IETF Logo Mail Archive

[TLS] Re: Composite ML-DSA

Simon Josefsson <simon@josefsson.org> Wed, 15 April 2026 13:55 UTC

Return-Path: <simon@josefsson.org>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 6E72CDCC8B10 for <tls@mail2.ietf.org>; Wed, 15 Apr 2026 06:55:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1776261308; bh=9/MdIj2WvDC2odY4IcNxonm/T44fTK8pUCZU4gMfFJg=; h=From:To:Cc:Subject:In-Reply-To:References:Date; b=C97jcy7MEO/9B87Yp17JfVrhgV1qJ5WYnjc15kiqqGaSNQBB6FDAWQZ4Ja6/Ksmch xosSjY4tOYqRuK4W5SdPhnRBuoKVZQpjSzJBZyTbHEY6z9daFuciHIFkev64rms8fs fZ5KR/KPmfMHuaeql1MkDTOO/X/TS9NXdnPZfjUk=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.401
X-Spam-Level:
X-Spam-Status: No, score=-4.401 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=josefsson.org header.b="9fMGFfQd"; dkim=pass (2736-bit key) header.d=josefsson.org header.b="R4GEGPkS"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XgtW63pWyluq for <tls@mail2.ietf.org>; Wed, 15 Apr 2026 06:55:07 -0700 (PDT)
Received: from uggla.sjd.se (uggla.sjd.se [IPv6:2001:9b1:8633::107]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 45F2EDCC8B08 for <tls@ietf.org>; Wed, 15 Apr 2026 06:55:07 -0700 (PDT)
DKIM-Signature: v=1; a=ed25519-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=ed2303; h=Content-Type:MIME-Version:Message-ID:Date: References:In-Reply-To:Subject:Cc:To:From:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=PXINMCRkI6kXVvu1AkpssweNlEnxz4Ehh/ZZkLr0m04=; t=1776261293; x=1777470893; b=9fMGFfQduonB2mfpYj+jfr7seAWxSFMskJUVgdgbQo1aSBjfDfetK6XDFLa2YfHz4vrJlyz/GQ+ OgTbE6Fl5Cw==;
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=josefsson.org; s=rsa2303; h=Content-Type:MIME-Version:Message-ID:Date: References:In-Reply-To:Subject:Cc:To:From:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=PXINMCRkI6kXVvu1AkpssweNlEnxz4Ehh/ZZkLr0m04=; t=1776261293; x=1777470893; b=R4GEGPkSSkVJzGOa0tmSC4ZkUNJJo2K8BaXNsGX6meU+p8Ef+jvw4OQwHk39Tn1XIpWq6wkV1iS sy/n1gvhbEbTM9SPaMH3f0+zammgQBEbJc2dNmWUgaNVudwj4ih8zXkcWAM+t/eXBEMqEwy/g8kBG NowswP0EaiKb8p044rNfEUOhCRVr+YXL6yOCoOay6vDR23Wc0uyOpU39LSJg9+T7SPh37TgfbA84m 18mxSmlxPwnGZOFP0c8b9tODUuZGLscbOhR1IBtChQL2w2NOcaIffCAjodz1RMuUNO+NoW+bc/uPF 0FuKqeVMgo9s2V+GUon1RLkp+wa0vtGmZjyhey2P5kcjcFiVJnIZm7brviFJqlHxpr86R6R5K6Gdv pjj7aRP5KRtNB0KjgNySr7vn4pEZQoIKKd5Vb+MhtPHzQQQZkP02SCGpkXPO8Clv+7jfCccHr;
Received: from h-178-174-130-130.a498.priv.bahnhof.se ([178.174.130.130]:58502 helo=frallan) by uggla.sjd.se with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from <simon@josefsson.org>) id 1wD0hZ-004G7U-59; Wed, 15 Apr 2026 13:54:45 +0000
From: Simon Josefsson <simon@josefsson.org>
To: Filippo Valsorda <filippo@ml.filippo.io>
In-Reply-To: <d69ba150-0257-4e64-9abb-9229d03a03a6@app.fastmail.com> (Filippo Valsorda's message of "Wed, 15 Apr 2026 14:43:19 +0200")
References: <16CF0FDA-7263-461A-9F2B-D37DBEAF5DD9@sn3rd.com> <25c8d414-e4c8-455b-bd64-28132615ba75@cs.tcd.ie> <68f49a81-dd2c-4bea-896a-87da3e6aff68@tu-dresden.de> <CAMjbhoWwvfkfScpbf4-5PBzk__qb+6M4ZzAOba64kk9aXBba5g@mail.gmail.com> <d47a34ab-7fb9-4687-84aa-a5fa6bcf6a6c@tu-dresden.de> <2971d01a-89e3-43d3-a01d-b9c17b178763@amongbytes.com> <692bb582-ab7e-4d6b-aa75-ac5d93228bb2@tu-dresden.de> <DS4PPFA08475C7DBE27468E40C672197481C1242@DS4PPFA08475C7D.namprd11.prod.outlook.com> <LV0PR21MB6623B48B1F3A05D745F5A79D8C242@LV0PR21MB6623.namprd21.prod.outlook.com> <ad0svakv_WUM3btz@chardros.imrryr.org> <CAF8qwaBU_YHWX2MsWeeaOJ8sutR1wMozvbiTJF5kyvTE8YjWWA@mail.gmail.com> <CACsn0c=GDta824UF7uJ3nw_4U_rT=XhYOGHRemMWa+2AdbsiAg@mail.gmail.com> <3a16c7c4-345e-48ce-af70-a3bf503c8caf@app.fastmail.com> <CACf5n7_0hdeHJXXucva9pb=+pjhcgveHRpjA8XAcXB3LsYUvaw@mail.gmail.com> <CAFpG3gcC+UfO7E=ADGhwr2En5PwipZiq_r6_RdqvmT-5nnh2jw@mail.gmail.com> <d69ba150-0257-4e64-9abb-9229d03a03a6@app.fastmail.com>
OpenPGP: id=B1D2BD1375BECB784CF4F8C4D73CF638C53C06BE; url=https://josefsson.org/key-20190320.txt
X-Hashcash: 1:23:260415:kondtir@gmail.com::LMjYxmqU97Pt69DE:JSUV
X-Hashcash: 1:23:260415:tls@ietf.org::Gd/z2IP4ejFb6mlG:Vnr1
X-Hashcash: 1:23:260415:filippo@ml.filippo.io::TVKiaJugA+4JaFAn:SE8q
Date: Wed, 15 Apr 2026 15:54:59 +0200
Message-ID: <87a4v42urw.fsf@josefsson.org>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Message-ID-Hash: JFIDQACMKHWXRRL3CJQM6A4MOF7GLCQ5
X-Message-ID-Hash: JFIDQACMKHWXRRL3CJQM6A4MOF7GLCQ5
X-MailFrom: simon@josefsson.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: tls@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: Composite ML-DSA
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/eDHFMTDF6zuRIEl5sLBHGqiFhhI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

"Filippo Valsorda" <filippo@ml.filippo.io> writes:

> I think hybrid authentication is firmly on the wrong side of the
> complexity / benefit tradeoff.
>
> The benefit is a little lower than hybrid key exchange due to the lack
> of store-now-decrypt-later risk [0], but that's not the interesting
> side of the tradeoff.

I don't understand that argument related to hybrid signatures.

I would say a risk of a man-in-the-middle attack is, generally speaking,
more serious than a risks of a store-now-decrypt-later attack.

If your protocol allows a store-now-decrypt-later attack, it is bad.

If your protocol allows a man-in-the-middle attack, it is REALLY bad.

Having man-in-the-middle attackers puts us back into the 1980-1990's era
of computer security, when we used unauthenticated 'telnet'.

Having store-now-decrypt-later puts us back into the 1990-2000's era of
weak encryption algorithms, when we used RC4 or single-DES.

We want to mitigate risks with both concerns.

Hybrid KEM's protect against the store-now-decrypt later threat.

Hybrid PQ/T signatures protect against man-in-the-middle attackers.

Could you (or someone else) pick this apparent disagreement apart, to
find where our security assumptions differ?  I assume my arguments won't
change your opinion, although that would be one way to resolve this too.

We started with PQ/T hybrid key exchanges because it was simpler to
solve than PQ/T hybrid authentication, for the many reasons you explain.
That's no reason to give up.

Generally, I would find hybrid authentication to be a more important
problem to solve than hybrid key exchange.  Especially today when the
latter problem seems to be more well understood and solutions already
deployed.  People used to resist deploying hybrid key exchanges, in much
the same way they resist deploying hybrid authentication now.

/Simon

v2.40.4 | Report a Bug | By Email | System Status