[TLS] Re: FYI: Ubuntu 26.04.01 GnuTLS ML-DSA sigalg friction

[Viktor Dukhovni <[e-mail]>]

On Wed, Sep 02, 2026 at 06:17:29PM +0000, Salz, Rich wrote:

> > GnuTLS library advertises ML-DSA-{44,65,87} sigalgs even though the
> > implementation of the corresponding verification algorithms in
> > libnettle is stubbed out and always fails.
> 
> Seems like a simple bug to fix.  Did you report it to the GnuTLS
> folks?  (That’s probably more useful than reporting implementation
> bugs here :)

I should perhaps have mentioned that essentially the same library stack
(GnuTLS + nettle) is correctly built in Fedora43.  This looks more like
a question of consistent build configuration than intrinstic  features.

Reasons to mention it here in addition to notifying the Ubuntu and
GnuTLS maintainers include the observation that similar failures can
happen any time the TLS stack and underlying cryptographic library are
maintained and delivered separately, and the TLS library assumes a
set of available signature algorithms without an explicit indication
of the availability of each in the underlying layers.

A similar mishap is not entirely unlikely in other implementations,
and I'd like to recommend designs in which there is greater confidence
that the offered signature algorithms are actually available.

A second reason is that this sort of friction can adversely affect
pilot PQ deployments, and mentioning it is not particularly less
relevant than say mentioning that 3GPP is phasing out TLS 1.2, ... 
neither is directly about a document under WG consideration.

I don't expect to need to say more on this topic.

-- 
    Viktor.  🇺🇦 Слава Україні!