[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Nicola Tuveri <[e-mail]>]

Hi Rich,

thanks for your clarification, indeed my phrasing was not ideal. I’ll take
your comment as a chance to clarify my stance.


Code point assignment and deployment support are distinct considerations.
In practice, non-experimental production deployments generally rely on both
assigned code points and a published standard.


Concerns about the proliferation of standards introducing support for
additional code points are not uncommon on this list. I note a similar
concern here in support of delaying this draft.


At present, the process risks creating the impression of a
“first-to-standard” outcome, where publication effectively determines the
direction of deployment before the trade-offs have been fully examined,
possibly even stalling the progress of other drafts. In particular, the
argument that introducing additional options increases complexity has been
raised repeatedly on this list, but it does not seem sufficient on its own
to guide decisions in a security area WG. It would be preferable to more
explicitly evaluate the security properties of hybrid and non-hybrid
approaches and reach a position that can inform what should-and should
not-be advanced to standard.

Best regards,

Nicola Tuveri



On Wed, Apr 22, 2026 at 19.30 Salz, Rich <[e-mail]> wrote:

>
>    - I have read the draft, but I do not support its publication at the
>    moment.
>
>
>
>    - My rationale is that this draft adds complexity by adding extra code
>    points for pure mldsa.
>
>
> Code points are assigned when a stable reference is available, as you
> might recall from the long threads on the pure ML-KEM draft. So I don’t
> think your stated rationale makes sense.
>