IETF Logo Mail Archive

[TLS] Re: [EXTERNAL] Erlang/OTP and Bouncy Castle now supporting SLH-DSA in end-entity certificates

"Dang, Quynh H. (Fed)" <quynh.dang@nist.gov> Mon, 17 August 2026 14:20 UTC

Return-Path: <quynh.dang@nist.gov>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 5F02912B0C759 for <tls@mail2.ietf.org>; Mon, 17 Aug 2026 07:20:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1786976415; bh=w5gR9CTUNVqjNsxqAZyiz9d9XDt5oZW71TQIHznmEQQ=; h=From:To:Subject:Date:References:In-Reply-To; b=CogruwJIZQ9QJqgr/FIQyaqApbtJlyizsZDml5N/ozTEBTDT7T/Cl8m5gRZHmF1Ra JXGs9S+g467Nh9CVwWBsSuC2YCdRZ0NSn6qOPyrANovf7MiWS27i8wNGjofP6uOvT4 3hEBNxBtTtJj21d2Xyo7BkH7K5Rc1vbdoQvSCq7c=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.1
X-Spam-Level:
X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=nist.gov
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xztSwb634DrE for <tls@mail2.ietf.org>; Mon, 17 Aug 2026 07:20:14 -0700 (PDT)
Received: from BN8PR09CU001.outbound.protection.outlook.com (mail-eastus2azon11012066.outbound.protection.outlook.com [52.101.58.66]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E9BEF12B0C752 for <tls@ietf.org>; Mon, 17 Aug 2026 07:20:13 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cSHPKUe17oSiHJrMMeTFVqos1oY+Qj3WqE6NlhLfMEdPhqB9pHIZvhUE+FApvgq2CZS6zGjPiZs2rHBMrWCtal+eRIziJWG5LYTCXIEym+Eq3BBygD2/XkFjFsiJTZXhX/9jVz6wan6d1SRXw8Rf9lB27sAh5dHgLv6a2gtnENQfzeKvpwfzJO2iSnqIvHPKaaDnUsUUUHkPgspLaX3X8VcwIeOMPebqOA4RSKJW5xKpxHlzARSfvMjcaIpi7zzTcC4mkdxFrNXVOTTiYNYx7NtKyU5LxI0UNwKaOn92uza9IdT/hGt42lT4ZYHyMYXS7oIiXaJMPUGPRLkT+Kd8zQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9qt7ryfRhyNhFN+3nbJWExe+HMuUTslzPmDenSz30yk=; b=iRxF36KiATGb4+dZXpliEwpSVCQQKid9xtcLlPY1g437QhTQhbWP5990HYLvivJ4/rdOcKFvB1JMJmzRmAsZ2TjzzRyaKHPk1xAQGzSEVOqLK2Khrq9lJTa4STXboFBjdVGm9AHelWUpuO3RoGrvVTfq0uDbhFaJvvwvq+4nXcIdBV8g/VW+aNDOjX1tlZEIgtcHIICm0h1quyOi7A5rEYbAMEvECYcERZeeLyB2qKjI1/BtJO6mTzpV5GVCBqHIvWWzCt0Qo8Gq6dlQtp3YkUuwiFP2zMjY+e1zNudOg2emhX8N8wj+hAnqsZv2E5QKLw7Xx7Blk0aklu2h1zZCCQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9qt7ryfRhyNhFN+3nbJWExe+HMuUTslzPmDenSz30yk=; b=Ioai1i497uk4o0FCRt2bB59ACGnxWc6sum31uRsxl0tH+HCsysqKQHWoXJp8C8c4s2QmpJxKoVe+MY8MFc5YmziN2EEB8rszbJMIH8N7Q0upC6pso0KQiFvmP27soHA2ZdU9CfEBCVzTxU9vvoHIcHIrtgQfy1bpDrROeeLFkV4vm9Oo2MwktxUA+DcFq0se9OKFkJVcaJrP46skUVe69O582biEIdbaISm2Zot18l7A4MMv5Hs6I/ERvE9iqHO0TW+jxNZh2Z64t8FMr0pMfWNhlJwv/eMgozIvZOBHNE5etUvAyM3+6MUVEQo7wmhho5h7951tGpQ4oyR8EMpMeg==
Received: from MW4PR09MB10059.namprd09.prod.outlook.com (2603:10b6:303:1fc::22) by FT1PR09MB13499.namprd09.prod.outlook.com (2603:10b6:170:1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.17; Mon, 17 Aug 2026 14:20:03 +0000
Received: from MW4PR09MB10059.namprd09.prod.outlook.com ([fe80::def7:ba99:ec18:2ef6]) by MW4PR09MB10059.namprd09.prod.outlook.com ([fe80::def7:ba99:ec18:2ef6%7]) with mapi id 15.21.0315.016; Mon, 17 Aug 2026 14:20:02 +0000
From: "Dang, Quynh H. (Fed)" <quynh.dang@nist.gov>
To: "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: [EXTERNAL] [TLS] Erlang/OTP and Bouncy Castle now supporting SLH-DSA in end-entity certificates
Thread-Index: AQHdKwnCY+xq4hO9D0+M9cX5AxkjeLaiTqKA
Date: Mon, 17 Aug 2026 14:20:02 +0000
Message-ID: <MW4PR09MB10059FEE9E8A62E42693A8FD2F3A72@MW4PR09MB10059.namprd09.prod.outlook.com>
References: <AS2SPRMB00197441178DEE9AFD0F460589DB2@AS2SPRMB0019.eurprd07.prod.outlook.com>
In-Reply-To: <AS2SPRMB00197441178DEE9AFD0F460589DB2@AS2SPRMB0019.eurprd07.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MW4PR09MB10059:EE_|FT1PR09MB13499:EE_
x-ms-office365-filtering-correlation-id: 43e0c29f-3099-4807-834a-08defc6aa08b
x-ms-exchange-atpmessageproperties: SA
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|22082099003|18002099003|55112099003|56012099006|8096899003|13003099007|38070700021|10067099003;
x-microsoft-antispam-message-info: jo9SB+8IOSrjHKr0sBkdD7Vf1kFQ3ZAPP1mPe7m/Gd3+Ox9AQcaiVexnxLKoGwmow/+pREpBsRGl27W9uZS89mCns7ZOXaOy/MJ7ofYsjmGzAXDyTIXyshPekOyYUjbykpf4Q23MlO6Czk25aEO1yuHFvIkf25uHmV20QEwRF0aEsOijT/b6TDXtFF8bXESX5zZbn/54haUYJZ+oqF+KWzdOxmBHdqP8lxvWYFmlephYCl4ckxiTSFH5wCQDDTRfqzddRhVJoQjzB1z92d7vKKuzrUvz9HebRQshAfvQVjHaAdlUzpXIKx9A4q1m/TPWqFDPIOX6NKsxJ4g44sh7fEDElm77Qea1c/QfrLfWmUKX/R7FBStoxe3ItmdVgURByh8//KEkKdF7W3IhY+2BrS5hGL2oviih2uEbWk9bn6+7dqBGpxEWt/xCbqoWWlzkk0C8Uze75BCpQw5bmVe0bS8G6zcawNvbQgTqnTBM2fi/9Qk/sbvIVfJXaizsjB6RtrYvp+H1emYWfghO7RBkAZH2JnASWVngFt1NIrmgtpVw9Tyz95cR8GjkzKedhDt+NR87bii/i61ZLVOGmf0Ex4GxMBBZmdv4UGiZyTxZ6NnAwjDyadTZqhOotZzD+ygUNHLodQVMTgL61IQmXVNeh4P4wlwyIoccAVqb14pavUw=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR09MB10059.namprd09.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(22082099003)(18002099003)(55112099003)(56012099006)(8096899003)(13003099007)(38070700021)(10067099003);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: OjWt+scKKMR+HUsrxvD+7dEre2KMlbv3IsRh0k0N+ljM9Pjm3nP10CHBatiYSIZjag0hfxXtUcEvzN4yTh/0DRiHRdUBH4Yo0hpb9nhBiVfvOo/sHygwV+NKzG7HHWEyYDtV70xnF2W/U4VLq9i+PCSOAOO6IzbxI8p4uM4Is+tOY/xp3qnWRveatA9WAekcu+XIc0Pw9dw/AG/yJ3fA9otv9y5eTyqAUpqHIHMlZ9FBLKAfyTFXIyIuR4HK0cFRTNdfV3aYzhy37PN4P4eJUtSorkytNONLP1FNaiIhQRkBJBczVSC55f24VltJBshA9vM096XI9McW9Uo2iGnFVWPDdopDiBnELwqsduwlsRHbF2QsS2/erpqxsSZ8jwnHq6Z7e6O7NGLp+R1N3R2fQLU6aXHyFroDf2aPXkVy5qSEuFWWFyIhWAjnaOLGwsHDwVPGCFq5xkQyJAZ8HBerPjdqezRsF+PRna/BxwE5pTN2v96rgNhr+sWaiWtJuvJQQnwmi1fALlO2ZmxhAdPIz7XR5e0sIIfQ2t4fOp5naJ8CO+NzasH7zkszRaeBtfwaV81xibJ3vQdhgfXDACpP5Ji4iCM/J9svIWDfUOXF+eiW1XnegFV0J4WPJMn5RC63HJZuMbUSu0i7EMBjtPIjM5EnkkyX37uL4jBpGAqkdi9ZoAFRdlCQF2gpyptUd9nzQgvQrNFexhDwcaciERfQcAfRYjS4Yj23fslVbVlogs3kODlie63yZgduHrcaZCdF0k1Q+eZQho6+R0DqRYZ+FATVVS0V91HJS5AOgoHLMwc6Z/DIDCb8sWDCQj+AdUCJCSxBDV6dMzYV0kr8aEGdAD3eVWXFXSWElhF/98XoFXuHxrnej0A2On//Njp1lnCbvj5egWv8xeDkJDFlnhI1rincoeOaH0wpbJc9PgTHBImFIpOD6ioFu1Y+wcAUvow82SpvxthW/HgQF4QJOC+ESZjktr1V7rxBTVPXrWU1JI35/43+JbCthofFnMGub4vRieed49msl8zUu4ru4BcBZCV8/PbsHiRVzWkutxd2kje4/qWS9i9f/d5EXnJrHiFXIMZOLYlhbGV6KeyCSKCVnsPQjFP+UWDlEUJEUnNr1lgNmfp8qFjL3M4RCmtOwDsXQDlZfJnZ7g0v4UbEhLu6YwX66CGVu6vmy8+IaX3r80nj8nI6ZuhxmB0cEE9Rgr4k/LAPJq/AD0ZmEGKgWg2BQcx00kChq8n/dIfMJfRGDogph1OHSPMBQNIX5UflY9ny4PFPZVt0lfpfdKmXCE7AVY+AJlCmOcRL3IGnmZOLM//X5FRdD7JDjJEQauLDtsDH6AHbM5WgW0XQKpS3vy3TXsCsXnuHgTUAnWsHLdICFp19MfXQtjU64mhJWLW3+51TAsYM3K6Yb5NdJ62ntwbeOSGp04u4Vr6bmzPEe4VhlOwkazgT+BRhR1NL9hcSInX9u8Ou8Rom1q1Avn/jt5+9e7OJZUYJ/EcB1hAtqyWzvpqVYtBUEAuHn9HwsMsJWd3T1kLwjOFZbyNfyNjjuU0BTpEZXx8DvLL2ajHf1YYzc7P3EQ836xJP7IrsjNEvPzysyZ5BQ+hxIGabrYceuQ0TWbvxoP+HxSLoM2GT02gkd3lA+IF0PTiFJDULsoxp4yc/Nnl6G4XhQIo0PVINwiQHTGb/Uop67Kwn8xLtfeRovXz/GyJckjzrLOY6OGWHptzu
Content-Type: multipart/alternative; boundary="_000_MW4PR09MB10059FEE9E8A62E42693A8FD2F3A72MW4PR09MB10059na_"
MIME-Version: 1.0
X-OriginatorOrg: nist.gov
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW4PR09MB10059.namprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 43e0c29f-3099-4807-834a-08defc6aa08b
X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Aug 2026 14:20:02.2821 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FT1PR09MB13499
Message-ID-Hash: 2LHXCZR6IL3N3XWS34BFAZ6VOUWPSNRK
X-Message-ID-Hash: 2LHXCZR6IL3N3XWS34BFAZ6VOUWPSNRK
X-MailFrom: quynh.dang@nist.gov
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; header-match-tls.ietf.org-1; header-match-tls.ietf.org-2; header-match-tls.ietf.org-3; header-match-tls.ietf.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: [EXTERNAL] Erlang/OTP and Bouncy Castle now supporting SLH-DSA in end-entity certificates
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/iz8Lbc30YRoMg9ysvtTnVK5EEF4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hi all,

There is an on-going discussion of the paper mentioned in the email below at https://discord.com/channels/1229434220154196008/1234415342634143796  . A new paper with the title "The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP" has been published at https://eprint.iacr.org/2026/1693 .

Regards,
Quynh.


From: John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org>
Sent: Thursday, August 13, 2026 6:34 AM
To: <tls@ietf.org> <tls@ietf.org>
Subject: [EXTERNAL] [TLS] Erlang/OTP and Bouncy Castle now supporting SLH-DSA in end-entity certificates

Hi,

We constantly try to maintain an overview of what different TLS libraries support, especially now that we are in the middle of the PQC migration.

While several TLS libraries have supported SLH-DSA in CA certificates for some time, I'm happy to report that both Erlang/OTP [1] and Bouncy Castle now support SLH-DSA as the public key in end-entity certificates. They also support ML-DSA and ML-KEM. SLH-DSA performance is adequate for all of our telecom use cases.

Have I missed any other TLS libraries with comparable support?

Given the risk of potential future attacks against lattice-based schemes such as the one discussed in [2], I believe all TLS libraries should support SLH-DSA and HQC-KEM. Note that PQ/T hybrids do not help at all.
Cheers,
John Preuß Mattsson

[1] https://www.erlang.org/

[2] https://eprint.iacr.org/2026/1591

v2.46.0 | Report a Bug | By Email | System Status