IETF Logo Mail Archive

[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2026-02-27)

Tibor Jager <jager@uni-wuppertal.de> Fri, 27 February 2026 22:21 UTC

Return-Path: <jager@uni-wuppertal.de>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id B6442BFF623A for <tls@mail2.ietf.org>; Fri, 27 Feb 2026 14:21:04 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=uni-wuppertal.de
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IpJMqxnc61Po for <tls@mail2.ietf.org>; Fri, 27 Feb 2026 14:21:01 -0800 (PST)
Received: from smtpout3.uni-wuppertal.de (smtpout3.uni-wuppertal.de [132.195.64.73]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 9F5C1BFF51E2 for <tls@ietf.org>; Fri, 27 Feb 2026 14:20:00 -0800 (PST)
Received: from smtpout-intern.uni-wuppertal.de (smtpout-intern.uni-wuppertal.de [132.195.64.33]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtpout3.uni-wuppertal.de (Postfix) with ESMTPS id 0EC9F17DE70 for <tls@ietf.org>; Fri, 27 Feb 2026 23:19:52 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uni-wuppertal.de; s=mail; t=1772230792; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tdO+Df8L6NvkHjKQUogGO1z6MnmjnU8y6M01gkJ+ExA=; b=Cw2XpuOpX9FjMe3s7b6vXYsRr8PwnlsbvPLLjBMsNqnIjhB9dL523/p66n0bLAePgRbzaw 8PlfU70myr0/YK+qmydhlKx2cilWXRX9i6i0bx+/vOEVK5n9mNb3dx9eBPWpz8Tm4hL56X ELqWzODHN/gMleMlKUdwQ5QZXalBEPw=
Received: from mail.uni-wuppertal.de (mail.uni-wuppertal.de [IPv6:2001:638:50a:64::3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (No client certificate requested) by smtpout-intern.uni-wuppertal.de (Postfix) with ESMTPS id 082AB9F4C3 for <tls@ietf.org>; Fri, 27 Feb 2026 23:19:51 +0100 (CET)
Received: from smtpclient.apple (p200300c0cf22870044581d224e65eafb.dip0.t-ipconnect.de [IPv6:2003:c0:cf22:8700:4458:1d22:4e65:eafb]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail.uni-wuppertal.de (Postfix) with ESMTPSA id DA75C1A1A for <tls@ietf.org>; Fri, 27 Feb 2026 23:19:51 +0100 (CET)
Content-Type: multipart/signed; boundary="Apple-Mail-C6CB6AAC-DB51-4B1E-B7F6-183CBF18C916"; protocol="application/pkcs7-signature"; micalg="sha-256"
Content-Transfer-Encoding: 7bit
From: Tibor Jager <jager@uni-wuppertal.de>
Mime-Version: 1.0 (1.0)
Date: Fri, 27 Feb 2026 23:19:41 +0100
Message-Id: <05529422-A5E7-4C0E-B7DF-9C6A98923035@uni-wuppertal.de>
References: <aaH7oSjfTR6KnmW8@LK-Perkele-VII2.locald>
In-Reply-To: <aaH7oSjfTR6KnmW8@LK-Perkele-VII2.locald>
To: tls@ietf.org
X-Mailer: iPhone Mail (23D127)
X-Spamd-Result: default: False [-0.20 / 100.00]; MIME_GOOD(-0.20)[multipart/signed,text/plain]; SENDER_FROM_WHITELIST_DOMAIN(0.00)[uni-wuppertal.de]; MIME_TRACE(0.00)[0:+,1:+,2:~]; DKIM_SIGNED(0.00)[uni-wuppertal.de:s=mail]; ARC_NA(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; LOCAL_OUTBOUND(0.00)[]; FROM_HAS_DN(0.00)[]
X-Rspamd-Pre-Result: action=no action; module=multimap; Matched map: SENDER_FROM_WHITELIST_DOMAIN
Message-ID-Hash: NTG6GELNSMPWJ6BNTBRIZFLBKFN4EKNC
X-Message-ID-Hash: NTG6GELNSMPWJ6BNTBRIZFLBKFN4EKNC
X-MailFrom: jager@uni-wuppertal.de
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-05 (Ends 2026-02-27)
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/4PcWkID3bs4M_-He_OL0jy5CyZY>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>


> Am 27.02.2026 um 21:16 schrieb Ilari Liusvaara <ilariliusvaara@welho.com>:
> - There does not seem to be any evidence that ML-KEM is weak. I think
>  that if ML-KEM gets badly broken, it will be for unforeseeable reasons
>  (which is a risk for any cryptographic algorithm, including prime-
>  field ECC).

Except that for a hybrid mode, both ML-KEM and ECC must be broken simultaneously. 

I think it is unwise to rely *only* on ML-KEM (or any other scheme based on relatively new hardness assumptions), and currently do not support any draft that does not use hybrid cryptography. In particular when the use of hybrid crypto comes with negligible overhead, as for ML-KEM + ECC. 

For almost every broken cryptosystem there was a time when there seemed to be no evidence that it is weak. ML-KEM still needs to stand the test of time. 

Best regards,
Tibor

v2.40.1 | Report a Bug | By Email | System Status