[TLS] Re: Confirming PQ+T Signatures Consensus

[Laura Bauman <[e-mail]>]

Hi Sean,

Outside of the Web PKI ecosystem, which is working on its own solutions, there are several TLS use cases that would benefit from the combined security of PQC and traditional ECC/RSA signatures. Apple supports proceeding with standardizing and allocating composite ML-DSA code points to unblock implementation and deployment in pursuit of these use cases.

Specifically, we would like to see the recommended subset of algorithmic combinations from draft-ietf-lamps-pq-composite-sigs [1], which balances the need to service different security levels against the combinatorial complexity of the broader set of options.

To address the specific questions on the suggested path forward:

> 1. Should the WG work on PQ + T Hybrid Signatures for TLS?
Yes

> 2. Should the WG only work on one: -pqt-dual-certs or -composite-ml-dsa?
Yes, just one

> 3. Should the WG work on: -pqt-dual-certs?
No

> 4. Should the WG work on: -composite-ml-dsa?
Yes

Best,
Laura Bauman


[1] https://www.ietf.org/archive/id/draft-ietf-lamps-pq-composite-sigs-19.html#name-profiling-down-the-number-o


> On Sep 28, 2026, at 9:52 AM, Sean Turner <[e-mail]> wrote:
> 
> At IETF 126, the chairs conducted a series of polls [1] to determine the way forward for PQ+T hybrid signatures after hearing from the -composite-mldsa [2] and -pqt-dual-certs [3] authors; you can watch the setup, authors presentations, and the polls at [4] from around 0:16:47 until 1:08:00. The polls' results showed in-room consensus to 1) work on PQ + T Signatures for TLS and 2) work only on -composite-mldsa. The chairs now need to confirm this consensus on list. We are going to do this by asking the four questions that follow. Please take note of the take note of the following:
> 
> 1. Framing of the questions is found in this deck [5]; in case it is/was not clear a "Yes" on Question 1 implies WG adoption of a draft.
> 2. Again, a "Yes" for 3 or 4 implies you are in favor of adopting the associated draft as a working group item.
> 3. Based on the responses we got during the session we only asked the 1st 4 questions in [5].
> 
> Please provide your answers to the following questions by 12 October 2026:
> 
> 1. Should the WG work on PQ + T Hybrid Signatures for TLS?
> 2. Should the WG only work on one: -pqt-dual-certs or -composite-ml-dsa?
> 3. Should the WG work on: -pqt-dual-certs?
> 4. Should the WG work on: -composite-ml-dsa?
> 
> Cheers,
> spt (for the chairs)
> 
> [1] https://datatracker.ietf.org/doc/polls-126-tls-202607241600/
> [2] https://datatracker.ietf.org/doc/draft-reddy-tls-composite-mldsa/
> [3] https://datatracker.ietf.org/doc/draft-yusef-tls-pqt-dual-certs/
> [4] https://www.youtube.com/watch?v=Qp1s1UMmhTI
> [5] https://datatracker.ietf.org/meeting/126/materials/slides-126-tls-framing-pq-t-signatures-for-tls-00
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]