IETF Logo Mail Archive

[TLS] Re: New Liaison Statement, "Liaison communication to IETF regarding draft-ietf-tls-mlkem"

Stephen Farrell <stephen.farrell@cs.tcd.ie> Thu, 09 April 2026 12:56 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 62EF9D8B0102 for <tls@mail2.ietf.org>; Thu, 9 Apr 2026 05:56:34 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775739394; bh=sS3rKBXB7A9YAlqlxDGfsANj/vz3daSn2nDUK53WCD4=; h=Date:Subject:To:References:From:In-Reply-To; b=gPuO07Lr/9uVbOW45YJXhAt96gC88DjhxpEHwY/KNOpLbHBm0uTzDDnPeUUfmFM/l u7jCkAu2slVLGFoXTl1HR1et6nO07NzTDJm4wRLXK9yq5Lt1Mq3HHkF2d2Ox5C04Hq lsWUS+IL3Scarka6m8Sv05TdqW41UROHK0giH49Y=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cs.tcd.ie
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SUv2Qb3x9P9L for <tls@mail2.ietf.org>; Thu, 9 Apr 2026 05:56:32 -0700 (PDT)
Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazon11023121.outbound.protection.outlook.com [52.101.72.121]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 0BA84D8B0045 for <tls@ietf.org>; Thu, 9 Apr 2026 05:56:31 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=h7HqhFNauFX95I3WEMXCJJHOSqEDsEBD29bRcVljzOVeJ5yQP7TRTQwP8tPxj+zYOqnzSQAcd8MdX26EfIyx2DMWRpj2Cij7zM2Y3uO/MUXykrF4pjBQqGf22qZPACPuCZ4rFFGfBhHGcV4MF6hUlb5PFpEKsnESqz/SBhXMu/ud5GVK+CWFsD/S6yOVa25EGg5Ak4mRSpceYcmB/Koi5Lop80vzUMJ16V1xp31WkR3m7m57qwu0inZZpI6T74L2rrWOLOsDkPnhtPl+CXHiT2ep1Pj9yh221meRtEzxEazXvdpD9XslequqaT/KjcOpp1zYPhbQ6VFxGVTdbhJcPQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=sS3rKBXB7A9YAlqlxDGfsANj/vz3daSn2nDUK53WCD4=; b=buKq6w2Le9nKDSEOw5QKDzfF5STH7dF1pypn6ANphxMUGNqpwjqhYh8DcxsAuucRQ7PizOvldmjBq8Cr83GQtIL9EVtu+uqkUghpId84mbaQ2Cm3RZkYfdZIseRCPFqzqOkm0a2rMOgIUpIwCMdgDdlve0zPFuneR0TZqCnMw7Tg9VCA24U8ltjkG78+axNAEFAha/eNHuXunGf10EaBSBENUigTH4fQ8fYxP+1yOhU34cttORQYGtwTJmVpGa4Qcoqy8rub9ofYjw8kic8SG53dX9mkJ2h10P6Fc6d8aM3itamthp4C8zRNZC67oyh1T8F/I3vwKkMeHNwsJ+GPcQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.tcd.ie; dmarc=pass action=none header.from=cs.tcd.ie; dkim=pass header.d=cs.tcd.ie; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.tcd.ie; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sS3rKBXB7A9YAlqlxDGfsANj/vz3daSn2nDUK53WCD4=; b=litzH9SlJ0hnRtuqdw6ebaZoH/1bKTfhFbxLuyRJHLK38tlFqH0ZrLD+FhoCAL06bDfEtY7MSXwzIcVIxtZ9w0TIIc69TsW0c/JfwRTf1vyL4AD9EgqKNDxBzw8YuiOaQYuoFAuK9K/orusEG0IcinWIeR09HzWUIxfgBBUCm/4u3bgEKPQPDQy3mZ9dMR+Kw0P51qKIgRZUtcD27auiQxK6LEhc5Li5kSQPPjnIrQ9VKt4nlPlOo1zvMKKhUENPJ7a7EaGVzjA1xhtBchiSw3GAh2fVlZsirBrUhZV3Eh45QzKDZKBolTXCmqlx/gM16t3wvmCJI14Hmy6yjMRfhg==
Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.tcd.ie;
Received: from PA3PR02MB11163.eurprd02.prod.outlook.com (2603:10a6:102:4b4::19) by PR3PR02MB6187.eurprd02.prod.outlook.com (2603:10a6:102:65::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.20; Thu, 9 Apr 2026 12:56:21 +0000
Received: from PA3PR02MB11163.eurprd02.prod.outlook.com ([fe80::71cc:8d7f:5cb5:3772]) by PA3PR02MB11163.eurprd02.prod.outlook.com ([fe80::71cc:8d7f:5cb5:3772%5]) with mapi id 15.20.9769.018; Thu, 9 Apr 2026 12:56:21 +0000
Message-ID: <b1567dcb-781e-4c5d-b305-ab11a4b4b371@cs.tcd.ie>
Date: Thu, 09 Apr 2026 13:56:19 +0100
User-Agent: Mozilla Thunderbird
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, "tls@ietf.org" <tls@ietf.org>
References: <CEB84168-5998-432A-9D62-36E28B9CDFA5@vigilsec.com> <CABcZeBM-eoqh+kJ7H6SiwC9p4tKAt+YiQhzetJZJmPNpXc+5OA@mail.gmail.com> <CAF8qwaALDXR6d=jLD46wXmKHDjyj=OdJ1X3a1AgxF+ByQceeMg@mail.gmail.com> <CABcZeBO0ysBjtbiPuSboP4fAATuVHQxq1TA5TbQ+_Oy-NrET0g@mail.gmail.com> <7A4F9775-8929-469D-B454-B027A0BAFA69@vigilsec.com> <CABcZeBPk3fdfPw=S_f5v2E9Y1LUfQL8f6sKvTYG0R6qRHm6rgg@mail.gmail.com> <b1527204-149e-6979-a344-8d530613e979@nohats.ca> <24a09e13-ad76-4af2-9e2c-27f1c2282b02@cs.tcd.ie> <adXVIdmIOG8SonlM@chardros.imrryr.org> <CH2PR17MB4022FAA970DA4E497AA75AC6CD5BA@CH2PR17MB4022.namprd17.prod.outlook.com> <adcutmQqdmhtJvaH@chardros.imrryr.org> <MN2PR17MB4031A6F9A5EBDE0CE50EF609CD582@MN2PR17MB4031.namprd17.prod.outlook.com>
Content-Language: en-US
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Autocrypt: addr=stephen.farrell@cs.tcd.ie; keydata= xjMEY9GzphYJKwYBBAHaRw8BAQdAo6JvjmSbxHdQWPZdvciQYsHhM1NxQBU398Mmimoy4p7N M1N0ZXBoZW4gRmFycmVsbCAoMjU1MTkpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsKQ BBMWCAA4FiEEMG54R8tZDyZFrDOn5Njp+ZeoM90FAmPRs6YCGwMFCwkIBwIGFQoJCAsCBBYC AwECHgECF4AACgkQ5Njp+ZeoM93bogEA25ElRyX0wwg+kGEN1AoL60MoZfvQZ/VtmXY6IC5j +csBAIBpkL5ySuzJK2zLNZn9qQGht8IaUcA7cvDcLvS2uHUEzjgEY9GzphIKKwYBBAGXVQEF AQEHQILCPWOwW36e8D3pY8GmvvtItIT+A5uV80ist+WokVsQAwEIB8J4BBgWCAAgFiEEMG54 R8tZDyZFrDOn5Njp+ZeoM90FAmPRs6YCGwwACgkQ5Njp+ZeoM92bcAEA8R+8cpqRUIS+SoAN iO05xE6O/wEx8/e88BqzAYki3SoBAOQdwiPX+MQrAxkWD8xxOsdMOAtxYKpkD1n8aPJUw6QJ
In-Reply-To: <MN2PR17MB4031A6F9A5EBDE0CE50EF609CD582@MN2PR17MB4031.namprd17.prod.outlook.com>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="------------vxbX0hagX0IHK0geqZhEmVcU"
X-ClientProxiedBy: DU2P250CA0010.EURP250.PROD.OUTLOOK.COM (2603:10a6:10:231::15) To PA3PR02MB11163.eurprd02.prod.outlook.com (2603:10a6:102:4b4::19)
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: PA3PR02MB11163:EE_|PR3PR02MB6187:EE_
X-MS-Office365-Filtering-Correlation-Id: dc67e539-5306-47d9-66bf-08de963765d3
X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True
X-TCD-Routed-via-EOP: Routed via EOP
X-TCD-ROUTED: Passed-Transport-Routing-Rules
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|19092799006|366016|10070799003|376014|4022899009|786006|22082099003|56012099003|18002099003;
X-Microsoft-Antispam-Message-Info: JXmxstnewK9dl86FkhPL8+3oMCjYH04vc1dza82UmwYzhkBZUIsujc2/TE/fWN6TpJTd5YWoaoWlUmpxTPFyxxXEF36jR4iscORvFErs64cO4Xt/RMayein9gcw4QIioXTZJb0NM7gapwgVBETdPJPAHjlDY0tLeiGnWNI7nqYD8Or2ibqErqfa88B6XxI5Ay34ucUftwcYsdlSuX6s9hyVSg5nPVOBxDDjDsbNQdx0UsfjhsunEvEmVkoVli5uTLt7N23MM4I4xGLEluTzqraR45XdZFgMLohM2kE4ontYzjlgCgFRSGhBD2tcPtLHJ0Fsk3WMKdFg4akjSFsWPYLqmCA0dSSQ5ssTtThITRD3M0fOR1T25jrYFPmmVrfEGKZUimxFp7fNO+xiryjJvpk+Z/F2AQhqE+7LgYQE5YUZ2IuLHCCynNnvyYpumRK1dmiuA7/aLo72C4gbc7UVzHfART2wVR3bNwWJyW/wR9wyxWpxiWLM58uX9zYaqDZVgQR5HnI1rC5EZddfkXW/DcLaxioxD0IBI9uOEyHgo+AYPo3KlofBk+emLSaVxUvS7VuNbJLgp/NxvnSz9SIymvwG+azrnlYsJOVuhVdvIj0S9rm7rP9T2YeU4XnnzoG2xk+DwYj9i5rkbxRU0GZMkWHsVuEdnGc5YzfCShu2a87x4rPIaCXsWaojpIqzrJ8TC0S0fNhnSem35Ls8CX1YFJDxueZhRXUC+xF2q6UXYyHk=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PA3PR02MB11163.eurprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(19092799006)(366016)(10070799003)(376014)(4022899009)(786006)(22082099003)(56012099003)(18002099003);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2
X-MS-Exchange-AntiSpam-MessageData-0: 4rPedifiUh3/8PKtWWaCSXYlpj4YRXYqrVuWlC8c9vOxFy5QVmuPO3bKsQ99J/uKBqTUm2leZ/UC8FdmqqtK3xEWEkqOsZIqE6NePvCFednwp8uft6ela6rhsqEONMsJoT8ZZtUWsvTbACNTfFxlrocZfv11z4QmLQI6a4eTz6ObY3TsiB9kDFwuG0IUhvBFRBh64WXBigVj0F95UpD7neCqEebwGDi0h7kyi+f6iS3hKmany41bL071bETNiQ9Z0aqNckKhOap65JIfWxDibTmIYyrTyydtj35+pUdJqh2KdWdeqaBjC4VcTOUHckhGkckeLcKNjF9pNAzrZ0+nlvbg2sLRGIHTp9+wE8NXneSH0PtjTlgwlPgbvYsIywizpN8FCNeSIAi9rGSQiDMrnujzYL7fzTiiVSDv5eUwF5OPr5bR+1eJAyqlnX9KhU8PjHj7WIChkwk1/8YhnW6rOkvKe5U/b3UDg9jvR5+oJqOo7w85wjz3NR1J5z1fcOzczcwisWxI7sHVlWuuB89JakTNxAAA+TYHLopPxcQ175iIT+J/OinhEFP8FXgaOvHKoibtQ7oUe0uNit3Hh1/ZBxHdi5cZci/hY8bCeMcN/rZfpsMT2+810lmbTx5E5pxCQMJXUE2bU0P/5pn4VfSQq58aNy4rCYhKdz/OiJf8EfLw6MYLQSwSR0/4tGW7xvxMpGTcpCMTR8H2PEP4qYoehgVSkiiGIhzEMWfxkcJth0up94zb5DFdP4L9lx2/8xfw3kexnWXsmjM9HHo9xFeUL8b60BDCi0P2n+ZA36wlITYp18R9LOb5znub2LRZxCW4l74wJn+Oxi7KO9wMSpCau/zMDlZTnT53DDNU8iPnrITQZsdz1kH2nT/i+jA64EhrPyxuyF4Q+FnI79h12wG4M2sc5iOQltshFd66YOIejCANx7CZOkiwe4F7Gl3/neyXbc29oN07h3FmB+eBJ3T4GarGPQG9PmIyy7HOc1WQ4ypWcs50vJpG/yrAp1w+GyEdUdvLbwxTKE52ub+azFkXL+z8jHcCg6xedj581XRnF/7/MWjU4a7DimXfiAfvaRjm19ka6ZzUZLTL6lnVySn1NwWCXGRYY8meM7Xg5Gx5+y8TChtl+0enAZBMpo3Z4eKxpJ2BdqxfU7492vRHBZYPuUUX4Iy2M0+b78F0TIuChlM2vZyMYTW5t+lOCu/zGxC3ks4fFyZqbuAf7/oLrYZ1qNY3yjvSE1vO08z0qCtfw9/3scMVpiL3ForO3rxVDaKE0DzZZcOI1xF6pYKAuIq0Yjwaz4UGlIZGBk7I1X7WpZs9WCeCKfojGn6XNrzwW/EbT/8E9QSMke9MuQ3o+/IucjIP2mBeN/quEIUqTjmBZWFHK9zjbvxOwCarB+IjoR1Xo9WUY7wJmpxdJnUcYZ/PsR0ELUlFyqmobZNCHYQ1hajKU3suSlrIPHNaSL9Cie1QmsTMaBfOQgMLjXJW+Og2nSeuN6nx48VoL1rJRpOMLCxPeTzY6c4b7rWo4SLJqm6cpRZmopZfyl7r0NGEDb021VlVLOBbH+0lWknBn/cnZ8Xe58ktqBHfR/wOz8BwctEUmywOO1tS515Y/WyNlX+syKfYMEKVjp77ePPDZFqF/oFMt7xiNvqK/6n/033s0KjE0RohMZjXdeMeWbUVdr6RdkFTPKvlhdnT8HlYQJFLZQX3UI8Lv0y5idvGJS400ep9nSPFRtqpO7sUxTjMuPBdEVVC0bIcfEgxFf1iuRTLRUzE9uLXvQlGZwT4siNuDRbpzADTRvnI
X-MS-Exchange-AntiSpam-MessageData-1: yGT+iOQ9LiknJg==
X-OriginatorOrg: cs.tcd.ie
X-MS-Exchange-CrossTenant-Network-Message-Id: dc67e539-5306-47d9-66bf-08de963765d3
X-MS-Exchange-CrossTenant-AuthSource: PA3PR02MB11163.eurprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Apr 2026 12:56:21.3079 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d595be8d-b306-45f4-8064-9e5b82fbe52b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: I0ObNIAA+ZNC6L56MPp2biXhQQakJ7138OfEwDGg1jzl0sqLQaV6JGjZAIxLUYoq
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3PR02MB6187
Message-ID-Hash: RIOH3QV5KD76B2EOWE3C5R23IC7GPRJM
X-Message-ID-Hash: RIOH3QV5KD76B2EOWE3C5R23IC7GPRJM
X-MailFrom: stephen.farrell@cs.tcd.ie
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: New Liaison Statement, "Liaison communication to IETF regarding draft-ietf-tls-mlkem"
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/Zq2Wb7cpN5W7OTn3gsB0yrhFRoA>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hiya,

On 09/04/2026 13:46, Salz, Rich wrote:
>> This framing is I think unopinionated to the point of avoding
>> mention of the specific risks that motivate hybrids, and the need
>> to consider those risks before choosing a non-hybrid, with a
>> hybrid as the prudent default choice when in doubt.
> 
> Then those arguments should have been made in the hybrid documents.

Disagree. The higher risk applies to non-hybrids so needs to
be documented as RFCs for those are processed.

> Or Stephen’s proposed draft.

Yep, that'd be the way to do it:-)

> I don’t know of any IETF RFC — if you do, please post — that says
> “here’s how to do something, but don’t do it if xxxx yyy or zzz.”

That's very common - anything with a SHOULD NOT seems like a
match to me. (RFC8446 has a few.)

Cheers,
S.




> 
> 
> 
> _______________________________________________ TLS mailing list --
> tls@ietf.org To unsubscribe send an email to tls-leave@ietf.org

v2.46.0 | Report a Bug | By Email | System Status