[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Ilari Liusvaara <[e-mail]>]

On Sun, Apr 12, 2026 at 01:51:58PM +0200, Muhammad Usama Sardar wrote:
> 
> In particular, say you are an implementer used to reading IETF documents and
> not NIST documents. Security considerations being offloaded to NIST document
> is an additional burden for you. But let's put that aside. For your
> implementation, would you interpret that text as SHOULD NOT or MUST NOT in
> IETF sense? How would you resolve this ambiguity?

It is clearly SHOULD NOT.

 
> And I believe this ambiguity has significant high-stakes impact. Say you
> manage to resolve it as SHOULD NOT: All confidential computing solutions are
> /almost exclusively/ based on TLS protocol. Would you let attacks like
> BadRAM, TEE.fail and wiretap.fail continue to be exploited? To me, this
> seems like a disservice to the community, given a demonstrated history of
> exploited attacks.

Randomized signing does not help there.

Furthemore, things like BadRAM, TEE.fail and wiretap.fail are far from
the worst threats. And the worst threats are becoming even worse...




-Ilari