[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Jacob Appelbaum <[e-mail]>]

Hello Paul,

Nice to hear from you; it has been a long time. I hope and trust that 
you are doing well.

On 5/4/26 22:02, Paul Wouters wrote:
> On Mon, 4 May 2026, Jacob Appelbaum wrote:
> 
>> Long-timers can be wrong and given the Dual_EC history and various
>> related drafts, they might even be wrong twice
> 
> IETF was never wrong on Dual_EC.

You are misreading the antecedent of "they."

The sentence of mine that you are quoting was replying to Rich's appeal
to "long-timers," not making a claim about the IETF as an institution.
Seniority alone is not a substitute for answering the security argument.

> It never tried to standardize Dual_EC.
That answers a narrower claim than the one I made, and about the wrong
entity.

I wrote "given the Dual_EC history and various related drafts." I did
not claim that the IETF tried to standardize Dual_EC, and I am not
making that claim now.

Probably we can find common ground that "it never tried to standardize
Dual_EC" does not mean the relevant processes worked well, that all of
the right lessons were learned, or that the institutional memory today
fully captures the magnitude of the problem.

> There were individual drafts about adding more (strong) randomness 
> only.

Which specific drafts do you mean? The set discussed in [0], especially
Section 7, seems the obvious place to start.

> https://blog.cryptographyengineering.com/2017/12/19/the-strange- 
> story- of-extended-random/
> 
> Since Extended Random was never standardized by the IETF, it 
> shouldn’t be in any systems. In fact, to the best of our knowledge, 
> BSAFE is the only system in the world that implements it.
> 

Thank you for raising Extended Random. It illustrates an important
point: even a draft can matter if it results in deployment, as appears
to have happened with BSAFE.

As [0] explains, in the BSAFE context the attack cost against TLS drops
from roughly 2^31 to 2^15 when Extended Random is used with Dual_EC.
The authors note that the difference is one of scale. Neither figure is
especially comforting, but one is far cheaper to exploit at scale.

In that light, I would not summarize the drafts discussed in [0],
including Extended Random (see page 18, Section 7), as merely "adding
more (strong) randomness." In the literature, and especially in the
context of PROJECT BULLRUN, that characterization does not capture the
resulting cryptographic weakness.

> See also: https://mailarchive.ietf.org/arch/msg/tls/ 
> rc3VjZTlBR08PmwtCECUD9-VHyw/ which explains what happened from the 
> IETF point of view - a discussion thread you were part of at the 
> time it happened.

I am familiar with that message, and I do not think it resolves the
issue in the way you suggest.

In particular, the claim there that "No one was talking about the
possibility of the additional public random values disclosing the state
of a random number generator with a backdoor" does not sit comfortably
with the public record. By CRYPTO 2007, Shumow and Ferguson had already
publicly presented "On the Possibility of a Back Door in the NIST
SP800-90 Dual Ec Prng," including the core point that if the
relationship between the published points were known, future outputs
could be predicted [1]. More broadly, the possibility of maliciously
subverted cryptography was not some unimaginable concept by 2009; Young
and Yung's kleptography work at Eurocrypt 1997 long predates that period
[2].

> 
> Your staement that "they might be wrong twice" is therefor 
> incorrect.

Once read in context with the proper antecedent, I think my comment is
quite defensible. If you instead want to make the broader claim that the
IETF itself has not been wrong repeatedly in comparable ways, that would
be a different argument, and a surprising claim.

Post-Snowden, Trevor Perrin's Dragonfly criticism and the related CFRG
dispute provide another example of early serious warnings not being
treated carefully enough [3][4][5][6].

All of this remains relevant to the PQ transition, where hybrids should
also be discussed as a risk-management question, and where discussion of
improper influence by states or other powerful actors should not be
treated as off-topic. These are central questions for a transition to
post-quantum cryptography [7][8][9].

If your concern is that I am alleging intentional misconduct by friends
and colleagues at the IETF here, that is not actually my point. The more
troubling possibility is the opposite: an adversary with far greater
resources does not need intent on the inside when ordinary deference,
process habits, and strategic blind spots are sufficient to produce the
desired result.

Kind regards,
Jacob Appelbaum

[0] https://projectbullrun.org/dual-ec/documents/dual-ec-20150731.pdf
[1] https://rump2007.cr.yp.to/15-shumow.pdf
[2] https://link.springer.com/chapter/10.1007/3-540-69053-0_6
[3] https://mailarchive.ietf.org/arch/msg/tls/A_SfHI4BsdAi4miklBs3TvUbu-Y/
[4] https://mailarchive.ietf.org/arch/msg/cfrg/MrJuQocm1iSYHD8ahFDXvp71GWk/
[5] https://www.rfc-editor.org/rfc/rfc7664
[6] https://papers.mathyvanhoef.com/blackhat2019-slides.pdf
[7] https://datatracker.ietf.org/doc/draft-ietf-tls-mlkem/
[8] https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
[9] https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/