IETF Logo Mail Archive

[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)

Sophie Schmieg <sschmieg@google.com> Tue, 30 June 2026 16:34 UTC

Return-Path: <sschmieg@google.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 94A1F10AF5234 for <tls@mail2.ietf.org>; Tue, 30 Jun 2026 09:34:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1782837266; bh=6gOCdyWSawAWhs+p9bxm7vcHZWgSNQFtpkYGQZtIv/k=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=BAxUCBQa6LlGIQXJ9VHBfeGTZe1uZYPCky8ro8e/IIIbEvLdU6kEEn30vTT4IaB8C JWyUddBhiHNn4i482VwIivRIwil1CK2lqVpjmqkbiVMdGR6vRUXIBUS+LPljJTOwa5 6WXRrryVWa+IlLD4Fn1yxvpofmZujBs0+S3ZflJs=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -17.6
X-Spam-Level:
X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WWMUbsuqwk1j for <tls@mail2.ietf.org>; Tue, 30 Jun 2026 09:34:24 -0700 (PDT)
Received: from mail-wm1-x334.google.com (mail-wm1-x334.google.com [IPv6:2a00:1450:4864:20::334]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id AA55610AF5219 for <tls@ietf.org>; Tue, 30 Jun 2026 09:34:24 -0700 (PDT)
Received: by mail-wm1-x334.google.com with SMTP id 5b1f17b1804b1-493b8d99342so59005e9.1 for <tls@ietf.org>; Tue, 30 Jun 2026 09:34:24 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1782837264; cv=none; d=google.com; s=arc-20260327; b=bEfH0Ajbk8kKR2wOqbDPbYE8WGwcapkhBcz8psH5RDZe5iZkstbsjS6kZr4la8VNX9 FTe100EVPOgHum3ofc9LPagEri1GtghjbU3qMVqw/uOHAcY8c2HcmOM0UjfxPhZGZiye wuCitZAE7Gzucurwfer3Y3GtIH5nz4h5+A5s1BS5B/f8c6jwnRpaDYs3SKjgi1Oji+Qc Kyll2jzgQK/mPL0Q06IOVC/2hPErA6acGMXqQRgY3362UhUbUNlCQWuU/yOUDVeWixgN czGkk0ARtAhiA9nriRS9RyeiMl/2wsEvXSimH7/wDW55acVU9eHp7suY1a5BE175GOco tuig==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=syXbd8u+HFRsbwWNc7OnWvPXCY1ZCBDEwjwHNcgx/b8=; fh=DWTtJel7qbY/oHPgehVdtjx5NuRZSIMuuyAZ8gLTzmw=; b=PXcsUsFlw2u7DEOdTS5cS6CixOrsDgWwsQ9uxY99aJAkCQ1gLw1sRHy4+o+kjRpNFB EcJlV1Smsz/a5rn2FutTkdvfQtjhlhN0qLUPS1QG9C0VfrYFOBGWMgNP53mu2SSxTJHR Cu/cmqFn6pcNe0c1kIQwVC9VRhxs2zOlipYd9EvShGoNuYDBEofxcs7ePraA/8DlIPrv r3C1UNwK8XMmp6CwoDPqjQOwDlil+Yg1BD9jTc02W2n8U4l29AjWbAoDmOjt0GbsHXjZ 28Dx6uMXu2AzbVKQpSou4fk7oNWC5XV1m94QhWtTx525iZbZRl6fCgUIBugOLTBIVsx+ BNvw==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1782837264; x=1783442064; darn=ietf.org; h=content-type:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:from:to:cc:subject:date:message-id:reply-to :content-type; bh=syXbd8u+HFRsbwWNc7OnWvPXCY1ZCBDEwjwHNcgx/b8=; b=KEqF8xjD1cmx48lNklePmqi1Y4b5aQKf5aIzAyV7+RE3T39BiHJd8+UxvXiGq14oEj I8HjLamuJBYhqFd59sUpdiGNEUiSRGHBQzLZziO4blJ6zEE9reVwHLmz1HsKvZwDSbSd qbw64TjcWS9iJiO3F6CM0Q8eLI+AcxDgFVcil0RJBxm9fSwzw71+pnxaz+AAPIAYXNVD 1Bdryt6ltSBSbrNM/OFyOrIEglIJgYxcNW4/agpXbiCvgxPySZCqx9lDQppWk0jxzmAD PUbTVgpL/SoKGrlP3kl0LpTTj5tzQrO05mtT8CFTwnk6027os7/Hpr+XaH5WeFyzuaI/ FCyw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782837264; x=1783442064; h=content-type:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=syXbd8u+HFRsbwWNc7OnWvPXCY1ZCBDEwjwHNcgx/b8=; b=Esackq0nsgtBmOrYjcQmInLaufPbcC+fgX/sA9fFGRMKpwA2q+N55OFfigi6lLK3bl sOJGyA5RhSN+VI2mP0OxCGhpYpv2LddzryeRETurirhrSgieWYlvKchSAq+ZOCgqnyD4 5WR5ouYvfzkAf18xi9+NgBZvqcmylMsFHhd+PJwORtJTjk+w0KkHBSlPCt5TunHZYH+G w/S5JgplZcoLsXH9Vbi5v9ZChre75VDCTPkN3vxAoq6FvmdMN29qo5+JA/vVC/87KyWg J27vTTTQtiH08nRABIYtrV1htsLo/faSmPngltYrneAR+XPZfIBrbvX8aovq2S2cAeiw VzcQ==
X-Forwarded-Encrypted: i=1; AFNElJ8V54/f2gyYMWCSJzo+7ZDRfnpP8FqpOnOb0pMbSfO7JelDxgYiK4pKgTVMevKtL9zZTcM=@ietf.org
X-Gm-Message-State: AOJu0YzKtKQnVdK3QbkIF1QyOyUSvlvVYx6eInhHyKazm3fgqAjHNGQ3 XF4Yipz+HIwh3fIY3ifyM2EtrH9F0Sbm7rbzaIGIomTkZZWpIVzwOmCI5rfvwlM1RyGMQfIYLFg G4ATaWnRBvf+hR38KTfm7Ta6gXAmSE/HE1lgkBBbe
X-Gm-Gg: AfdE7ckTyYAuHZ6bxUjMQp6w9l2ciI3SHCRSx6bQ+ixVZ8G4p6If18FLIg7397vh4Oi JkuPsRkEOqlBVY5qO4tJQTlBbNNKIx3pheoxe2hmhsxjhZlwiuDJZkGpzFwR/4zzbnboaixxCDG 9BlPY5tD6mzEb4qc+yTelC7e9FaDrkZg5Gg0axEYzIJqicCeSsY7iZxObv6kwyBtFTIcY/hdTkh 7QBZyBpqW20zVEnkXTzf4rLTPtvTm1y08+rAyGPj16eFQIh+uqc+FK4XdztqumfYa+0DJHyJ1Dv WGddjm7U0eK0hoBelHNWtBEQNQbnbcZf7brt82oAa2k+1ZPhq+ZppGISt6+RBSg=
X-Received: by 2002:a05:600c:3791:b0:492:203f:a378 with SMTP id 5b1f17b1804b1-493bd736f32mr511595e9.8.1782837263212; Tue, 30 Jun 2026 09:34:23 -0700 (PDT)
MIME-Version: 1.0
References: <178231320760.1520243.5914961961176039994@dt-datatracker-f9b87776f-8pmmg> <CAOvwWh2hxN6+terXGs4W8s3d5p=-oLzOiMGgH94ZNg3QMKjb-g@mail.gmail.com>
In-Reply-To: <CAOvwWh2hxN6+terXGs4W8s3d5p=-oLzOiMGgH94ZNg3QMKjb-g@mail.gmail.com>
From: Sophie Schmieg <sschmieg@google.com>
Date: Tue, 30 Jun 2026 09:34:11 -0700
X-Gm-Features: AVVi8CeFvykGRlGekviqk5hGFfrfBRtUQMPXqRjKi6_8hEWGHg1r7wZ_uzcR0UA
Message-ID: <CAEEbLAbFp6af6+oq4xbM+8gqF4-2wxh=cmKne7dX6n9wB1SevQ@mail.gmail.com>
To: Soatok Dreamseeker <soatok.dhole@gmail.com>
Content-Type: multipart/alternative; boundary="000000000000c5305606557b254a"
Message-ID-Hash: QILKOLFAD5AR35K4VUDM3KGL3RYQSWEW
X-Message-ID-Hash: QILKOLFAD5AR35K4VUDM3KGL3RYQSWEW
X-MailFrom: sschmieg@google.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: draft-ietf-tls-mlkem@ietf.org, tls-chairs@ietf.org, tls@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/CVJarSUEDVuSW7HQ313d8xK362g>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

As with the old document, I support publication. (And just like Soatok, I
have a blog post about it if further argument as to why is wanted)

On Tue, Jun 30, 2026 at 7:48 AM Soatok Dreamseeker <soatok.dhole@gmail.com>
wrote:

> I support publication of this document.
>
> Happy to share my reasoning if anyone is curious (but I already posted it
> on my blog for the curious and impatient).
>
> On Wed, Jun 24, 2026 at 11:01 AM Joseph Salowey via Datatracker <
> noreply@ietf.org> wrote:
>
>> This message initiates a new Working Group Last Call for
>> draft-ietf-tls-mlkem[1], which defines standalone ML-KEM key establishment
>> for TLS 1.3. The main question before the working group is: "Should the
>> working group publish a document specifying stand alone ML-KEM?". If there
>> is rough consensus then we will push to refine and publish the document;
>> otherwise, we will stop discussing the draft and not progress it. Please
>> respond to this call indicating whether you support publishing a document
>> specifying a stand alone ML-KEM. Please refrain from further discussion on
>> this topic as most arguments have been discussed multiple times.
>>
>> Why are we holding this consensus call now?
>>
>> Significant developments have occurred both within this document and in
>> the broader TLS ecosystem to address the concerns raised in the last WGLC.
>> Therefore, the third consensus call is warranted. We ask the working group
>> to consider document publication in light of these recent changes:
>>
>> - Promotion of Hybrids in draft-ietf-tls-ecdhe-mlkem: Following a
>> separate consensus call, the WG agreed to promote the X25519MLKEM768 hybrid
>> group to Recommended: Y in the IANA registry. Consequently, the IANA
>> registry will reflect a clear community preference for a hybrid because
>> Recommended: Y clearly indicates this while the standalone ML-KEM groups
>> defined in this draft remain Recommended: N. The updated security
>> considerations in [1] reference the IANA registry to emphasize this
>> preference.
>>
>> - Key Share Reuse Prohibited in draft-ietf-tls-rfc8446bis: The WG
>> recently reached consensus to explicitly prohibit key share reuse across
>> connections in TLS 1.3. The new text changes the guidance from SHOULD NOT
>> to a strict MUST NOT. This resolves the concerns regarding static key reuse
>> and its associated privacy and forward-secrecy risks for ML-KEM.
>>
>> - Nadim updated the ProVerif model of TLS 1.3 to evaluate KEM and hybrid
>> KEM groups in TLS 1.3. This supports other results which show that KEMs are
>> secure when used in TLS 1.3 and that hybrid groups are secure even if one
>> of the components is compromised.
>>
>> - Liaisons: We received liaison statements from multiple SDOs including
>> O-RAN[2], IEEE 802.11[4] and from 3GPP[3]  expressing support for the
>> publication of draft-ietf-tls-mlkem as an RFC as they rely on the IETF to
>> provide a stable normative reference.
>>
>> Please note that a third-party IPR disclosure exists [5] against this
>> document regarding patents related to the underlying ML-KEM algorithm. This
>> IPR declaration has not changed since the last WGLC. As a reminder, per BCP
>> 79, the IETF takes no stance on the validity of patent claims, and the
>> working group may decide to proceed with a technology despite IPR
>> disclosures if it decides that such use is warranted.
>>
>> Conduct Reminder: Given the heated nature of previous discussions on this
>> topic, participants are strongly reminded to adhere to the IETF Code of
>> Conduct (BCP 54) and the TLS WG's Mail List Procedures. Keep feedback
>> professional, technical, and focused on the document's text.
>>
>> This working group last call will end on 2026-07-08.
>>
>> Joe and Sean
>>
>> [1] https://datatracker.ietf.org/doc/draft-ietf-tls-mlkem/
>> [2] https://datatracker.ietf.org/liaison/2198/
>> [3] https://datatracker.ietf.org/liaison/2151/
>> [4] https://datatracker.ietf.org/liaison/2148/
>> [5]
>> https://datatracker.ietf.org/ipr/search/?submit=draft&id=draft-ietf-tls-mlkem
>>
>> _______________________________________________
>> TLS mailing list -- tls@ietf.org
>> To unsubscribe send an email to tls-leave@ietf.org
>>
> _______________________________________________
> TLS mailing list -- tls@ietf.org
> To unsubscribe send an email to tls-leave@ietf.org
>


-- 

Sophie Schmieg | Information Security Engineer | ISE Crypto |
sschmieg@google.com

v2.46.0 | Report a Bug | By Email | System Status