[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[David Benjamin <[e-mail]>]

I agree with Bas. Obviously the TLS WG can and should override the FIPS'
document's guidance when the general guidance is inappropriate. But when it
is appropriate, it is simpler for everyone to just cite it.

In this case, I think the FIPS guidance is already what we want, and
addresses exactly those platforms where side channels make deterministic
signing unattractive.

On Fri, Apr 10, 2026, 09:32 Bas Westerbaan <bas=
[e-mail]> wrote:

> FWIW, PQC-Forum should not be authority to make decisions for TLS -- that
>> authority should remain with IETF TLS WG.
>>
>
> Certainly, and I did not mean to suggest otherwise. For matters not unique
> to TLS, we should take note of the discussions there.
>
>
>> Has there been a change in understanding?
>>
>> Deterministic signing has the advantage that it's easier to test for
>> correctness. On platforms where side channels and fault attacks are not as
>> pressing of concern, this can outweigh the benefit of hedged signing.
>>
>> I have presented very concrete hardware examples, where side-channel
>> attacks have been wildly exploited, and hardware vendors have still refused
>> to take care of side-channel attacks. If we don't forbid deterministic
>> signing, I believe the attacks may remain exploitable.
>>
>
> Concerns with deterministic signing were well known for years and
> certainly during the discussion at the pqc-forum. The guidance is §3.4 in
> FIPS 204 is pretty clear. Did we learn anything new in the meantime? Is TLS
> particularly vulnerable?
>
> Best,
>
>  Bas
>
>> _______________________________________________
> TLS mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>