MIME-Version: 1.0
References: <16CF0FDA-7263-461A-9F2B-D37DBEAF5DD9@sn3rd.com>
 <25c8d414-e4c8-455b-bd64-28132615ba75@cs.tcd.ie>
 <68f49a81-dd2c-4bea-896a-87da3e6aff68@tu-dresden.de>
 <CAMjbhoWwvfkfScpbf4-5PBzk__qb+6M4ZzAOba64kk9aXBba5g@mail.gmail.com>
 <d47a34ab-7fb9-4687-84aa-a5fa6bcf6a6c@tu-dresden.de>
 <CAMjbhoWBHmJnLx7wRG9iyurAHrSCExxO83G8PN=TnQUidp84SQ@mail.gmail.com>
In-Reply-To: 
 <CAMjbhoWBHmJnLx7wRG9iyurAHrSCExxO83G8PN=TnQUidp84SQ@mail.gmail.com>
From: David Benjamin <davidben@chromium.org>
Date: Fri, 10 Apr 2026 10:00:28 -0400
Message-ID: 
 <CAF8qwaDmkHwhBS=OxQRtE+JawBgKyLB+ou8ujQ4v8Hf04yrrdQ@mail.gmail.com>
To: Bas Westerbaan <bas=40cloudflare.com@dmarc.ietf.org>
Content-Type: multipart/alternative; boundary="000000000000111e29064f1b8ff4"
Message-ID-Hash: IQFXRGUZU7EPW2V3GWLVESNOIQIR3ETD
CC: TLS List <tls@ietf.org>
Precedence: list
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_Working_Group_Last_Call_for_Use_of_ML-DSA_in_TLS_1?=
	=?utf-8?q?=2E3?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/id5D7irJi6mwNyDKSgGCvkj68zA>

--000000000000111e29064f1b8ff4
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I agree with Bas. Obviously the TLS WG can and should override the FIPS'
document's guidance when the general guidance is inappropriate. But when it
is appropriate, it is simpler for everyone to just cite it.

In this case, I think the FIPS guidance is already what we want, and
addresses exactly those platforms where side channels make deterministic
signing unattractive.

On Fri, Apr 10, 2026, 09:32 Bas Westerbaan <bas=3D
40cloudflare.com@dmarc.ietf.org> wrote:

> FWIW, PQC-Forum should not be authority to make decisions for TLS -- that
>> authority should remain with IETF TLS WG.
>>
>
> Certainly, and I did not mean to suggest otherwise. For matters not uniqu=
e
> to TLS, we should take note of the discussions there.
>
>
>> Has there been a change in understanding?
>>
>> Deterministic signing has the advantage that it's easier to test for
>> correctness. On platforms where side channels and fault attacks are not =
as
>> pressing of concern, this can outweigh the benefit of hedged signing.
>>
>> I have presented very concrete hardware examples, where side-channel
>> attacks have been wildly exploited, and hardware vendors have still refu=
sed
>> to take care of side-channel attacks. If we don't forbid deterministic
>> signing, I believe the attacks may remain exploitable.
>>
>
> Concerns with deterministic signing were well known for years and
> certainly during the discussion at the pqc-forum. The guidance is =C2=A73=
.4 in
> FIPS 204 is pretty clear. Did we learn anything new in the meantime? Is T=
LS
> particularly vulnerable?
>
> Best,
>
>  Bas
>
>> _______________________________________________
> TLS mailing list -- tls@ietf.org
> To unsubscribe send an email to tls-leave@ietf.org
>

--000000000000111e29064f1b8ff4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div>I agree with Bas. Obviously the TLS WG can and shoul=
d override the FIPS&#39; document&#39;s guidance when the general guidance =
is inappropriate. But when it is appropriate, it is simpler for everyone to=
 just cite it.</div><div dir=3D"auto"><br></div><div dir=3D"auto">In this c=
ase, I think the FIPS guidance is already what we want, and addresses exact=
ly those platforms where side channels make deterministic signing unattract=
ive.</div><div dir=3D"auto"><br><div class=3D"gmail_quote gmail_quote_conta=
iner" dir=3D"auto"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Apr 10, 20=
26, 09:32 Bas Westerbaan &lt;bas=3D<a href=3D"mailto:40cloudflare.com@dmarc=
.ietf.org">40cloudflare.com@dmarc.ietf.org</a>&gt; wrote:<br></div><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s=
olid;padding-left:1ex"><div dir=3D"ltr"><div class=3D"gmail_quote"><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px=
 solid rgb(204,204,204);padding-left:1ex"><div>FWIW, PQC-Forum should not b=
e authority to make decisions for TLS --
    that authority should remain with IETF TLS WG.</div></blockquote><div><=
br></div><div>Certainly, and I did not mean to suggest otherwise. For matte=
rs not unique to TLS, we should=C2=A0take note of the discussions there.</d=
iv><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0=
px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
    <blockquote type=3D"cite">
      <div dir=3D"ltr">
        <div class=3D"gmail_quote">
          <div> Has there been a change in understanding?</div>
          <div><br>
          </div>
          <div>Deterministic signing has the advantage that it&#39;s easier
            to test for correctness. On platforms where side channels
            and fault attacks are not as pressing of concern, this can
            outweigh the benefit of hedged signing.</div>
        </div>
      </div>
    </blockquote>
    I have presented very concrete hardware examples, where side-channel
    attacks have been wildly exploited, and hardware vendors have still
    refused to take care of side-channel attacks. If we don&#39;t forbid
    deterministic signing, I believe the attacks may remain exploitable.<br=
></div></blockquote><div><br></div><div>Concerns with deterministic signing=
 were well known for years and certainly during the discussion at the pqc-f=
orum. The guidance is =C2=A73.4 in FIPS 204 is pretty clear. Did we learn a=
nything new in the meantime? Is TLS particularly vulnerable?</div><div><br>=
</div><div>Best,</div><div><br></div><div>=C2=A0Bas</div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div><blockquote type=3D"cite">
      <div dir=3D"ltr">
        <div class=3D"gmail_quote">
          <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8=
ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
            <div>
              <p> </p>
              </div></blockquote></div></div></blockquote>
  </div>

</blockquote></div></div>
_______________________________________________<br>
TLS mailing list -- <a href=3D"mailto:tls@ietf.org" target=3D"_blank" rel=
=3D"noreferrer">tls@ietf.org</a><br>
To unsubscribe send an email to <a href=3D"mailto:tls-leave@ietf.org" targe=
t=3D"_blank" rel=3D"noreferrer">tls-leave@ietf.org</a><br>
</blockquote></div></div></div>

--000000000000111e29064f1b8ff4--