IETF Logo Mail Archive

[TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3

Joseph Birr-Pixton <jpixton@gmail.com> Mon, 13 October 2025 19:23 UTC

Return-Path: <jpixton@gmail.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 64E9772A9306 for <tls@mail2.ietf.org>; Mon, 13 Oct 2025 12:23:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ObBSynKcMn0I for <tls@mail2.ietf.org>; Mon, 13 Oct 2025 12:23:20 -0700 (PDT)
Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [IPv6:2a00:1450:4864:20::431]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id DB7F472A92FF for <tls@ietf.org>; Mon, 13 Oct 2025 12:23:20 -0700 (PDT)
Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-3ee15505cdeso3846400f8f.0 for <tls@ietf.org>; Mon, 13 Oct 2025 12:23:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1760383400; x=1760988200; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=yWUM/oqOO3xbmR1Brdw7dJhNZKPfT1jKvZ5B+/NwMhM=; b=aYedOnQ4zwIUQuuv1daRwSpGm//pnYEVMx3r3PLmm9AH2XMoP0WaB39rhSujQjlRKz sbhpMkGZoDHA8V40cb3Yood4JFs9x/ykmkbrQJj22+agGNdSM30kXPj0fYAWqIAsjFsu +dS2HnA2rPTKUwe7n57Op+Tb9s2SBRFswvz8fqIVimo7Cb6IE13CPslvv8b1fW7ittBC wNxh2X8dPru5T/o6ZE88ldSz3kf4YyFwIJeCT44ruQ+/jDdmptQtHjqAXZqHk7L5eq6m oYU9A02IN6UmwUMJIpjQBi2TKBb5h5z5WSfljONNCqs6VZvBxAHQe4lyP0vua/tE9OaG p53g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1760383400; x=1760988200; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=yWUM/oqOO3xbmR1Brdw7dJhNZKPfT1jKvZ5B+/NwMhM=; b=gFPDohosON6JH+lx0bsRJinNW0liu4BvxC+miXYZhVT3jCCawyXXQf55EAbNYx9fvm z22ejc8AJ/39UQWaIlxq88mG3z6s4PgsqmcqPQKxQToZGJPwb5A8mwt5ZYjyTZhGbsCp spr5Eoe/e4T89L+/LI/W5vI1KYFubbJi6IxK66X4ALzGEbSfOFvNAxwI6YyuXR+tJYkn GwviiVtHIy/KfsfsQfhYFJwptkPNmut6In8MdlY+vOYX2HX2ZHwDx+6hKqrS66qQSHfB cwEzo9i4o5Sqzr5DLCSmJzDqlp+Ic//l6gJAZP4Pwbn4631jbkyU5UBEs65yAVvbtnkU l8Vg==
X-Gm-Message-State: AOJu0YxDHABWroJDx3jYsX9QX0nfd2Hp2VyUSbpqj3sqtmsGJDKyTAjC jYxt0/7GBeOUGnO/JLyDVvSqRe2t7PhlEUV1S8JSR5Gyk1mdnG2PhY4y/NTS7WZ4hBQjjGF9K/A CwedpyDYryHKC3zfcx8uFlIlT/jp7jpy7zv3p
X-Gm-Gg: ASbGncuiZxRvxuEEj8e92ASC7UwZTQPGPQLa1CJPALyawlXkWo7m2qJD2ANLikx3GNP YYTbigIW37UbjmDOzBe2F4MUCRkhgJAJaH6Ntty8ljWA0+CIPeZbp5PZ0ZFmQSPT5fCg9B0+h2u NF36KN2BJGPyqopZOR0fqUvtKGq+iWvBqZ4PwCgyRawqIbhdDQKaS/b+jbxjqJwGvDqHivLxThT KUvV0yOos+mNQWuczv0FUEYaw==
X-Google-Smtp-Source: AGHT+IGqdMNLNTOnLIfhVTD0q35yjmimZmy+DgdCMOL/Qjl81w5mBLivEbEscBVLaWrmJ1ymLBBu+HCoUiEoXcLT1qc=
X-Received: by 2002:a05:6000:2c04:b0:3e9:54d1:e708 with SMTP id ffacd0b85a97d-4266e7c7cc6mr13888420f8f.20.1760383399660; Mon, 13 Oct 2025 12:23:19 -0700 (PDT)
MIME-Version: 1.0
References: <CAOgPGoA+c8kXDizwsvFG5tLz9+Kxk0HqiN1skKp5jMvvpxeu0Q@mail.gmail.com>
In-Reply-To: <CAOgPGoA+c8kXDizwsvFG5tLz9+Kxk0HqiN1skKp5jMvvpxeu0Q@mail.gmail.com>
From: Joseph Birr-Pixton <jpixton@gmail.com>
Date: Mon, 13 Oct 2025 20:22:43 +0100
X-Gm-Features: AS18NWAIzK0sIg-Si7iKW3XKF36dw5Ri8buxGpwHYP9XMx5mE5OpDvYuFBh0yQE
Message-ID: <CACaGAp=6RFV++swtRNzo=Y9KWaD-KOz4Wfwn_aK86N-N7iKvkA@mail.gmail.com>
To: Joseph Salowey <joe@salowey.net>
Content-Type: multipart/alternative; boundary="00000000000034926706410f331c"
Message-ID-Hash: 4II5WPHHI5WTDQLCGKRE5R6BPOPNVYQ2
X-Message-ID-Hash: 4II5WPHHI5WTDQLCGKRE5R6BPOPNVYQ2
X-MailFrom: jpixton@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "<tls@ietf.org>" <tls@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/vZ2BDFDfjJef3lowqYBzEwbD0zk>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hello,

I think this is ready for publication and should not be further delayed.

In my view the question of whether X25519MLKEM768 should be Recommended=Y
is an inconsequential one. In my opinion, the TLS WG has a storied
tradition of choosing atrocious MTI and recommended algorithms, and
departing from that at this point is likely to cause confusion. I would
prefer it if the WG stopped doing that altogether, but I doubt that is a
view shared by others. However, I think having a Recommended=N algorithm
nonetheless now used for a third of web traffic is saying
something unflattering about the value added here.

Thanks,
Joe

On Tue, 7 Oct 2025 at 14:47, Joseph Salowey <joe@salowey.net> wrote:

> This is the working group last call for Post-quantum hybrid ECDHE-MLKEM
> Key Agreement for TLSv1.3. Please review draft-ietf-tls-ecdhe-mlkem [1] and
> reply to this thread indicating if you think it is ready for publication or
> not.  If you do not think it is ready please indicate why.  This call will
> end on October 22, 2025.
>
> Please note that during the WG adoption call, Dan Bernstein pointed out
> some potential IPR (see [2]), but no IPR disclosure has been made in
> accordance with BCP 79.  Additional information is provided here; see [3].
>
> BCP 79 makes this important point:
>
>  (b) The IETF, following normal processes, can decide to use
>    technology for which IPR disclosures have been made if it decides
>    that such a use is warranted.
>
> WG members can take this information into account during the working group
> last call.
>
> Reminder:  This working group last call has nothing to do with picking the
> mandatory-to-implement cipher suites in TLS.
>
> Cheers,
> Joe & Sean
>
> [1] https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
> [2] https://mailarchive.ietf.org/arch/msg/tls/mt4_p95NZv8duZIJvJPdZV90-ZU/
> [3]
> https://mailarchive.ietf.org/arch/msg/spasm/GKFhHfBeCgf8hQQvhUcyOJ6M-kI/
>
> _______________________________________________
> TLS mailing list -- tls@ietf.org
> To unsubscribe send an email to tls-leave@ietf.org
>

v2.35.0 | Report a Bug | By Email | System Status