[TLS] Re: Working Group Last Call for Post-quantum Hybrid ECDHE-MLKEM Key Agreement for TLSv1.3

[Eric Rescorla <[e-mail]>]

On Mon, Oct 13, 2025 at 8:53 AM Simon Josefsson <[e-mail]> wrote:

> Eric Rescorla <[e-mail]> writes:
>
> > The current document has Recommended=N for *all* the algorithms. Above, I
> > proposed changing them to Y, which would also entail changing the
> document
> > to be Proposed Standard. We've now heard a number of counterproposals,
> > including (1) leave as-is (2) just mark X25519 Y (3) take out the NIST
> > curves.
> >
> > At this point it's not clear to me that any of these has consensus, so
> that
> > chairs need to work that out. However, given that there have been a
> number
> > of objections to (3), I doubt very much that that would pass WGLC (and I,
> > at least, would object to it.).
>
> Do you have any technical argument against separating the widely
> deployed X25519MLKEM768 (which I believe ought to be
> StandardsTrack/Recommended=Y) from the more marginal NIST curves (which
> I believe are more appropriate as Informational/Recommended=N)?
>

You may or may not feel that this is a technical argument, but
P-256 and P-384 on their own are both Recommended=Y
and we are in the process of publishing RFC 8446-bis, which
actually has P-256 as the MTI, and I think being consistent
with both of these is good.

-Ekr