[TLS] Re: What about AuthKEM? / Online-Offline signature split

[Thom Wiggers <[e-mail]>]

Hi all,

As main author of AuthKEM (nee KEMTLS) I’m of course a big fan of continuing discussions on it. The drafts have essentially been sitting on a simmer: I’m keeping them alive to indicate that we’re still interested in the proposal. At the same time, there are some things to overcome and in development that are probably required make AuthKEM more attractive, which is why we’re not pushing them actively. I’m also “just” an academic and don’t want to just push my pet project onto others.

The main problem is AuthKEM does not get rid of the signatures in the certificate chain. This means that in “WebPKI” deployments, you’re going from (say) 6 signatures to 5.  Aside from the fact that you could maybe do “fancier" signatures in the chain (which you could also do with ML-DSA-leaf certificate chains), this certainly reduces the relative gains.

PLANTS / MTC is actually something that could be helpful here, as it helps reduce the number of signatures to “just” the handshake signature. So with MTC’s reduced signature format, the relative gains of replacing the “last” ML-DSA signature is much more pronounced.

AuthKEM may also be interesting to environments that don’t use the WebPKI. At RWC, Viktor suggested looking at DANE in SMTP; I would be interested in exploring this and other environments more. [^1]

Cheers,

Thom   

[^1] on a more philosophical note, I wonder if we will see that the “everything uses TLS” trend will be broken by PQC, if/when TLS-with-sigs-without-resumption becomes too big for constrained environments.  See also other “esoteric” proposals like https://datatracker.ietf.org/doc/draft-housley-tls-using-mls-handshake/

> Op 8 apr 2026, om 07:49 heeft Viktor Dukhovni <[e-mail]> het volgende geschreven:
> 
> On Sun, Apr 05, 2026 at 07:32:27PM -0400, Daniel Apon wrote:
> 
>> KEMTLS is fantastic,
> 
> It certainly looks very interesting, and worthy of further exploration.
> 
> -- 
>    Viktor.  🇺🇦 Слава Україні!
> 
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]