IETF Logo Mail Archive

[TLS] Re: [EXT] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2026-02-27)

"Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu> Fri, 20 February 2026 05:25 UTC

Return-Path: <prvs=8511e8c3ff=uri@ll.mit.edu>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id DF9F6BA42E3F for <tls@mail2.ietf.org>; Thu, 19 Feb 2026 21:25:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.297
X-Spam-Level:
X-Spam-Status: No, score=-4.297 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=ll.mit.edu
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xbaRnDWCfAuQ for <tls@mail2.ietf.org>; Thu, 19 Feb 2026 21:25:06 -0800 (PST)
Received: from MX2.LL.MIT.EDU (mx2.ll.mit.edu [129.55.12.51]) by mail2.ietf.org (Postfix) with ESMTP id 56688BA42E35 for <tls@ietf.org>; Thu, 19 Feb 2026 21:25:06 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ll.mit.edu; h=content-type : date : from : in-reply-to : message-id : mime-version : references : subject : to; s=dkim1; bh=eDoGoGDRUIPU6OfQjs7c1l4u2VpYdeRzZdpxLplCpfM=; b=GV/Ayh1sAFyS0zySGES5Ts+fyPOjR9DWDL6XDGpkULW9mdGuOWROj1/ucEGNDXAc8uKk nSjl2FgU6TnSlI4PPY+ttGvXmiyo9NqApcSLy4pcBDaBM31sLGx8napTT+YcbeVjNaIg +buYxDi/aqlAdEcjphDNd/f1WlcMJ59YBObWCFwx3PCCerz9r1Cqn7nhPhY9/1iSUtiW DfTEVX81jbqePi0VSKjXiURK4JERyejd++cxwQtV60G22hu865jCjpFspS3YXyy1g5SI ArIZnjagcdT//kAoQy+F89uaoGZCZTZCfSSfwtxhdH0Cde2B9DyKNTs5AQftS2P3GFky qg==
Received: from LLEX2019-03.mitll.ad.local (llex2019-03.llan.ll.mit.edu [172.25.4.99]) by MX2.LL.MIT.EDU (8.18.1.2/8.18.1.2) with ESMTPS id 61K5P5l5065146 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Fri, 20 Feb 2026 00:25:05 -0500
ARC-Seal: i=1; a=rsa-sha256; s=arcselector5401; d=microsoft.com; cv=none; b=EN7yRHZQyfBvOzRdZBrtv0p6Ck5mHHsegs1DFfkfDwKUc2GmvDZNAbFW+BTv4P4+rWyQ0VP0CgxoUhGEn0PnNgysdGccPa7bXJ4bkK0NXmK1+CF5M2yICzIavlWd2u+CeR+WUpcwZTObjBT+s7WNoyLWLGbrz20i8F/HNhHSEthHW9pl5r/mu5ys9s0h83JsqrKH5MWAYmxnVpj8V0cjfvkXvs3SCoqeTsStARszBCKWcd0kRq9WnDQzuUyx0ZTcWUeEiS7XIc9KF0oxMLfQ88RnsD6M5KBV9HbAid/phpkB+4nqzaZBZ/Whscp1XzLZ2QRWI/PDw2ZVn3jYTZzB1w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector5401; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BGHtyI5/iaua6a6AlYz7x4YqA+oZIIEbFRdwW+5n158=; b=FDMyLtHm1CzJiBjZVPHpzcefPp7nnvp85Zcd94igRfNnOnOnC/t0j5wG6feSoerQiWmcMx1cLhx1s9lXUefnYT9dT505WAuczV8OtTM+vQ62clDWKADe09lXe68bp63Yuhb2h5/TA1hZnR2l5iNGq+KcU1/MKSZ+BZTQ9oP5xjXU+OoCkpZDV15ZlFbYRMwpfs2UqktY7K8LKsr4/E4JfhnJd/VTluFTXfnQylrwnaOyE1fmsBPbfVp+Rx79/pLj/hKiFyq8z2d0Qznro2bgfeXNSu9qSNg06igY0UnPD0qxu/DTghdH6V2VSpcHd02DDxCyQsIwFlkSZDw3b5h7Kg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ll.mit.edu; dmarc=pass action=none header.from=ll.mit.edu; dkim=pass header.d=ll.mit.edu; arc=none
From: "Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu>
To: Izzy Grosof <izzy.grosof@northwestern.edu>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [EXT] [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2026-02-27)
Thread-Index: AQHcoiKcIPjcFObJJ0W2izD7vQRQsbWLAgUt
Date: Fri, 20 Feb 2026 05:24:42 +0000
Message-ID: <BN0P110MB1419070CED63E8566EAA540F9068A@BN0P110MB1419.NAMP110.PROD.OUTLOOK.COM>
References: <4f0a9258-8d66-4573-a0b6-2f35e03972d7@email.android.com>
In-Reply-To: <4f0a9258-8d66-4573-a0b6-2f35e03972d7@email.android.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-ms-reactions: allow
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: BN0P110MB1419:EE_|PH3P110MB2152:EE_
x-ms-office365-filtering-correlation-id: 055a4956-da06-40cd-875e-08de70406489
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;ARA:13230040|366016|1800799024|6049299003|4053099003|8096899003|38070700021;
x-microsoft-antispam-message-info: Y/bqjNsOHVRTKgiLXrUWcesluKz4/1pKWxo2p+g/XrXRwBHpTSq7A7LJFTlyGgQtV2AsyLOs2W8HlJ6elJ5z4EuVsppW9Q2kXY8/pHzrCXyv/o9YxwHKRiFGmuBvkzezlupyzaGd5qPzWGtt36f7EfnBUyis5vhzOQ5g3iNYsD1v02oSFhxFiJ8JprrKg+WJPFvMHYa25EGaSvtpynVWjPbHxv8O+DehBcxVKT0KGFquLQCzMRvtc3/9MlV3v0+eh4tqih5vDjtOk+PXO7V5e4J2Y9oGhXzc0fYEyyJFxu2W2SbXTl86Z/kZNzpi/TIBPfzYI0bNEr9QLf00aaIf1qMI8wmeZ+j0NXS5zyG1rgoZ2l9mzuIc1NUrKQORDA1VHaBXaE2k1b/LoMlsmiDGvLoKL9yLXZaGiTpZzwaQvuAVxtdb9i+pm2tsD+0//1Qg2BMINmY0q67pzQbTfVHcwxtMiauSTWasU8FmRkaUlHyvT1zdbZBNFFTNLi6S8a9uL2t6+DrNEy7cXuasd3t7OxM/kUpIyr3LLyCzSPhxyqsMwF++KQke7n6/gT5g7nkralf4F6uAXzQkXgYDZlbUo7ZGAeyqbV0uYACnBqUh4UTo28MOUdGRQPfUpVqH1xwhT0+GxrUCng5m3NbNqg2qUZ2xCkzDJpFwoKSkvq+lsyUgoLOuKSyPBZZKm8Dkm3ZjnRmyFytKC5vEK36x2JG/WIog+NfRl8h1IjavdlEfigcHZIDzBb4LgrlOVEIg/HUumcmfisp0W4mTo5JVEcdqbWnqeeOYLwzip7yAm6UeO1UrLYmCPS4Fh6Fbq02f9G/e0/UUt63d5LqwIxUF8Zq7crMMK7NXTcH5Dpa2yxkld9kBknYcgZ0SmQPsH1tFeniF+3BwEOUTLmNouG2CVB9V+z/4UXLLHbKufTzAY1uiguKXURKdXH55feb/wxXnsQlARRi+jl13Cl5X8tIiYmF71cgIV1tDPd82V/hqiC7GDfm4wFIzOAW1sJQeRn2jf9QPGTZbkq4lP44HeqimUrX+h4DDrzNWQORijGJzlwo3M3tAPIQ1UNzVUIy1ijOD1hl7voYuTCxo6vbNV9CMX9apkMt8eyck3t1cPQvE6YtnkidUdxpE1COHsGSRM31A7C79kAlBn6c7KgHpBjIUT6zQCfNNc/XTZmIsoHIp1+DjZFP7lV65JkMJZhPJ74crmXaRolsVj2X1FHJNHKAGDqjioPhjPqetCOgY6uPiCwogjhSJ7/GVd6ueqH6vVJ1qjTeRwl2vZ1wGU9fFsrWTpcoEFRA7UqY+jC2SKNFjsQjNSoa0Z+E0Gwl2PdRQF0jL27lbWk5rm007FMICj9cTI2JALEnYo6yNMLS873In8g0nFq7M3NLYHZHFHXUlB31kVd4fw3w0IzUjPuKFmtH9NIlQcV4ASyTAbDC0AwxfoH7xvAkbmBQ7UC1MHeK6sZ2jkDXIWt9700lLCZ+tPAwxMQz4tEwOMB4EPBeNytioz2RabSDG53fpIsnDDbO9nVSr1ik6pmdrFKZbMD+nl38kEBSOFjSe9K11BR7Zz+vxWTCyuuc=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN0P110MB1419.NAMP110.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(6049299003)(4053099003)(8096899003)(38070700021);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: /d3Mv5kWr97tpBJAc8n9lYKQ9VrSe8OZDtGPYh+8TOhzNb4AI3kaSTb9Ug21D5AkKRItVyzCjJzPD72oBiCjpBUkzkkmu1cSbxklg+pGo5vXtkJHDJH6ZW/INIX/VzQ2JXTk3JapVw9hNCCKLOzilQ8SyMrJmNMpDlV41TU3UZ3fpjksKodhlL0Vsl8oJryb9HdXMmqIU1ty86iJbRLC7ttUUPQkC+6fXnho5dzneUD3GxGiGFNexGBRiKLOq66UFiWpdReMs0UxwNaSH2rRckhoA0AMWr+95wIVcmYioB/rFK7xhSFk+6GoeJgYXuad/1ErfNmSx3Mrv97MJQjBAHeuJ58EKNaEu9NYcLStCDrD+xuOkzDsNr7yYEDfNfiHE1LPpD+I6wTwbsvCJsmrBgRYzIRCLfD5L8T61hsRdVgVDE7+UZAZ8N7s+ICl3UXWxFOU+DmLBbrnwOaiR7S+8s+afCZvvwbWYU6FINE+O9e/+g7JEGWus8FvEz9qQ+6V2/v8UmgpLhE1YOLB30T2zp5y1TuVYqQyw433+4kx1Mw/5EoohWKeunx4cfTGG0jBxh44spfotPhzqzxRUext3Tp0/kcw+D8QObN5W4YUkuKDi+I5EwwG8nb7RJAMdNpiTRkfTw7H8cSYSgZsPraLicW6UtXsp+sKMHoeSfYlZhE20YMX3kWdySenWzONxFVAS8DzPNqbH3/m2VfPbfaD/JUbl/6bBZlIOfcNJnao5oBIlsBLoDLYODjsijtV467aiew+8WOJNYVlSJoZDDe5B2JpR11cQVFR5EUCV1EtsuGVib7pHIKqOmkMtHsVYSpqaHFdRhsKONzny8cDmAQhOqrb6ZqIg6H1cHUCSYz17W/deQ4XTMMN+/h1hcEOXFoLoAY63BGdmwtPE4UuBMgDkBEsbpg2as3Wmf7tyQbUXikc5sY3gn9xapk8t+I1tb9vkF2zjOU8vflOZLxQS1a/3nx9RSreJfVEGhfCe1werG8tIpAv/yMabBUqvK81MMtKITKy9pEwMhHR6/oJhnn3xpd8L//azRLq+/SAqUiDl5mlM1movcVUSKxL3IJ0HNmRdVGTgxMAXDigbYtBGnd+SLVKboH7Z7lgKXTfZeE+H/EBJ1RUW4+OA3zNCbYmnnxHfeLVd7xpEZAInN0mkXCtYj84ewBgXOexb0KpTQGqzwIfOp8JifQq+4tL1epQW4BQ/+1y3n50kIGcgG+bfwMJlHlTuzv7UjegCmn4dGaus0d1iseCxzsrqDVcssn342p41zsJhqMHR9ViozCJzLWaxZvbt9BuWDwkP6iRfJZG6RTpiIBBEetUb/xz0DYQ0YiEtUsfTT3FS4FcPuFWFkWtwoZ2kJUcgKesK8Tyh/zehZM3lDfbCOCWzViliX/GIkh0IV6eiy5vZlByCPv4nsKw8ojKlS38ZydqTUDkt/WzvBych7L7rNfn4T+Ubs0hu5A/nFq+MXgdfTbYaKeTJXDQx8O0GSoD2CskUXh2e8DRGCE=
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha256"; boundary="_44A58845-4AFC-9747-9F26-CB13FBDDDC00_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN0P110MB1419.NAMP110.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 055a4956-da06-40cd-875e-08de70406489
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Feb 2026 05:24:59.9609 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 83d1efe3-698e-4819-911b-0a8fbe79d01c
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH3P110MB2152
X-Proofpoint-ORIG-GUID: tVC44LXmz0-TUmRH_RWlpbnvlCBNTRnk
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMjIwMDA0MyBTYWx0ZWRfXzql54HCuzx2B hOuJ+CF2mqofWl4YNwhflyolzb08SE9DGVyh3k8vg68Qzv6WfKRSwzUB+i/nrh3dZaDOSqswAWd GftrxuPcEWXSJoPLABjMu40g8IgnRnXsacAd3Hrqy0Xwmvm4bktxCM27R8D8MD1VYfaC0rxLn1A Y9mujvSpUcuuH6JFuTpWvODR0/NWOzAb4RK/wGvmtploqQ/vQiiT/lV99NsBbhck71HEe3OeGCC 7DxANvv+ocASllqQYfU0DkS3kNGkqedAc0irTsEHU+qrv/+5IhUQ==
X-Proofpoint-GUID: tVC44LXmz0-TUmRH_RWlpbnvlCBNTRnk
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-02-19_06,2026-02-19_03,2025-10-01_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 mlxlogscore=999 phishscore=0 malwarescore=0 mlxscore=0 spamscore=0 suspectscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2602130000 definitions=main-2602200043
Message-ID-Hash: A7HKAOHQYLKNI2IZPDN5YNEIP3NBTE4H
X-Message-ID-Hash: A7HKAOHQYLKNI2IZPDN5YNEIP3NBTE4H
X-MailFrom: prvs=8511e8c3ff=uri@ll.mit.edu
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: [EXT] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2026-02-27)
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/Jkq-0wjf3cj-jyoPOh9FflioyxI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

> I would like to register my strong objection to this working group promoting 
> the use of non-hybrid ML-KEM in any way, or any other non-hybrid
> post-quantum cryptosystem. 


I would like to register my strong disagreement with the above position. And register support for allowing the use of “pure”, aka non-hybrid ML-KEM (and other non-hybrid PQ cryptosystems).


Among the reasons — since the goal of PQC is protecting data with long-term value — protection given by the Classic part of the hybrid is meaningless against the threat of “Record Now, Decrypt Later”. Confidentiality of the recorded-now sensitive data relies solely on the PQ part of the hybrid.


The only use case when hybrid adds anything meaningful, is if your data value is short-lived, so it is not likely to be exposed to CRQC — so, Classic alone would suffice, and adding PQ KEM doesn’t hurt.


The only situation when hybrid could make sense for a "long-term” data is if:



1. Crypto-Relevant Quantum Computer does not materialize; and
2. PQ algorithm falls to a Classic attack; and
3. Classic algorithm remains unbroken.



> The correct course of action is to recommend against such an ill-advised decision,


That’s a matter of opinion. I consider your recommendation ill-advised, for reasons stated above.


> The performance improvements of a non-hybrid approach are trifling;


Correct. Though this depends on the use case — some would welcome the speedup of Lattice-based crypto over ECC.
But this is not about the extra computations required for hybrid.


> the security risks are immense,


Simply not true. See above. The logic above is straightforward enough.


Also, this might be instructive:


System
Proposed
Standardized
Lag-to-Standardization
Math-Studied-For-How-Long
RSA
1977
~1993–1995
~15–20 years
Number theory: 2000+ years
ECC
1985
~1998–2000
~13–15 years
Elliptic curves: ~150 years
Lattice crypto
1996
2022–2024
~25 years
Lattices: ~150–200 years
McEliece 1978 2024 ~46 years Codes: ~60-75 years


> given the breadth of attempted post-quantum cryptosystems that have fallen to classical attacks;


Given the number of standardized successful post-quantum crypto systems that stand strong, we shouldn’t panic needlessly.


> I am baffled that so many people are taking a stand in favor of a non-hybrid system, which is transparently unwise.


Well, “wisdom" apparently is a relative term, because to me the position you’re advocating seems unwise.


> For context, cryptography is not my area of research


Coincidentally, it is mine. Plus, a few decades of experience (and some publications & patents, nothing earth-shattering).

v2.39.1 | Report a Bug | By Email | System Status