[TLS] Re: Codepoint registration for algorithms enough?

[Ilari Liusvaara <[e-mail]>]

On Wed, Sep 30, 2026 at 10:33:14AM -1000, Richard Barnes wrote:
> On Wed, Sep 30, 2026 at 1:04 PM Ilari Liusvaara <[e-mail]>
> wrote:
> 
> > On Wed, Sep 30, 2026 at 09:20:06AM -0700, Watson Ladd wrote:
> > > On Tue, Sep 29, 2026 at 11:24 PM Ilari Liusvaara
> > > <[e-mail]> wrote:
> > > >
> > > > On Tue, Sep 29, 2026 at 02:53:57PM -0700, Watson Ladd wrote:
> > > > > Dear TLS WG,
> > > > >
> > > > > Is a codepoint registration all that we need for composite certs to
> > > > > work in TLS pointing to the doc in LAMPS? I'm trying to understand
> > > > > what content we would need to have here and why.
> > > >
> > > > AFAICT, other than the registration stuff, mostly just interoperability
> > > > and security considerations. Prominent part of security considerations
> > > > is downgrade attacks (to both traditional and standalone).
> > >
> > > That doesn't seem specific to this draft but shared by any enablement
> > > of a new signature scheme.
> >
> > Composite signatures have special considerations with downgrade attacks
> > (this also interacts with PKI policy), and also considerations with
> > interoperability.
> >
> 
> Really?  How do these considerations differ for ECDSA+ML-DSA vs. say
> Ed25519?

Ed25519 did not have to consider subtle downgrade attacks or effects of
combinatorial explosion.

Is ECDSA+ML-DSA -> ML-DSA considered a downgrade attack? That is up to
the PKI policy. If no, it does not make sense to use ECDSA+ML-DSA
outside phaseout to transition to stand-alone ML-DSA.




-Ilari