IETF Logo Mail Archive

[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2026-02-27)

Nadim Kobeissi <nadim@symbolic.software> Sat, 21 February 2026 10:28 UTC

Return-Path: <nadim@symbolic.software>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 9FF84BB2B906 for <tls@mail2.ietf.org>; Sat, 21 Feb 2026 02:28:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.798
X-Spam-Level:
X-Spam-Status: No, score=-2.798 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=symbolic.software header.b="HekTLBYr"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="msMnhgrP"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z0DJBjrFMqC7 for <tls@mail2.ietf.org>; Sat, 21 Feb 2026 02:28:59 -0800 (PST)
Received: from fhigh-b3-smtp.messagingengine.com (fhigh-b3-smtp.messagingengine.com [202.12.124.154]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 07E57BB2B8FF for <tls@ietf.org>; Sat, 21 Feb 2026 02:28:59 -0800 (PST)
Received: from phl-compute-07.internal (phl-compute-07.internal [10.202.2.47]) by mailfhigh.stl.internal (Postfix) with ESMTP id AEF7C7A00F4; Sat, 21 Feb 2026 05:28:53 -0500 (EST)
Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-07.internal (MEProxy); Sat, 21 Feb 2026 05:28:53 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= symbolic.software; h=cc:cc:content-type:content-type:date:date :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm1; t=1771669733; x=1771756133; bh=hGHGwVR1RGbqdL84wrLNB8gE423Lj/c8KpzBlrqVyP4=; b= HekTLBYrhxIvE2cd9GI1fcjtBngHDA77oVNut97jkHQvM3aNhYHQNEEgM3oTUZDK 5pSMPxfsqT+/C6qXOJaLUMV5f1S6FyJQfXKoIgKElug66UC0YTg99pv9J/xSYY6G AbFLr5O/XF21fekLKoi/ylWiCctQd6ypLlWuxcW6BHrMNwutMRH8y6NamU99/L8x bxphSbz6xCeVbwpscVQZ+qzxez8QM289zZxsjOZu2t+oS0uTMp4/m8WPtXqXnd33 j9PYv1VJ4Qf8A1yhXjEByi2jtt4rxIylea2rRckCkRcc9ut0UZv8t7G7HR6lvzRq 8GkCJms3OdEOtYtZqhq3Sw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t= 1771669733; x=1771756133; bh=hGHGwVR1RGbqdL84wrLNB8gE423Lj/c8Kpz BlrqVyP4=; b=msMnhgrPBzMnihhMIXWm1t1kx3qFtZOo5O9ZKUxeV4sY5zx2Y5E S5NHRSM5gjBN9LeLYf3FeP64PcHreSAwrtzbTKBv1QPViCGv38gIaYhkHX+aaRW5 WaDd16JyJ3YM3ccQBQo2eTEsfDnS47tPRBk3X7KAxJc+rM1zSVLa481Pq2Aik95C jU5m/xjV8IsOb8R45ggn0nf5NnIq8FB/BWoN6kIKlkC81cwg4lq6H71Z9oL/QV3H roZl1pKWBfo/0/TLFbjqqxERaOdxaiRcRvN/BO+C2NAAtuy2fmBUjOjgOIaT1k1D mXoFnpS3nQu9QZuDNpMbbPBNZQdNwzPnx/w==
X-ME-Sender: <xms:5YiZafzIwJ9sOwS9mH4jpLUEBkC5ae31gRNx962yjqnDEQ1RMsP5Zw> <xme:5YiZadSai-JmT_9v_cVl0LwpK6bz4mo0KQKAvv2FfW_z0JGfKjIWjeQEykJpu58Oh NmuMPEn7-n3ot4uP2_G-PSWIQAI50n3imLZm-QDZZhuEyCN040m_A>
X-ME-Received: <xmr:5YiZaW9aRKqvmcUCCKunl10AlbFg3TOIwGVxjYQGAPXDX8yKVH4FY25QHILUt7txYL-0kPhVlASFCfUuyVTKFXg_zoikQ9S_1RATkBuhUuT_e0ey84hlV39Wrg>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefgedrtddtgddvfeduudduucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfurfetoffkrfgpnffqhgenuceu rghilhhouhhtmecufedttdenucenucfjughrpefhkfgtggfuffgjvefvfhfosegrtdhmre hhtdejnecuhfhrohhmpefprgguihhmucfmohgsvghishhsihcuoehnrgguihhmsehshihm sgholhhitgdrshhofhhtfigrrhgvqeenucggtffrrghtthgvrhhnpeefgfevkeeukedtvd dvvddtfeegvdefvefgudduffevgfffgfdtfeehffelffetfeenucffohhmrghinhepihgv thhfrdhorhhgpdhshihmsgholhhitgdrshhofhhtfigrrhgvnecuvehluhhsthgvrhfuih iivgeptdenucfrrghrrghmpehmrghilhhfrhhomhepnhgrughimhesshihmhgsohhlihgt rdhsohhfthifrghrvgdpnhgspghrtghpthhtohepvddpmhhouggvpehsmhhtphhouhhtpd hrtghpthhtohepphgruhhlpeegtdhnohhhrghtshdrtggrsegumhgrrhgtrdhivghtfhdr ohhrghdprhgtphhtthhopehtlhhssehivghtfhdrohhrgh
X-ME-Proxy: <xmx:5YiZaUqEiLA8TmRo0YJB3TCOHrDlt6L13cYaLE5VFVu2a3kzXkQwKA> <xmx:5YiZaTlN-do_0rS97gxl_RyIVl3ds0r0yM3FmsHJOpdPtkEYZhFS8A> <xmx:5YiZabICq3MIqUaDtcqfaqulNELrVDYVHADhwXKwT25kJsQK1kzJJg> <xmx:5YiZaYzE6JdPHgqjKCEikyWktIIsMId9GKV4uA_g_NiTgRNxMIG6Pg> <xmx:5YiZad9mdRuZi0PciI2pDNN_x2pBG9qn7-Ik17Gd8cqNjttjd3ZGso1x>
Feedback-ID: i6d3949ed:Fastmail
Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sat, 21 Feb 2026 05:28:52 -0500 (EST)
From: Nadim Kobeissi <nadim@symbolic.software>
Message-Id: <971672FF-31BE-47C4-A478-8FEB60DE3F7A@symbolic.software>
Content-Type: multipart/alternative; boundary="Apple-Mail=_F4DBFB4F-735D-4A9C-9FE1-E637364A7D15"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.400.21\))
Date: Sat, 21 Feb 2026 11:28:51 +0100
In-Reply-To: <9b71e709-69a3-f3d9-4cbd-d4d521556c55@nohats.ca>
To: Paul Wouters <paul=40nohats.ca@dmarc.ietf.org>
References: <20260218194044.1135896.qmail@cr.yp.to> <7C9C99AA-42B0-4BC7-8F41-39F35754F1C4@vigilsec.com> <MN2PR17MB40310F0A2891942D76C43E60CD6BA@MN2PR17MB4031.namprd17.prod.outlook.com> <2caab265-00ba-4078-b6d0-3a178dabaa61@tu-dresden.de> <CAEEbLAbkV4YxN7cgggckpEp24MLtRZpzs6M4KemBatpzCCcs0A@mail.gmail.com> <MEAPR01MB3654415F735DE96CEE239C78EE68A@MEAPR01MB3654.ausprd01.prod.outlook.com> <aZfbhrFDBp7a0xHL@chardros.imrryr.org> <EB48AB24-A1A2-47C8-9C2C-47C93B9320E7@thomwiggers.nl> <93af0689-4bd3-4f6b-afaf-41869d27fa4d@app.fastmail.com> <CAMtubr3QcHbiP5guhBoiFbFh8tKSD6WNHBJkxxb_AM4Wy5i0=g@mail.gmail.com> <9b71e709-69a3-f3d9-4cbd-d4d521556c55@nohats.ca>
X-Mailer: Apple Mail (2.3864.400.21)
Message-ID-Hash: QN5JM62NKJ3NAM73V7SJDTGYAU35LAJE
X-Message-ID-Hash: QN5JM62NKJ3NAM73V7SJDTGYAU35LAJE
X-MailFrom: nadim@symbolic.software
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: tls@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2026-02-27)
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/BROjzM1l30g8MLhfWLIV_CPVdWY>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hi Paul,

You write:

> We already had a WGLC on this document [1] and the conclusion [2] was
> that it passed WGLC provided some clarifying text would be added that
> stated that for the general use case, hybrids were preferred.


I just had a look at [2] and to my surprise, it didn’t seem to match your description. What [2] seems to show was that the chairs decided that there was no consensus. Quoting:

> The working group last call for pure ML-KEM has concluded, thanks to those
> that participated in the discussion. In summary, we do not have consensus
> to publish the document as is.
> […]
> Given this, the chairs will move the document back to the "WG Document"
> state and ask the author to work on resolving the issues brought up on the
> list including text to address concerns that there are reasons to prefer
> hybrid over the pure approach. The chairs will then redo a working group
> last call to see if there is rough consensus for publishing this document.

I am very confused. You say that [2] showed that it passed WGLC provided that some clarifying text would be added. Absolutely none of this is reflected in [2]. Instead, what [2] shows is an explicit admission of the lack of any consensus to publish the document, and the document being moved back to a “WG Document” state.

Could you please clarify this rather large discrepancy between your description of [2] and what [2] actually appears to say?

Thank you,

[2] https://mailarchive.ietf.org/arch/msg/tls/Gc6KVPrVHn-QCkeEcvJ_qtRcFxY/

Nadim Kobeissi
Symbolic Software • https://symbolic.software

> On 20 Feb 2026, at 4:00 PM, Paul Wouters <paul=40nohats.ca@dmarc.ietf.org> wrote:
> 
> 
> [ AD hat on ]
> 
> All,
> 
> I want to remind people that the goal of this 2nd WGLC is to focus on
> the new text changed in responds to the conclusion of the 1st WGLC.
> 
> We already had a WGLC on this document [1] and the conclusion [2] was
> that it passed WGLC provided some clarifying text would be added that
> stated that for the general use case, hybrids were preferred. This
> 2nd WGLC is about that topic.
> 
> There is an appeal chain that got muddled by the inappropriate use of
> derivative clauses that is still in progress, but so far yielded the AD
> statement [3] that confirmed the WG Chairs view that the consensus call
> passed. There is an appeal with the IESG [4] on that decision, and this
> document will not be placed in the RFC Editor queue until that appeal has
> concluded, but will also not stop all processing while the appeal runs.
> 
> This 2nd WGLC is meant to get those people who provisionally said "yes"
> to publication of this document pending some extra text, to review this
> text and let us know if that resolves the conditional part of their
> "yes" statement. The text changes to discuss can be seen at:
> 
> https://author-tools.ietf.org/iddiff?url1=draft-ietf-tls-mlkem-05&url2=draft-ietf-tls-mlkem-07&difftype=--html
> 
> 
> I understand this is a heated topic. I am also not hearing from people
> that they have changed their opinion on whether or not to publish this
> document at all. Confirming your views are fine, but again, that is not
> the goal of this 2nd WGLC. It would be helpful if, especially those
> people who wanted additional clarifying text, to give us feedback on
> this. And ideally, offer up suggestions that would address any still
> outstanding issues.
> 
> Thanks,
> 
> Paul
> 
> [1] https://mailarchive.ietf.org/arch/msg/tls/Pzdox1sDDG36q19PWDVPghsiyXA/
> [2] https://mailarchive.ietf.org/arch/msg/tls/Gc6KVPrVHn-QCkeEcvJ_qtRcFxY/
> [3] https://mailarchive.ietf.org/arch/msg/tls/dzPT8KQe4S-_pZROLUJMvS9pM0M/
> [4] https://datatracker.ietf.org/group/iesg/appeals/artifact/230
> 
> _______________________________________________
> TLS mailing list -- tls@ietf.org
> To unsubscribe send an email to tls-leave@ietf.org

v2.39.1 | Report a Bug | By Email | System Status