OA28PGlJjoZXi1BwbBsAK/5jp4ZJg3pOAZ33KN6MBHkteHzgJWl2iHsPkt5Xvovc4Sgm8DqYRwkSrOjUDR0ukZSVJUiiX2ythGhSJuUzH9GV0eLjB8jy4QqVAWCLFy8muxhyfngrc6x1lw76jAgiN7EVtLNEoHJQOISct7OIhxmlPIcXhWvZSb5z9yrQfLwL7eKZZmsDoSeZTa0Z2czoQjQlz7UzZYNyCRUhNs2sRgQxyJj1HOi/UOG8PduaQAash3R/i6IzxMbQVdINZVMhG7TDjZoUOXv7nuc6bh8TG715QRg0SdS0ttq0HkSjZ5RcCH5F5HMPEFQSo5N1rUTZIUhLYik7/UCyUBDvBvjzWAWP6m7lmh2CVFbRjJ/Po6R+QEXO1GUP3axTdmFcmgAA7vekaWkSHbORyVA52nRAiNBs0xUgJeh9nxZ23T1hKowwIoe8xP3ZmORRgDD8cfg3ARYmF2GEDL4BMB5jbtZOqvgZhAo/mnBpD+XQKXhMd5GjpRQ5F548lCsJF+MKT4AxkJqdQXOpbgOc1ezqKGPzzglY9jExzHUA7da+bc3wcVfnvaQzoQu1eef/RB5GaKUc8zCclTINiEmr7irmGpGcLxvlG+3JuJbS5RHqLsUGZsZevkVvnFeVjYsYGT51jfqvAR9pBY5ZtI/Css9MXIRywlw7SFt3t/yYnJUgtyCfAaIy31DWZAhJrdkQRLp19q0DapCQ6BMNNUkl0ENaOL8b6OphaGbfXSXPclH8EDMohgkg+KOl0DT6mQfpJTUnq9OwZ0DoZbHU2uxOPNK6pEDcI9AFeA0cttSV6qTYy2hfkZC73jkyBn08boOA6olMUKTd16LSsf466Yfe/LcJqtj1E1Epnz+KNaMhbBz0/Ux0pjx9gsCJuEKRpC41kS/lM0KNzE5RKLMWpVdTCmmSrA5mWNBnsdsrjZQc/JbdMbTdhK+8TqUaeinEA3tAuWdtYBS8E5Q24EZlBpkNAzLQangUiG8DcXIy3Kfg+g5YWrrSEVsQ
Content-Type: multipart/alternative; boundary="_000_DM6PR18MB28597D58553B966E9418660FAB9AADM6PR18MB2859namp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DM6PR18MB2859.namprd18.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e857d95a-c777-47a9-d679-08de6274d844
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Feb 2026 16:05:11.6707 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5280104a-472d-4538-9ccf-1e1d0efe8b1b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: tb2y/RzHy+1SHQXo5IjwEWJIpGnCIlld7/Ghd9mtrPss3msQbBnNleWxC1qjYrxUazERsT+uTOv8eg5I9eRtQg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR18MB4343
X-OriginatorOrg: amazon.com
Message-ID-Hash: KX6RBRTJUTJZTCCPYGADRPCHXLRZIWNE
X-Message-ID-Hash: KX6RBRTJUTJZTCCPYGADRPCHXLRZIWNE
X-MailFrom: prvs=4869b647e=kpanos@amazon.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: PQC Continuity draft
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/T-gmbO3XkrSy2QGEvgCg96Roqt8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hi Yaron,
Doesn’t draft-ietf-tls-trust-anchor-ids with certification paths already enable this? The client can find out if the server supports a quantum-resistant PKI and not accept a classical one.

From: Yaron Sheffer <yaronf.ietf@gmail.com>
Sent: Sunday, February 1, 2026 12:04 PM
To: TLS WG <tls@ietf.org>
Subject: [EXTERNAL] [TLS] PQC Continuity draft


CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

Hi,

A few months ago, Tiru and I published a draft [1] whose goal is to minimize rollback attacks while the Internet is slowly migrating from classic to PQC (or composite) certificates.

It seems that the TLS WG is now ready to turn its attention to PQ resistant signatures, and we would like to present the draft at the upcoming IETF-125. If anybody has had a chance to read the draft in the meantime, we would appreciate your feedback.

People might also want to refer to the earlier discussion on this list [2].

Thanks,
      Yaron

[1] https://datatracker.ietf.org/doc/draft-sheffer-tls-pqc-continuity/
[2] https://mailarchive.ietf.org/arch/msg/tls/qfmTs0dFq-79aJOkKysIP_3KhEI/

v2.46.0 | Report a Bug | By Email | System Status