Post #1151345

2026-04-14 22:26 UTC

@pedromj@mastodon.social @djb@mastodon.cr.yp.to @paulehoffman@infosec.exchange @rsalz@ioc.exchange We are heading towards a situation where the ML-KEM key exchange draft will be published, probably in about a year. I would much prefer to see a warning in the text itself, and I think that can be achieved. After that, the IETF will have published 2 documents, hybrid ML-KEM and naked ML-KEM. If we follow Dan's reasoning, we can expect the US Gov to encourage "naked", which they might be able to break. We will be in the domain of opinions, not standards.

Replies (3)

@rsalz@ioc.exchange 2026-04-14 23:26

@huitema@social.secret-wg.org You think it will be published? I'm not sure sure it has consensus.

Open ##1152422
@huitema@social.secret-wg.org 2026-04-14 22:34

@pedromj@mastodon.social @djb@mastodon.cr.yp.to @paulehoffman@infosec.exchange @rsalz@ioc.exchange After publication of naked ML-KEM, we could try to sway opinion by publishing Internet drafts such a "naked ML-KEM considered harmful". We could lobby browser vendors to not implement that. We could publish in news papers, rally suppport from the EFF, etc. All that may help getting people to deploy hybryd ML-KEM instead. But it would help more if there is an warning in the naked ML-KEM draft itself.

Open ##1152440
@djb@mastodon.cr.yp.to 2026-04-15 03:53

@huitema @pedromj @paulehoffman @rsalz The previous "last call" for objections to the _non-hybrid_ ML-KEM spec produced objections from 22 people and support from 21 people. Names, quotes, links: https://blog.cr.yp.to/20260405-votes.html This is obviously very far from the "consensus of the IETF community" that every WG-issued RFC claims to have. Are you really claiming that IETF will issue this as an RFC? Why do you claim this?

Open ##1249793