[TLS] Re: WG Adoption Call for ML-KEM Post-Quantum Key Agreement for TLS 1.3

[Paul Wouters <[e-mail]>]

On Thu, 17 Apr 2025, Bellebaum, Thomas wrote:

>> My previous email explained the obvious way the consensus was validly called. This
>> can be independently verified by anyone reading the email thread. The
>> fact that you are the only one questioning the consensus should be an
>> indication that your reasoning to doubt the consensus call might in fact
>> be erroneous.
>
> He is not the only one.

> This amounts to about every fourth person objecting the draft in its current state at this time

Note that the consensus call was for Working Group Adoption. Not publishing as is.

> Going forward with the new WG item, here is my current wishlist:
>
> - Much discussion stems from an insufficient understanding of the considerations leading so many to believe that pure-PQ algorithms are the better choice compared to hybrids, be that harsh requirements ("users that need to be fully post-quantum" -> Why? Regulations?) or implementation considerations (e.g. "minimalist code base"). Please collect and document them (preferably inside the document) so that we can reason about concrete requirements and applications rather than hearsay and hypotheticals.
> - Give some guidance to implementations as to whether or not this should be implemented and/or available at runtime. Is this just for those with special considerations mentioned above? If so, consider recommended=D or Experimental to convey this. Or is this for general purpose use by all sorts of applications? If so, document how the considerations above apply to them and discuss the relation to hybrid constructions.

This sounds like you are not objecting to adoption, but objecting only
to publication as is? No consensus call for moving this document forward
as is (eg WGLC) has been requested for this document yet. It is expected
to be discussed in the WG, and I encourage everyone to propose text to
improve the document.

Paul