[TLS] Re: New Liaison Statement, "Liaison communication to IETF regarding draft-ietf-tls-mlkem"

[Paul Wouters <[e-mail]>]

On Fri, 3 Apr 2026, Eric Rescorla wrote:

> This is precisely what I said in the text above:
> 
> That normally happens with RFC publication, but we find ourselves
> in the difficult case where an algorithm *is* being worked on in the
> IETF but there is real contention about whether it should be published [0],
> leaving us in an unfortunate situation. 

The contention is whether it should be published now or later, when
classic protections gain us little to no benefit. That is quite a
different situation from the "publish now or never" question, which is
not at stake here but people seem to treat this discussion as such.

Google and Cloudflare just adjusted their deadlines on this from
further into the future to 2029. It seems it would be prudent to have
this algorithm as an RFC now, since we would want to have it ready for
about 2029 anyway, if indeed classic algorithms would fall with a single
vendor / academic budget. The way to say "we published an RFC to help
people gain experience, but we don't want you to use this right now"
is by RECOMMENDED=N.

The other layers in the stack, eg IEEE, sits far closer to implementing
things in hardware. It makes total sense to publish this draft as RFC
now for them, so they can confidently start manufacturing the hardware.
And in a few years if nothing bad happens, and anyone can rent a cloud
quantum computer to break classic algorithms, we switch it to RECOMMENDED=Y.
This reasoning also means going via the ISE is not the right path.

People spend a lot of energy on the "but what if mlkem turns out to be
broken", but lets remember that even without this document becoming an
RFC, if mlkem turns out to be broken in 5 years, and a quantum computer is
easilly available, there will be about 5 years of stored data that can
already be decrypted. That is, we've already commited to mlkem being
safe, and the extra seatbelt isn't doing much now and won't do anything
at all, in just a few years.

On the other hand, if mlkem is not broken, and quantum computers are
available, this document makes the most sense to deploy.

It makes 100% sense to get this document published as an RFC with
RECOMMENDED=N. It solves the problems of the people who want to use
it, and solves the problem of the people who don't want to use it. And
the TLS WG can go back to regular work again. Or we can keep discussing
this every three months until another organization or goverment will
stand up their own IANA style crypto registry and make the IETF
irrelevant.

Paul