[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Sean Turner <[e-mail]>]

Replying to the original consensus call message.

RFC 2418 Section 3.3 lays out the criteria for “rough consensus”:

   Working groups make decisions through a "rough consensus" process.
   IETF consensus does not require that all participants agree although
   this is, of course, preferred.  In general, the dominant view of the
   working group shall prevail.  (However, it must be noted that
   "dominance" is not to be determined on the basis of volume or
   persistence, but rather a more general sense of agreement.) Consensus
   can be determined by a show of hands, humming, or any other means on
   which the WG agrees (by rough consensus, of course).  Note that 51%
   of the working group does not qualify as "rough consensus" and 99% is
   better than rough.  It is up to the Chair to determine if rough
   consensus has been reached.

In this case, during WGLC there was an almost 4:1 ratio for progressing this draft, which we judge fits within the numeric “more than 51% and less than 99%” range suggested by this text for “rough consensus” and represents the “dominant view of the working group”.

In assessing rough consensus, we also considered the nature of the objections. In reviewing the list traffic, the majority of objections related to the status of pure MLDSA versus composite MLDSA-ECC, including (1) we should not publish a pure MLDSA specification at all; (2) we should recommend composites over pure MLDSA; (3) we should publish the composite and pure MLDSA specifications concurrently. While there was substantial disagreement on these points, we believe that the discussion on-list sufficiently aired the respective points of view and that the right approach is fundamentally a judgement call based on weighing various technical factors, which each WG participant needs to make for themselves. We see no reason to believe that participants were not able to make informed judgements.

Conclusion: The chairs believe there is consensus to proceed with publication of this draft as an RFC with Recommended=N for those people that want to use this algorithm, and a future Standards Action will be needed to make a change to Recommended=Y, if anyone has the willingness to undergo this heated discussion again.

For transparency purposes, the chairs note that we received a complaint/appeal about the consensus call. The message was moderated due to a previous notice of moderation; see [1], and the complaint/appeal contains a derivative work notice. As a result, the message was not sent to the mail list and we will not process the complaint/appeal as-is. If the message is resubmitted without the notice, the message can be posted to the mail list and we will process the complaint/appeal.

The Chairs,
Deirdre, Joe, and Sean

[1] https://mailarchive.ietf.org/arch/msg/tls/no0lW8r_wIPGF1ZXWB3EaGywh9Q/

> On Apr 28, 2026, at 16:24, Sean Turner <[e-mail]> wrote:
> 
> Hi! The chairs have judged that there is consensus to progress this I-D. We will work with the authors to get a new version submitted and we will get to work on the Shepherd Write-Up.
> 
> The Chairs,
> Deirdre, Joe, and Sean
> 
>> On Apr 9, 2026, at 15:30, Sean Turner <[e-mail]> wrote:
>> 
>> This is the working group last call for Use of ML-DSA in TLS 1.3. Please review draft-ietf-tls-mldsa [1] and reply to this thread indicating if you think it is ready for publication or not. If you do not think it is ready please indicate why. This call will end on April 23, 2026.
>> 
>> REMINDER: If you have not done so recently, review the TLS WG's Mail List Procedures; see [2].
>> 
>> The Chairs,
>> Deirdre, Joe, and Sean
>> 
>> [1] https://datatracker.ietf.org/doc/draft-ietf-tls-mldsa/
>> [2] https://mailarchive.ietf.org/arch/msg/tls/ucdImHExlbOf4Q3BCG81gjzi2xE/
>