[TLS] Re: Confirming PQ+T Signatures Consensus

[Sophie Schmieg <[e-mail]>]

1. Should the WG work on PQ + T Hybrid Signatures for TLS?
Neutral.
It's probably going to be required in some compliance regimens, so
there is an argument for it. On the other hand, as far as I understand
it, "for TLS" only covers the leaf signature to begin with, the rest
of the certificate chain should be handled by LAMPS for the
certificate chain, and PLANTS for CT logs, or am I mistaken? The leaf
signatures are some of the least value signatures in the handshake,
produced and consumed within less than a second, with a public key
that rotates on at least somewhat reasonable rates, so the risk here
is fairly minimal, at least with my prior of a high confidence in
ML-DSA, and has an existing remediation strategy that is reasonably
well exercised.
2. Should the WG only work on one: -pqt-dual-certs or -composite-ml-dsa?
Only composite-ml-dsa
3. Should the WG work on: -pqt-dual-certs?
no. Technically, TLS certificates are already a directed graph, with
various complexities in path finding between standards,
implementations, and common practices. Making this situation even more
complex by requiring multiple paths is going to be a nightmare. It
would also mean that TLS needs to start having opinions on the nature
of the roots trust anchors are using, getting very messy. The main
reason "multiple certs" gets pushed is for the situation where people
want to continue using their classical cert, which just opens the door
to a lot of downgrade attacks. PQ authentication is hard enough, let's
not make it even harder.
4. Should the WG work on: -composite-ml-dsa?
Yes. This addresses the security concern people pushing for composites
have, without opening the door to the downgrade mess. While I still
consider composite optional for leaf signatures, it's the correct way
of actually addressing the security concerns.

On Tue, Sep 29, 2026 at 9:59 AM Ilari Liusvaara
<[e-mail]> wrote:
>
> On Mon, Sep 28, 2026 at 12:52:21PM -0400, Sean Turner wrote:
> >
> > Please provide your answers to the following questions by 12 October 2026:
> >
> > 1. Should the WG work on PQ + T Hybrid Signatures for TLS?
>
> No. I consider the use case too niche.
>
>
> > 2. Should the WG only work on one: -pqt-dual-certs or -composite-ml-dsa?
>
> No.
>
>
> > 3. Should the WG work on: -pqt-dual-certs?
>
> No. There seems to be no way to make this not play merry hell with TLS
> library APIs. Which is bad.
>
>
> > 4. Should the WG work on: -composite-ml-dsa?
>
> No. I think this is too limited applicability, and the registration
> policy is SR (with interpretation from looser end).
>
> I think the best use case for this is IoT devices that spend a lot of
> time on the shelf, and where vendor is also the CA.
>
>
>
>
> -Ilari
> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]



-- 

Sophie Schmieg | Information Security Engineer | ISE Crypto |
[e-mail]