Technical Summary
This memo defines ML-KEM-512, ML-KEM-768, and ML-KEM-1024 as
NamedGroups and registers IANA values in the TLS Supported Groups
registry for use in TLS 1.3 to achieve post-quantum (PQ) key
establishment.
Working Group Summary
The consensus for this document was built over 3 WGLCs. Over time changes
were made to this document and other documents, liaison statements from other
SDOs were received which helped to shift the consensus to publication.
It is worth noting that the consensus was rough
because there were many new participants who joined the discussion during the
WGLC, due to extensive social media activation of the last call. The chairs
focused their consensus judgement on people that participated in TLS prior to
the last WGLC.
Document Quality
Standalone ML-KEM is already widely implemented:
OpenSSL (512/768/1024), AWS-LC (512/768/1024), Bouncy Castle (512/768/1024),
Botan (512/768/1024), wolfSSL (512/768/1024), Rustls (768/1024), GnuTLS
(768/1024), BoringSSL (1024), s2n-tls (1024)
In nearly all of these the pure ML-KEM groups are not enabled by default
(hybrid X25519MLKEM768 is the default); enabling standalone requires an
explicit choice. The hybrid version is negotiated at scale in browsers and
server stacks.
The document defines no MIB module, no YANG module, no media type,
and no URI scheme.
The IETF stream is Informational. This is appropriate because the WG has explicitly
declined to recommend standalone ML-KEM for general use (Recommended: N) while
still wishing to document the already-registered, already-implemented code
points.
Personnel
The Document Shepherd for this document is Joseph A. Salowey. The
Responsible Area Director is Deb Cooley.