[TLS] Re: Last Call: <draft-ietf-tls-mldsa-03.txt> (Use of ML-DSA in TLS 1.3) to Informational RFC

[Tanja Lange <[e-mail]>]

Dear chairs, dear all,
Already in the previour round I expressed a strong concern on the unprotected
use of ML-DSA. That concern has not change and is substantive. I also do not
see how it has been taken into account or has been addressed  as the same text
is now in last call.

Here is what I had written before:

"
I do not think that the TLS WG should publish a non-hybrid signature proposal
at this point. We should instead put support and effort behind hybrid drafts.
 
I agree that these systems should not be recommended at this point, which is in
line with the IANA considerations, however I'm concerned that the mere
existence of an RFC will be seen as an endorsement by the IETF and lead to
deployment of ML-DSA without extra ECC protection, which is a security issue.
 
I thus oppose publication of draft-ietf-tls-mldsa.
"

All the best
	Tanja


On Mon, May 18, 2026 at 08:40:16AM -0700, The IESG wrote:
> 
> The IESG has received a request from the Transport Layer Security WG (tls) to
> consider the following document: - 'Use of ML-DSA in TLS 1.3'
>   <draft-ietf-tls-mldsa-03.txt> as Informational RFC
> 
> The IESG plans to make a decision in the next few weeks, and solicits final
> comments on this action. Please send substantive comments to the
> [e-mail] mailing lists by 2026-06-01. Exceptionally, comments may
> be sent to [e-mail] instead. In either case, please retain the beginning
> of the Subject line to allow automated sorting.
> 
> Abstract
> 
> 
>    This memo specifies how the post-quantum signature scheme ML-DSA
>    (FIPS 204) is used for authentication in TLS 1.3.
> 
> 
> 
> 
> The file can be obtained via
> https://datatracker.ietf.org/doc/draft-ietf-tls-mldsa/
> 
> 
> 
> No IPR declarations have been submitted directly on this I-D.
> 
> 
> 
> 
> 
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]