[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Nicola Tuveri <[e-mail]>]

I have read the draft, but I do not support its publication at the moment.

I’d rather hold the evaluation of its publication until the composite-mldsa
TLS draft process is resumed.

My rationale is that this draft adds complexity by adding extra code points
for pure mldsa.
There are jurisdictions where the current recommendations mandate hybrid
deployments, and even in those where that is not a mandate, hybrids do
offer an extra layer of protection to the users in the current ecosystem of
PQC implementations that have not yet matured as much hardening as the
traditional implementations.

For this reason, given that this WG does put emphasis in keeping a limited
number of negotiable code points, I’d prefer the choice between this and
the composite draft to be taken on equal basis rather than just on which
group of supporters managed to put more pressure on the WG to win the race
to last call.

Many have reported on their experimental deployments of this draft: in
support of delaying the publication of this draft, I’d complement that in
the QUBIP project [0] we do have a successful deployment of TLS 1.3 using
both the composite-draft and the pure-draft.
I can report that the deployment of composite-mldsa did not exhibit any
higher complexity level than the pure-mldsa deployment.

Best regards,

Nicola Tuveri

[0]: https://www.qubip.eu