[TLS] Re: Confirming PQ+T Signatures Consensus

[Ilari Liusvaara <[e-mail]>]

On Tue, Sep 29, 2026 at 01:27:01PM -0400, Sophie Schmieg wrote:
> 1. Should the WG work on PQ + T Hybrid Signatures for TLS?
> Neutral.
> It's probably going to be required in some compliance regimens, so
> there is an argument for it. On the other hand, as far as I understand
> it, "for TLS" only covers the leaf signature to begin with, the rest
> of the certificate chain should be handled by LAMPS for the
> certificate chain, and PLANTS for CT logs, or am I mistaken? The leaf
> signatures are some of the least value signatures in the handshake,
> produced and consumed within less than a second, with a public key
> that rotates on at least somewhat reasonable rates, so the risk here
> is fairly minimal, at least with my prior of a high confidence in
> ML-DSA, and has an existing remediation strategy that is reasonably
> well exercised.

Another usecase is some kinds of IoT devices.

And with the codepoints, there is signature_algorithms_cert, and at
least some TLS libraries do pay attention to it.

And as for adding signature_algorithm_cert_x509ai, which specifies
algorithms by X.509 AlgorithmIdentifier, that will not work right with
algorithms that are not what COSE/JOSE calls fully specified (nor with
some legacy algorithms, but nobody should be using those).

(And non-fully-specified algorithms will not work any better in
signature_algorithms_cert.)


> 3. Should the WG work on: -pqt-dual-certs?
> no. Technically, TLS certificates are already a directed graph, with
> various complexities in path finding between standards,
> implementations, and common practices. Making this situation even more
> complex by requiring multiple paths is going to be a nightmare. It
> would also mean that TLS needs to start having opinions on the nature
> of the roots trust anchors are using, getting very messy. The main
> reason "multiple certs" gets pushed is for the situation where people
> want to continue using their classical cert, which just opens the door
> to a lot of downgrade attacks. PQ authentication is hard enough, let's
> not make it even harder.

Other than the TLS certificates (which are hard regardless, hopefully
PLANTS is way way easier), I consider all this the easy stuff.

The hard part is TLS library interfaces. Where composite-mldsa leaks
out, this has a large outflow pipe. Which to be clear, is a serious
problem.


> 4. Should the WG work on: -composite-ml-dsa?
> Yes. This addresses the security concern people pushing for composites
> have, without opening the door to the downgrade mess. While I still
> consider composite optional for leaf signatures, it's the correct way
> of actually addressing the security concerns.

This has different downgrade mess. There is not just the downgrade-to-
traditional, but also downgrade-to-stand-alone (or you could just use
stand-alone).

And without further profiling, interoperability looks iffy.




-Ilari