IETF Logo Mail Archive

[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)

Daniel Apon <dapon.crypto@gmail.com> Fri, 03 July 2026 00:36 UTC

Return-Path: <dapon.crypto@gmail.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 286B510D2C5C0 for <tls@mail2.ietf.org>; Thu, 2 Jul 2026 17:36:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1783038966; bh=2ZyFLECVLA9Q/HoLs5dIoacM+KvMYlpiiGWmtAZ0HkE=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=N2j1OaJYWM0Gx9n6f+5LPr83rMVbUoOECpPdYSBB9gviFxs7Ak6nFzSTteGkcGxSx +r9+b/e4H7qzzmQY8qjiHI8QHgpp5lgFtr5oD3TWToVDBUuGYvrBm72F97LrU/dFBt H2HNfBUIVSVKZTlZYE8CAvwVR7KQlwDIyZrnio5I=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CV7vBzygxUqu for <tls@mail2.ietf.org>; Thu, 2 Jul 2026 17:36:05 -0700 (PDT)
Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 7BE6610D2C5B6 for <tls@ietf.org>; Thu, 2 Jul 2026 17:36:05 -0700 (PDT)
Received: by mail-lf1-x136.google.com with SMTP id 2adb3069b0e04-5aeb8c19017so58760e87.0 for <tls@ietf.org>; Thu, 02 Jul 2026 17:36:05 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1783038964; cv=none; d=google.com; s=arc-20260327; b=M3mZn4/FeYIqa5rtswzqZgBlHI5wHvAzDdIsamjsoaj9nDpQ202lsAuSIsKGuVyKl9 gG+wkVeW4P8w62QNBs8wjnsr4Y0YHGObQFuyMmAdG0U2tBDeKZ5REXLMKjQs5wxUW/zn OPJVyrCypziR+oYbFg69JIYewMxlmQptKQHQALYEwclgCeYCyMCW1D3Idj4+YZim7gOO OSqjz3VAtaB8AUdx1W6ygUU2tSt2KbEuTqeFSihAMOvfxyzuWNPDBksqp/j5Q1BTh3Hf CA6qcIZqaGZ11pvfoMsiawhq63VIzCeg/NFJvlv3jWpEpMbNSNOmY9SE0T3wE7oITXh8 tPzQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=W6+tnFdR7MX1iy0slSJOGuqRkURP/Ro7mWjNE+ESs9s=; fh=zT9JUwyxfAlR88HDmVd46t7rx/y7DUWR/w6/JhDdfLQ=; b=eMcdntKn9+HCCz4zOFGHVEfJv3C3vPIVtuLn8KrRziX+Z1HhW3HyEidZUF7bnVoAaM 5lmIqgTj+bqJVsILUO55wAw2PYhiJrOBvWjRC7HA71tTPhXhHA2QtCLqRVfSoYbPk9aN 6/Hc3rmYpdSUr1SrD0a+Vr0sqkBzQZ4DcvWxPgN7eJtFp9CUrkYh6EfZ8dnbKky/uK46 zM3FuVytY6hFa0ZOcFG9BMLneQF0cOrAiCGYA6D3n3w07dhJ4LPuVR6mW1RBGN68b0Wf M5TgAzxuWcNkkxtNfpRYMAvmp6Q3V9v5ZtXgNi6BfzkAHXKJtokA8/XI/TtR6MS2mCWL 8FIA==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783038964; x=1783643764; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=W6+tnFdR7MX1iy0slSJOGuqRkURP/Ro7mWjNE+ESs9s=; b=TCuf5pziFarN+sMjiX3quQkuSKRDxcTNOnQvUAB9vLOMVDVGy+/9JyspufQOB+Ea9R iI+V5y3lirZavVobWXj6CW59fGaojNHIYx/MtInOxaxR8ihifFPQMoj5ZFmnNSVxrYDW eA5hDlhO3OHsAcehxqeYc3OFwlkRLijIow9Brvo1cC7sdGy2exc6OSTnsk1aVBoBoFIM 6MFgbwWtxCP9DDzau02mFA3+/kKZxL7r4UNmENSmjXZBXYHzspANl+1FCSnibFl5cS9M Tvel1hoDOISomFMpHFn/kGRKWnhwj7kzXXhbwTaT6ZWjJO3lu+nhrNSV3GD63+uP7P0o 5yPQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783038964; x=1783643764; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=W6+tnFdR7MX1iy0slSJOGuqRkURP/Ro7mWjNE+ESs9s=; b=nN8vDC6mlzyYFeoVx/Y6VeZWdS6OKg6PVsXL+rnWL2tAPxvuw8+A8Nac5SPf03QolE xC1tlCuNVOLALqt4zuaNaPatjVz446rvsFgxfmh5jfUn5WhAuB/qu7nVGKCXN0MJiAuW gcCX6JCU0ESD1bA0DvZwEbzTc8E9PGS23oYQnjsqoU3fMkQJwpzVtMBtWUSRxRELx4EZ Y0rnzpFyBTbhXIGHgXVQMtgQSbmhaLz2s43yPL7nxrSrrGcr3P4K/5duZk+Y0D4jU9Mo DY02Dhvp62PHUqAblvRkpKeV97rQFQuNB380zwMOMA5At8xx9X5m6Bc2Gy+LgMMEdpMe X7pQ==
X-Gm-Message-State: AOJu0YzBBmYseZmDIUa/RzZm2qZpvjVNrdAAlYRuEna8Pn7F04E3U8LC WMUoS/bN2QecGl3zKwqw3DQP3eXeKwj3nIiOMnUCnB2bIpo4Zg/nGQ0YbTmup6S5tXB9lxFAeKq hSuz1hvE1NTnybz1LxISSa5X31YW3SRQHVVbWVIs=
X-Gm-Gg: AfdE7cl7XdCPcyC43yBwhZYEuoIgatGIG7tz1oAIMf0M77eQh1Mq68zxDUky6HPBIsq X2L7ANbPTCc8PAnSCO6k+2LNAwdcAXELrb0H1SPe20nI2nUQHuK5A510soSKrButwSGOQ9380TH XqcDcy3uX/6rzW4YXyrkuGeT0Rf2C2BjbnP0r63yXxpfPyrOTbnyiWWHY7+0HtEGMtbS6Dx7OUv H6k8venyFjD2OlzuufxoTyihRC7afsM4dbdkd8Nx7x1xqnIdZpnKFeQRs7n9MIwS+ZhYPOSO0fW 1TW4ySXknvdLCdXAmXjdT5781nNOvAgVbG3u25+n99SCwxmYROdQaPcAToCCD3oNjLQzbalvFL3 rmskJIS4+KQmzNojomaJnjv4nB/qjVakMBrMJw09BOH7HLVPXUfhEw/anCR3WClwPERw4O07zuQ LKMy5iWjIYlrtWxNoPsne1ekQ3ctYBIlH8ZqM6ayk=
X-Received: by 2002:a05:6512:a354:b0:5ae:bed1:dea5 with SMTP id 2adb3069b0e04-5aec68b731bmr1341759e87.41.1783038963144; Thu, 02 Jul 2026 17:36:03 -0700 (PDT)
MIME-Version: 1.0
References: <CAK5=5Qp6qJaMOE6NgysfHK_JyM7JYp=VB7tKJ8QkZLkopKSeiA@mail.gmail.com> <PH3PPFA3FE8A23FE09ADC3276F8D2B69B80C1F52@PH3PPFA3FE8A23F.namprd11.prod.outlook.com> <5d435771-2afc-46bb-88d9-941d89fe4c28@burtrum.org>
In-Reply-To: <5d435771-2afc-46bb-88d9-941d89fe4c28@burtrum.org>
From: Daniel Apon <dapon.crypto@gmail.com>
Date: Thu, 02 Jul 2026 20:35:51 -0400
X-Gm-Features: AVVi8CfpJBU5gHxkqHIvAAAD5BfYzdeIM2gcmd0-qFJ9RKF_AdoyMORaxNESbIM
Message-ID: <CAPxHsSJZsJJwrR4WsT4hHXuM1Kb0hx_v2JnWip90DJcxAyhExA@mail.gmail.com>
To: Travis Burtrum <travis.ietf@burtrum.org>
Content-Type: multipart/alternative; boundary="00000000000004daf80655aa1c59"
Message-ID-Hash: IL6UBOYYIYQDJKFXLPVG5IVAUFRLQB4Z
X-Message-ID-Hash: IL6UBOYYIYQDJKFXLPVG5IVAUFRLQB4Z
X-MailFrom: dapon.crypto@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: tls@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/xvEZn9xR756qNq0AMg4cJW7fvZ0>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Dear Travis,

You "turned it around" and asked the question whether Scott is 100% sure
without any doubt whatsoever that ML-KEM and these specs are completely
secure forever. May I turn it around (in good cheer) and ask the other side:
*How many United States Dollars shall I put on a bet with you about a
hypothetical future in which quantum computers exist and break ECC, and on
what timeline?*

>From https://en.wikipedia.org/wiki/Scientific_wager, I find that

In 2017, Daniel J. Bernstein
<https://en.wikipedia.org/wiki/Daniel_J._Bernstein> made a bet for US$2,048
(equivalent to $2,600 in 2024)[11]
<https://en.wikipedia.org/wiki/Scientific_wager#cite_note-inflation-USGDP-11>
 with Francisco Rodríguez-Henríquez
<https://en.wikipedia.org/wiki/Francisco_Rodr%C3%ADguez-Henr%C3%ADquez?action=edit&redlink=1>
 that quantum computers <https://en.wikipedia.org/wiki/Quantum_computer> will
publicly break the RSA-2048 <https://en.wikipedia.org/wiki/RSA-2048> factoring
challenge no later than 2033.[23]
<https://en.wikipedia.org/wiki/Scientific_wager#cite_note-quantum-bet-23> In
2023, John Preuß Mattsson bet $2,050 that the challenge will withstand
quantum computing until at least 2050. Daniel J. Bernstein
<https://en.wikipedia.org/wiki/Daniel_J._Bernstein>, John Sahhar
<https://en.wikipedia.org/wiki/John_Sahhar?action=edit&redlink=1>, Daniel
Apon <https://en.wikipedia.org/wiki/Daniel_Apon?action=edit&redlink=1>,
and Michele
Mosca <https://en.wikipedia.org/wiki/Michele_Mosca> accepted the bet.[24]
<https://en.wikipedia.org/wiki/Scientific_wager#cite_note-24>

So, in the grand tradition and good spirit of public scientific wagers
(with a beautiful, storied, and even hallowed history across many
scientific disciplines!), I will happily entreat you to make a
USD-denominated wager on your position. My position is that ECC will be
broken "soon" -- indeed, just as DJB has been willing to go on the record
for public wagers before (along with me) -- as in his case, that ECC would
be broken by 2033 and 2050.

Please let me know what terms you're willing to publicly put money behind.
(And cheers to the mailing list for joyfully humoring this humble request!)
My kindest regards,
--Daniel Apon

On Thu, Jul 2, 2026 at 8:24 PM Travis Burtrum <travis.ietf@burtrum.org>
wrote:

> Hi Scott,
>
> On 7/2/26 2:49 PM, Scott Fluhrer (sfluhrer) wrote:
> > I feel I need to ask this (both to you and to others who have suggested
> > that ML-KEM cannot be trusted): do you support the publication of draft-
> > ietf-tls-ecdhe-mlkem?
>
> Surely if anyone knew for sure ML-KEM was broken they'd bring that up,
> but "cannot be trusted" is a different thing.  Obviously we've seen tons
> of standardized crypto over the decades that everyone thought was secure
> and then it turned out was broken.  So let me turn it around and ask you
> a question, are you absolutely 100% sure without any doubt whatsoever
> that both ML-KEM and these specs are completely secure forever?  If not
> (and I'm not sure how anyone could be) it's only sensible to hedge
> against this, which is why only hybrid should exist and this
> draft-ietf-tls-mlkem should not be published.
>
> Thanks,
> Travis
>
> _______________________________________________
> TLS mailing list -- tls@ietf.org
> To unsubscribe send an email to tls-leave@ietf.org
>

v2.46.0 | Report a Bug | By Email | System Status