[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

["Ackermann, Michael" <[e-mail]>]

HOSTILE TAKEOVER???????????

From: Eric Rescorla <[e-mail]>
Sent: Wednesday, May 6, 2026 12:51 PM
To: David Benjamin <[e-mail]>
Cc: TLS List <[e-mail]>
Subject: [TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[External email]
+100 to this.

With any luck, we can take a pause on the discussion of this topic on-list. I am aware that there may be pending appeals, but we have a process for addressing those that does not require on-list debate.

-Ekr


On Wed, May 6, 2026 at 6:23 AM David Benjamin <[e-mail]<mailto:[e-mail]>> wrote:
Thanks, Deirdre, Joe, and Sean, for all your hard work in navigating these WG discussions!

On Wed, May 6, 2026 at 9:09 AM Sean Turner <[e-mail]<mailto:[e-mail]>> wrote:

Replying to the original consensus call message.



RFC 2418 Section 3.3 lays out the criteria for “rough consensus”:


   Working groups make decisions through a "rough consensus" process.

   IETF consensus does not require that all participants agree although

   this is, of course, preferred.  In general, the dominant view of the

   working group shall prevail.  (However, it must be noted that

   "dominance" is not to be determined on the basis of volume or

   persistence, but rather a more general sense of agreement.) Consensus

   can be determined by a show of hands, humming, or any other means on

   which the WG agrees (by rough consensus, of course).  Note that 51%

   of the working group does not qualify as "rough consensus" and 99% is

   better than rough.  It is up to the Chair to determine if rough

   consensus has been reached.


In this case, during WGLC there was an almost 4:1 ratio for progressing this draft, which we judge fits within the numeric “more than 51% and less than 99%” range suggested by this text for “rough consensus” and represents the “dominant view of the working group”.


In assessing rough consensus, we also considered the nature of the objections. In reviewing the list traffic, the majority of objections related to the status of pure MLDSA versus composite MLDSA-ECC, including (1) we should not publish a pure MLDSA specification at all; (2) we should recommend composites over pure MLDSA; (3) we should publish the composite and pure MLDSA specifications concurrently. While there was substantial disagreement on these points, we believe that the discussion on-list sufficiently aired the respective points of view and that the right approach is fundamentally a judgement call based on weighing various technical factors, which each WG participant needs to make for themselves. We see no reason to believe that participants were not able to make informed judgements.


Conclusion: The chairs believe there is consensus to proceed with publication of this draft as an RFC with Recommended=N for those people that want to use this algorithm, and a future Standards Action will be needed to make a change to Recommended=Y, if anyone has the willingness to undergo this heated discussion again.

For transparency purposes, the chairs note that we received a complaint/appeal about the consensus call. The message was moderated due to a previous notice of moderation; see [1], and the complaint/appeal contains a derivative work notice. As a result, the message was not sent to the mail list and we will not process the complaint/appeal as-is. If the message is resubmitted without the notice, the message can be posted to the mail list and we will process the complaint/appeal.


The Chairs,
Deirdre, Joe, and Sean

[1] https://mailarchive.ietf.org/arch/msg/tls/no0lW8r_wIPGF1ZXWB3EaGywh9Q/<https://urldefense.com/v3/__https:/mailarchive.ietf.org/arch/msg/tls/no0lW8r_wIPGF1ZXWB3EaGywh9Q/__;!!DVqnNCPqsA!H9Py_Rt__O8pjzUI4OMX2OusR6HFRbXek-Wm9dHUdjLkLaTuW7-CKZAvUaDoN8M1vUJ4yLIQHQ$>


On Apr 28, 2026, at 16:24, Sean Turner <[e-mail]<mailto:[e-mail]>> wrote:

Hi! The chairs have judged that there is consensus to progress this I-D. We will work with the authors to get a new version submitted and we will get to work on the Shepherd Write-Up.

The Chairs,
Deirdre, Joe, and Sean


On Apr 9, 2026, at 15:30, Sean Turner <[e-mail]<mailto:[e-mail]>> wrote:

This is the working group last call for Use of ML-DSA in TLS 1.3. Please review draft-ietf-tls-mldsa [1] and reply to this thread indicating if you think it is ready for publication or not. If you do not think it is ready please indicate why. This call will end on April 23, 2026.

REMINDER: If you have not done so recently, review the TLS WG's Mail List Procedures; see [2].

The Chairs,
Deirdre, Joe, and Sean

[1] https://datatracker.ietf.org/doc/draft-ietf-tls-mldsa/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-ietf-tls-mldsa/__;!!DVqnNCPqsA!H9Py_Rt__O8pjzUI4OMX2OusR6HFRbXek-Wm9dHUdjLkLaTuW7-CKZAvUaDoN8M1vUKcrqJCBA$>
[2] https://mailarchive.ietf.org/arch/msg/tls/ucdImHExlbOf4Q3BCG81gjzi2xE/<https://urldefense.com/v3/__https:/mailarchive.ietf.org/arch/msg/tls/ucdImHExlbOf4Q3BCG81gjzi2xE/__;!!DVqnNCPqsA!H9Py_Rt__O8pjzUI4OMX2OusR6HFRbXek-Wm9dHUdjLkLaTuW7-CKZAvUaDoN8M1vUJmOlAILQ$>


_______________________________________________
TLS mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>
_______________________________________________
TLS mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>

The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.

Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.