[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Tim Hollebeek <[e-mail]>]

I strongly object to the suggestion that not enough time has been spent discussing the advantages and disadvantages of hybrid vs non-hybrid authentication (a rather bold claim at this point, after eight years of such discussions!) or any suggestion that this process is moving too fast.

I would like to remind participants that IETF we stick to the technical merits of the draft and do not engage in these sorts of process insinuations. Nicola, I would like an apology, please.

-Tim
________________________________
From: Nicola Tuveri <[e-mail]>
Sent: Wednesday, April 22, 2026 1:22 PM
To: Salz, Rich <[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: [TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3


Hi Rich,

thanks for your clarification, indeed my phrasing was not ideal. I’ll take your comment as a chance to clarify my stance.


Code point assignment and deployment support are distinct considerations. In practice, non-experimental production deployments generally rely on both assigned code points and a published standard.


Concerns about the proliferation of standards introducing support for additional code points are not uncommon on this list. I note a similar concern here in support of delaying this draft.


At present, the process risks creating the impression of a “first-to-standard” outcome, where publication effectively determines the direction of deployment before the trade-offs have been fully examined, possibly even stalling the progress of other drafts. In particular, the argument that introducing additional options increases complexity has been raised repeatedly on this list, but it does not seem sufficient on its own to guide decisions in a security area WG. It would be preferable to more explicitly evaluate the security properties of hybrid and non-hybrid approaches and reach a position that can inform what should-and should not-be advanced to standard.

Best regards,

Nicola Tuveri



On Wed, Apr 22, 2026 at 19.30 Salz, Rich <[e-mail]<mailto:[e-mail]>> wrote:

  *
I have read the draft, but I do not support its publication at the moment.


  *
My rationale is that this draft adds complexity by adding extra code points for pure mldsa.

Code points are assigned when a stable reference is available, as you might recall from the long threads on the pure ML-KEM draft. So I don’t think your stated rationale makes sense.