IETF Logo Mail Archive

[TLS] Re: [EXTERNAL] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)

Yaakov Stein <ystein@allot.com> Sun, 28 June 2026 12:51 UTC

Return-Path: <ystein@allot.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 8A70E10928B19; Sun, 28 Jun 2026 05:51:48 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1782651108; bh=YFqWwd3QqOuYWnbthBoGe6w+My+V2xvNZWjWh5N7m+s=; h=From:To:Subject:Date:References:In-Reply-To; b=CiwY/hJ4pYjYt4Sv8oBZWK/4opnU9sXk6kVEKtJHgaFhofozBoJPNzTZfDSWUpFoB 5Xkp1tIwS3VRz3mnYug+PqLRd5Qs2NyZSaNbHq0rzH1D1F9AoSvj7afz8rSRZ8pFqv uoxR4q8ICwbO1VdnlgVsKelYNVyk3YUXXHnDJ8jo=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=allot.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YxaWpLGYRleS; Sun, 28 Jun 2026 05:51:47 -0700 (PDT)
Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022091.outbound.protection.outlook.com [52.101.66.91]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C87F710928B14; Sun, 28 Jun 2026 05:51:47 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=X9B5NI+PspE8P0wyk+WOjv0Rd727VY2ofmZ2NDb77Sec9FErytlO8GuXnL9oW8sWBVUNNOncX9eDTKEE3wCxKNGcg0r0zi5tQRi8PzpoFW5cQbEkguAIMvdve9u57mLmnCHeved+phlDaDqkkjM3UwwK/i233zjo4XpwVIMIprZkffmiZ6glqouXt5rcAVEhf+iv0BoQ7TVVIVwclXqwFWgYyoVW2sG8j8gkW8KwOKmhWsppYUPMsn7KKgREMotl4krgklt02RiX13H4Poe0dwOK9fjRnyacIT6FCtJ493MKu+GJkQ6ASU5wHvU9rXSvT2dYxENNoYIcHUckvI1vMw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=YFqWwd3QqOuYWnbthBoGe6w+My+V2xvNZWjWh5N7m+s=; b=ZCTtVcRnZ0rXJBinAhWW3zOWeisy4CThcxEdN+yGaJiuQ/tMkk5jpUoL3akJgZ+PMM/MR9L99+KKpNE8uz2B9HFLBNq6IaT9cxWKfHyAIxCkgNtcLsu99wn/k4bOc7o7Zb8Jv7v0SUvTAvz71HcntzxfCGoOUeaP/mWIk5oVxXmF3cFiott5nXz2oG/AYr6PIMWkDadTZapsrLZft6jTFk3JX9aaaiZ1cPpBHQx50AGj1bLr2IY2sx12PWajN/zwl2BUWiiOuwj5fTXrop4JxkNcI3+izAdsGuA3ikrPs+AUahifZRGA7fdClFuo8uwFoUcD1DhupS6+wZE0A5MBUA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=allot.com; dmarc=pass action=none header.from=allot.com; dkim=pass header.d=allot.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=allot.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YFqWwd3QqOuYWnbthBoGe6w+My+V2xvNZWjWh5N7m+s=; b=aU+DkwVktmYU3xpnbK5s9lCcSmWUrV2lLIsMB82ZjOctohvrJi9cZXD+SfAMJi34+idEtriPYJTydkTf7kbfwPsfkY6wK9+4zC2Lc+yH0Nye1Irg0F5tabZlDXNffjV0MCQ06I7aTgSjw1fGMbw/QKo8YJUmzJDxIWvrewNJHgU=
Received: from GV1PR08MB7346.eurprd08.prod.outlook.com (2603:10a6:150:21::6) by PA6PR08MB10857.eurprd08.prod.outlook.com (2603:10a6:102:3d8::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.13; Sun, 28 Jun 2026 12:51:38 +0000
Received: from GV1PR08MB7346.eurprd08.prod.outlook.com ([fe80::c681:b002:49:d763]) by GV1PR08MB7346.eurprd08.prod.outlook.com ([fe80::c681:b002:49:d763%3]) with mapi id 15.21.0159.018; Sun, 28 Jun 2026 12:51:38 +0000
From: Yaakov Stein <ystein@allot.com>
To: "draft-ietf-tls-mlkem@ietf.org" <draft-ietf-tls-mlkem@ietf.org>, "tls-chairs@ietf.org" <tls-chairs@ietf.org>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [EXTERNAL] [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)
Thread-Index: AQHdBvHE6YZQvTla20mjwWsRpfSn1rZT6vWg
Date: Sun, 28 Jun 2026 12:51:38 +0000
Message-ID: <GV1PR08MB7346CCE18921B0B5EA66CFD9D3E92@GV1PR08MB7346.eurprd08.prod.outlook.com>
References: <178231320760.1520243.5914961961176039994@dt-datatracker-f9b87776f-8pmmg> <2D5E5321-B3E4-4727-B5C1-EDF1EBB2C654@symbolic.software>
In-Reply-To: <2D5E5321-B3E4-4727-B5C1-EDF1EBB2C654@symbolic.software>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=allot.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: GV1PR08MB7346:EE_|PA6PR08MB10857:EE_
x-ms-office365-filtering-correlation-id: e5954142-45e8-4eb2-9978-08ded513fea6
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|4022899009|23010399003|1800799024|38070700021|56012099006|4143699003|11063799006|18002099003|22082099003;
x-microsoft-antispam-message-info: PLZHKDFWzgyLthYzvIQxRf5BTOYCQk11vZhkzZqMG0EDqxPImOBV4vT+JFn+ge1ghUf8iJLC6Xt97FiqNd/rzL0XTBYbojaxo1EFxiLLS8ABFKanX64M5eK7iy6Do3f+2ClJ+3mZ1k2Dzn+JO09EiJGtwFQ961cV8OTaxrY/iqJEEfRxr2gLURO8/lz2g5InKgsr14wrDrY9+Ay4BqD8gUKs7nyMUnDIVfMMzYY5zQgHc2GTPVhHgdQq5ZXLmkhipQg2Pn8eEQgVe64gTSpBrzgrlTyjsSiLjup5m3lYFRCThEx52Zs3edfD0nF+bZ+YqQ3AMTkhgWuPk7ocu+7U8WkMlKXC4MVQZ4EgmtzhKGf8rNbdrTnr9EQnNSrUpbor118xZ51LZJE8NfDhsD+C6pC4bJuJKjbzzx1ueLGtvitlytSttQdX4G8gSWkLgANovZB1wfiCCiJobJDzaRw2YngGDjhV3Z1llh8yg2hAjp0qG1shfDZZtxbdECBWKzHmopBxX2zUygT0uEAY0DTWc1+2Lkk798yJEuyqZZ1B00yBYzD4+PItLIXSN52y2nyCGh5iR8WgRt7SE9XtFm3COAISyOOBmyDG+/VzIAiiYecVzip8dZEe7BZGs0zBx1kix/IdADOeSs5FCoiTkee0sugBBl1SjxoYi+m+PAB4Npg=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1PR08MB7346.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(4022899009)(23010399003)(1800799024)(38070700021)(56012099006)(4143699003)(11063799006)(18002099003)(22082099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: unaudsWRXhIxUAWNSTORVAjeypkcM1JOizMJ9e2boP1+UzZYTIf6T9nzyO7h/04XCxiSLs5tWjql5Xls7msMzM9Akbb1xYbmraJUSr16g8GJ72wiXIsa2cPSJOPj6CllSEP2+Q77DiIC70pxyYBMfnDV2/z4T17vWyxDsB4QAnbygmHvIfwEuf3xPwo/pWJ+m0U81XOjixrhPtmX/Wg5Bn0Z+MNPUyy1Mqg22YrWBe+G3Wg6S5kLJIJ8IfnVVXKPUS2Ea9UkkD8baa+6c4wqSXyMS8/eYx/JxO+gdayh3qHVkr9obGo6QAhgSRgvfXEhJq6FP1uNoA5lZg/1GKX9tSOrSQP5/KVZTwQxUQhmYyK+ojr04yoLFzx4VqDyeIWp07/q0G2niaB9/EhT8ntq/yl5/goXy5vfAJDIBtrwySysox5L72m3Kc6GKn9+s17lBj1fKfR0GX5piHHFqlrYBMIBwS2BuOoZj9ORxcOElibIM0tq0WwnB0IzTz8lNJR5ujTFe2Lt5vJEqrdbkdDvFsaHekLpiiBaE9tkD7ht6s1OJEwQc+dYGqhbaJv4mnXW0okMKN93P+vfHlCYYMwNnbntIX19AxX2cbtY6Th3LLLe+1UotBYA0C43C6Y6g+v6flnbK8Knp5ndSx0smcsgtXDrL4YDXnOFFS6gQ+klrmAIkRXI6Ed6YXCldp2C3+OZIqGyEzYDBlYaV985T+lH2ewy2jtxmOVEtwMHGN7u1IRkv0R1jXCmM1iPdnChBEtXsGGBrtU2i1sj39sDTTMDiA0UFoUNb9iF/0jZyHJHKAtLstQ8nz0WQBhdmq/07P7s20rzt0D4XlLLB3h6oFO9aBs/eY64q+I6GBepqIMm3Wgtvw2e9dNTkbaDeiLAafXu/g+7ADhMlG9Ci/VxboL+UBj+YoSGUTepikKMGjyg0KJ7OR3nW8W7dfgWbcvVnhMRdDrxJRoZr4q2QjSaXuRYSiUUY1qHDmTdnVjSrhmsIJQHviywtlADKrnlZ9Y7Q8ftF8oWSF2CqUh1qRpxzlpTrFl1PeRqSVHqzT1bc8lp3CRu25TtSWow3QgOaWGJLm5NNLlquFkMdmH61S251gYcJ/TuUv3p3pjoTMx/HZ1WXWYBcaQqEOUB70hiGASk2Ta5hkMbfIYxiH7kgET9O5DdHrcS4BBKUNiIubjL3o4xVXWwR58XqUSHr66gkCApdHAObPIA1sTlpzS2Hv39Os6iaZ7O41zVuIOge3Ed9IdlKWD2qWdqerDEF4QIqOYd62R1buD/fLpa546uECP3EUGChK6OocJ8f+ZbGi5+VXDet6+9iBOJOcnnONTMBSSbTW93WM8jnUMPaWbNcikZR+SLxfa32N2X0LmPFncnN3zhIEow4ovWsJ5SLXmRH0g48ZoK+RFSLqt0jIAHa6VZ8SfFq5FieEU5U0aETFhre2iNUWvFlbcHXk3GlwWa4Lm33ubiHmKsQvnTSmvyS2aIHiZVwFA454zDsWQ4eo3fuXYXsoKcvcdlIFCvOSuBeCYSHH+bIza+PSkYB0kPdLa0hdI23GXlF8JapD/nwwIHcnCKbO8wTd+3FnNqNgHGTujGrHL51FcE/DP5z5N2Hdbvj35G64QVYaVQA/196bqv0WMvxwVuXohVv7NDHZsTeSDRvcv3wZQsiBOszBw30gwJZfWDDtobRbqHwLG6aM8xXTnRae+SoCsLhv4V4LAja/khGm12
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: allot.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: GV1PR08MB7346.eurprd08.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e5954142-45e8-4eb2-9978-08ded513fea6
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jun 2026 12:51:38.6325 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 789e5ff8-0396-414e-803b-13a424e9f5d2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: gCYxlMq3ucAKNU2dwg0ZVYyqDck9vpRJLs+uYbmqm3nALhXcAxeXKUHspr3yX0NA9Jq2XG4b/hAw3dAq+jvhXA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA6PR08MB10857
Message-ID-Hash: 7CR3QR6SOYLSBUO735M5WLHG42I2NBUC
X-Message-ID-Hash: 7CR3QR6SOYLSBUO735M5WLHG42I2NBUC
X-MailFrom: ystein@allot.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: [EXTERNAL] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/G8RweFH4IBTBXXSi_nOTAKMI9Vw>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

I too strongly oppose publication (for the same reasons as others have already articulated).

I did not respond sooner as the flood of those supporting publication almost convinced me that it would be futile to oppose,
but others are speaking out have enheartened me.

Y(J)S

-----Original Message-----
From: Nadim Kobeissi <nadim@symbolic.software>
Sent: Sunday, June 28, 2026 2:31 PM
To: Joseph Salowey <joe@salowey.net>
Cc: draft-ietf-tls-mlkem@ietf.org; tls-chairs@ietf.org; tls@ietf.org
Subject: [EXTERNAL] [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)

External Email: Be cautious do not click links or open attachments unless you recognize the sender and know the content is safe

I oppose the publication of this document.

Pure ML-KEM key exchange is a strict weakening of TLS 1.3 that brings absolutely no benefit over hybrid key exchange, something which has been standardized and deployed for years now to great success.

This document only legitimizes a mode of operation for TLS the security of which is strictly less resistant than what we already have with hybrids, and which does not improve upon hybrid key exchange in any way, as shown and proven through various security analyses, some of which are cited in the draft itself.

Nadim Kobeissi
Symbolic Software • https://symbolic.software

> On 24 Jun 2026, at 5:01 PM, Joseph Salowey via Datatracker <noreply@ietf.org> wrote:
>
> This message initiates a new Working Group Last Call for draft-ietf-tls-mlkem[1], which defines standalone ML-KEM key establishment for TLS 1.3. The main question before the working group is: "Should the working group publish a document specifying stand alone ML-KEM?". If there is rough consensus then we will push to refine and publish the document; otherwise, we will stop discussing the draft and not progress it. Please respond to this call indicating whether you support publishing a document specifying a stand alone ML-KEM. Please refrain from further discussion on this topic as most arguments have been discussed multiple times.
>
> Why are we holding this consensus call now?
>
> Significant developments have occurred both within this document and in the broader TLS ecosystem to address the concerns raised in the last WGLC. Therefore, the third consensus call is warranted. We ask the working group to consider document publication in light of these recent changes:
>
> - Promotion of Hybrids in draft-ietf-tls-ecdhe-mlkem: Following a separate consensus call, the WG agreed to promote the X25519MLKEM768 hybrid group to Recommended: Y in the IANA registry. Consequently, the IANA registry will reflect a clear community preference for a hybrid because Recommended: Y clearly indicates this while the standalone ML-KEM groups defined in this draft remain Recommended: N. The updated security considerations in [1] reference the IANA registry to emphasize this preference.
>
> - Key Share Reuse Prohibited in draft-ietf-tls-rfc8446bis: The WG recently reached consensus to explicitly prohibit key share reuse across connections in TLS 1.3. The new text changes the guidance from SHOULD NOT to a strict MUST NOT. This resolves the concerns regarding static key reuse and its associated privacy and forward-secrecy risks for ML-KEM.
>
> - Nadim updated the ProVerif model of TLS 1.3 to evaluate KEM and hybrid KEM groups in TLS 1.3. This supports other results which show that KEMs are secure when used in TLS 1.3 and that hybrid groups are secure even if one of the components is compromised.
>
> - Liaisons: We received liaison statements from multiple SDOs including  O-RAN[2], IEEE 802.11[4] and from 3GPP[3]  expressing support for the publication of draft-ietf-tls-mlkem as an RFC as they rely on the IETF to provide a stable normative reference.
>
> Please note that a third-party IPR disclosure exists [5] against this document regarding patents related to the underlying ML-KEM algorithm. This IPR declaration has not changed since the last WGLC. As a reminder, per BCP 79, the IETF takes no stance on the validity of patent claims, and the working group may decide to proceed with a technology despite IPR disclosures if it decides that such use is warranted.
>
> Conduct Reminder: Given the heated nature of previous discussions on this topic, participants are strongly reminded to adhere to the IETF Code of Conduct (BCP 54) and the TLS WG's Mail List Procedures. Keep feedback professional, technical, and focused on the document's text.
>
> This working group last call will end on 2026-07-08.
>
> Joe and Sean
>
> [1] https://datatracker.ietf.org/doc/draft-ietf-tls-mlkem/
> [2] https://datatracker.ietf.org/liaison/2198/
> [3] https://datatracker.ietf.org/liaison/2151/
> [4] https://datatracker.ietf.org/liaison/2148/
> [5] https://datatracker.ietf.org/ipr/search/?submit=draft&id=draft-ietf-tls-mlkem
>
> _______________________________________________
> TLS mailing list -- tls@ietf.org
> To unsubscribe send an email to tls-leave@ietf.org

_______________________________________________
TLS mailing list -- tls@ietf.org
To unsubscribe send an email to tls-leave@ietf.org
This message is intended only for the designated recipient(s). It may contain confidential or proprietary information. If you are not the designated recipient, you may not review, copy or distribute this message. If you have mistakenly received this message, please notify the sender by a reply e-mail and delete this message. Thank you.

v2.46.0 | Report a Bug | By Email | System Status