Hi Authors, Thank you for your responses! We have updated the document accordingly and have 5 followup items for your review (we’ve tried to consolidate updates per everyone’s responses here, but please let us know if we’ve missed something). Updated files have been posted below in this thread.
1) For the following (from Deb): > Please note that some of the text that was agreed during wglc for > draft-ietf-tls-mlkem need to be added to this draft as well (specifically the > randomizer text, when it applies to this draft). Authors - Can you point us to the final text that should be added to the document (and where the text should be placed)? We note that this pull request (https://github.com/tlswg/tls-ecdhe-mlkem/pull/69) has been merged, but we want to make sure we incorporate the correct text. > On Jul 27, 2026, at 8:09 AM, Bas Westerbaan > <[email protected]> wrote: > > > > On Fri, Jul 24, 2026 at 12:06 AM <[email protected]> wrote: > Authors, > > While reviewing this document during Final Review, please resolve (as > necessary) the following questions, which are also in the source file. > > 1) <!-- [rfced] Document title > > a) How may we update the document title to clarify "ECDHE-MLKEM Key > Agreement”? > Note that we will add a hyphen for "MLKEM" (i.e., "ML-KEM"). > > Original: > Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLSv1.3 > > Perhaps: > Post-Quantum Hybrid Key Agreement Mechanisms for TLS 1.3 That Combine ML-KEM > and > ECDHE > > Coauthors, I prefer the original, but if we make a change, I'd prefer > > Post-Quantum Hybrid Key Agreement Mechanisms for TLS 1.3 > > with abbreviation > > PQ Hybrids for TLS 1.3 2) We have updated with your proposed title with further improvements per Panos’ suggestion regarding the use of "post-quantum hybrid" (see #4 below). Please let us know any objections. Current (Title): Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3 Current (Abbreviated Title): PQ/T Hybrids for TLS 1.3 > 2) <!-- [rfced] Questions about ECDHE and ECDH > > Note: The abbreviation "ECDHE" refers to "Ephemeral Elliptic Curve > Diffie-Hellman", and the abbreviation "ECDH" refers to "Elliptic Curve > Diffie-Hellman". > > a) The document title and abstract use "ECDHE" (but the expansion in the > abstract does not include "Ephemeral"). A similar sentence in Section 2 uses > "ECDH". Should the usage be aligned? > > Document title (uses "ECDHE"): > Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLSv1.3 > > Abstract (uses "ECDHE" but expansion does not include "Ephemeral"): > This draft defines three hybrid key agreement mechanisms for TLS 1.3 > - X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 - that > combine the post-quantum ML-KEM (Module-Lattice-Based Key > Encapsulation Mechanism) with an ECDHE (Elliptic Curve Diffie- > Hellman) exchange. > > Section 2 (uses "ECDH"): > This document introduces three new supported groups for hybrid post- > quantum key agreements in TLS 1.3: the X25519MLKEM768, > SecP256r1MLKEM768, and SecP384r1MLKEM1024 which combine ML-KEM with > ECDH in the manner of [hybrid]. > > > b) Both "ECDH" an "ECDHE" are also used elsewhere in the document, including > in > the IANA Considerations section. Please review all instances and let us know > if > any further updates are needed. > --> > > Coauthors, I propose to mention emphemeral everywhere consistently. 3) For consistency throughout the document, we have updated each instance of "Elliptic Curve Diffie-Hellman" and "ECDH" to "Ephemeral Elliptic Curve Diffie-Hellman" and "ECDHE", respectively. Please review and let us know any objections. Additionally, should the keyword "ECDH" be updated to "ECDHE"? > 3) <!-- [rfced] In the title, abstract, and Section 2 (mentioned in the > previous > question), is there a preferred order for the words "post-quantum" and > "hybrid"? > Or is the current variation okay? > > For example, "post-quantum hybrid" is used in the document title, and "hybrid > post-quantum" is used in Section 2. In the abstract, "post-quantum" is placed > before "ML-KEM". > --> > > "Hybrid post-quantum" sounds more natural to my ear, but "post-quantum > hybrid" emphases what is important. I don't have an opinion. Coauthors? 4) Per Panos’ suggestion, we have updated to use "PQ/T" in the document after the expansion "Post-Quantum Traditional" to align with RFC 9794. Let us know if you prefer otherwise. > 4) <!-- [rfced] RFC 8446 has been obsoleted by RFC 9846. Would you like to > update > instances of [RFC8446] to [RFC9846]? > > Note that if we update [RFC8446] to [RFC9846], we would also need to update > the > following section number (several instances in the document): > > Section 4.2.8.2 of [RFC8446] > Section 4.3.8.2 of [RFC9846] > > Three instances to my count. > We do not believe this section number would need to be updated: > > Section 7.4.2 of [RFC8446] > Section 7.4.2 of [RFC9846] > > Please confirm. > > Correct. > --> > > > 5) <!-- [rfced] May we combine Sections 2.1 and 3 into one section? > > Original: > 2.1. Terminology > > The [hybrid] document defines "traditional" algorithms as those that > are already widely adopted and "next-generation" algorithms as those > that are not yet widely adopted, such as post-quantum algorithms. In > this document, ECDH using Curve25519, P-256, or P-384 is considered > traditional, while ML-KEM is considered next-generation. > > The [hybrid] document also defines a "hybrid" key exchange as the > simultaneous use of multiple key exchange algorithms, with their > outputs combined to provide security as long as at least one of the > component algorithms remains secure, even if the others are > compromised. This document uses the term "hybrid" with the same > meaning. > > 3. Conventions and Definitions > > The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", > "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and > "OPTIONAL" in this document are to be interpreted as described in > BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all > capitals, as shown here. > > Perhaps: > 3. Terminology > > [RFC9954] defines "traditional" algorithms as those that are already > widely adopted and "next-generation" algorithms as those that are not > yet widely adopted, such as post-quantum algorithms. In this > document, ECDH using Curve25519, P-256, or P-384 is considered > traditional, while ML-KEM is considered next-generation. > > [RFC9954] also defines a "hybrid" key exchange as the simultaneous > use of multiple key exchange algorithms, with their outputs combined > to provide security as long as at least one of the component > algorithms remains secure, even if the others are compromised. This > document uses the term "hybrid" with the same meaning. > > The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", > "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and > "OPTIONAL" in this document are to be interpreted as described in > BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all > capitals, as shown here. > --> > > Ok. > 6) <!-- [rfced] Would adding "in [RFC9954]" after "framework" be helpful > here? > > Original: > This document applies the framework to ML-KEM and specifies code > points for the hybrid groups.a > > Perhaps; > This document applies the framework in [RFC9954] to ML-KEM and specifies > code > points for the hybrid groups. > --> > > Yes. > 7) <!-- [rfced] Should the note in Section 4.1 of this document be in the > <aside> > element? It is defined as "a container for content that is semantically less > important or tangential to the content that surrounds it" > (https://authors.ietf.org/en/rfcxml-vocabulary#aside). > --> > > Yes. > 8) <!-- [rfced] Is "final" correct here? Or is "latest" or something similar > intended? > > Original: > These identifiers are to be > used with the final, ratified by NIST, version of ML-KEM which is > specified in [NIST-FIPS-203]. > > Perhaps: > These identifiers are to be used with the latest version of ML-KEM > ratified by NIST, which is specified in [NIST-FIPS-203]. > --> > > Final is correct. A changed algorithm will have a different name. > 9) <!-- [rfced] Throughout the text, the following terminology appears to be > used > inconsistently. Please review these occurrences and let us know if/how they > may be made consistent. > > key exchange value > key_exchange value > --> > > Everywhere should be key_exchange. > 10) <!-- [rfced] FYI - We have expanded the following abbreviation per > Section 3.6 > of RFC 7322 ("RFC Style Guide"). Please review carefully to ensure > correctness. > > HMAC-based Key Derivation Function (HKDF) > --> > > Correct. > 11) <!-- [rfced] Please review the "Inclusive Language" portion of the > online Style > Guide <https://www.rfc-editor.org/styleguide/part2/#inclusive_language> and > let > us know if any changes are needed. Updates of this nature typically result in > more precise language, which is helpful for readers. > > We follow rfc9794—perhaps better to cite it? 5) Would adding a citation for RFC 9794 after "Post-Quantum Traditional (PQ/T) hybrid key agreements" work here? Current: This document introduces three new supported groups for Post-Quantum Traditional (PQ/T) hybrid key agreements in TLS 1.3 -- X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 -- that combine ML-KEM with Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) in the manner described in [RFC9954]. Perhaps: This document introduces three new supported groups for Post-Quantum Traditional (PQ/T) hybrid key agreements [RFC9794] in TLS 1.3 -- X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 -- that combine ML-KEM with Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) in the manner described in [RFC9954]. The files have been posted here (please refresh): https://www.rfc-editor.org/authors/rfc10024.txt https://www.rfc-editor.org/authors/rfc10024.pdf https://www.rfc-editor.org/authors/rfc10024.html https://www.rfc-editor.org/authors/rfc10024.xml The diff files have been posted here: https://www.rfc-editor.org/authors/rfc10024-diff.html https://www.rfc-editor.org/authors/rfc10024-rfcdiff.html (side by side) https://www.rfc-editor.org/authors/rfc10024-auth48diff.html https://www.rfc-editor.org/authors/rfc10024-auth48rfcdiff.html (side by side) For the Final Review status page, please see: https://queue.rfc-editor.org/final-review/rfc10024/. Thank you! Madison Church RFC Production Center > I reviewed the edits already made. They look good. > > Kris, I'd like to highlight that the spelling of your name changed. > Thank you. > > Thanks! > > Best, > > Bas > > > > Madison Church and Rebecca VanRheenen > RFC Production Center > > > On Jul 23, 2026, at 3:03 PM, [email protected] wrote: > > *****IMPORTANT***** > > RFC Author(s): > -------------- > > Final Review for RFC-to-be 10024 <draft-ietf-tls-ecdhe-mlkem> > > Your document is now available for Final Review (previously AUTH48). Once it > has been > reviewed and approved by you and all coauthors, it will be published as an > RFC. > If an author is no longer available, there are several remedies; > see the Unavailable Authors section > (https://authors.ietf.org/rfc-publication-process#unavailable-authors). > > You and you coauthors are responsible for engaging other parties > (e.g., Contributors or Working Group) as necessary before providing > your approval. > > Planning your review > --------------------- > > Please review the following aspects of your document: > > * RFC Editor questions > > Please review and resolve any questions raised by the RFC Editor > that have been included in the XML file as comments marked as > follows: > > <!-- [rfced] ... --> > > These questions will also be sent in a subsequent email. > > * Changes submitted by coauthors > > Please ensure that you review any changes submitted by your > coauthors. We assume that if you do not speak up that you > agree to changes submitted by your coauthors. > > * Content > > Please review the full content of the document, as this cannot > change once the RFC is published. Please pay particular attention to: > - IANA considerations updates (if applicable) > - contact information > - references > > * Copyright notices and legends > > Please review the copyright notice and legends as defined in > RFC 5378 and the Trust Legal Provisions > (TLP – https://trustee.ietf.org/license-info). > > * Semantic markup > > Please review the markup in the XML file to ensure that elements of > content are correctly tagged. For example, ensure that <sourcecode> > and <artwork> are set correctly. See details at > <https://authors.ietf.org/rfcxml-vocabulary>. > > * Formatted output > > Please review the PDF, HTML, and TXT files to ensure that the > formatted output, as generated from the markup in the XML file, is > reasonable. Please note that the TXT will have formatting > limitations compared to the PDF and HTML. > > > Submitting changes > ------------------ > > To submit changes, please reply to this email using 'REPLY ALL' as all > the parties CCed on this message need to see your changes. The parties > include: > > * your coauthors > > * [email protected] (the RPC team) > > * other document participants, depending on the stream (e.g., > IETF Stream participants are your working group chairs, the > responsible ADs, and the document shepherd). > > * [email protected], which is an archival mailing list > to preserve discussion about the document while in the RPC editorial > queue; it is not an active discussion list: > > * More info: > > https://mailarchive.ietf.org/arch/msg/ietf-announce/yb6lpIGh-4Q9l2USxIAe6P8O4Zc > > * The archive itself: > https://mailarchive.ietf.org/arch/browse/auth48archive/ > > * Note: If only absolutely necessary, you may temporarily opt out > of the archiving of messages (e.g., to discuss a sensitive matter). > If needed, please add a note at the top of the message that you > have dropped the address. When the discussion is concluded, > [email protected] will be re-added to the CC list and > its addition will be noted at the top of the message. > > You may submit your changes in one of two ways: > > An update to the provided XML file > — OR — > An explicit list of changes in this format > > Section # (or indicate Global) > > OLD: > old text > > NEW: > new text > > You do not need to reply with both an updated XML file and an explicit > list of changes, as either form is sufficient. > > We will ask a stream manager to review and approve any changes that seem > beyond editorial in nature, e.g., addition of new text, deletion of text, > and technical changes. Information about stream managers can be found in > the FAQ. Editorial changes do not require approval from a stream manager. > > > Approving for publication > -------------------------- > > To approve your RFC for publication, please reply to this email stating > that you approve this RFC for publication. Please use 'REPLY ALL', > as all the parties CCed on this message need to see your approval. > > > Files > ----- > > The files are available here: > https://www.rfc-editor.org/authors/rfc10024.xml > https://www.rfc-editor.org/authors/rfc10024.html > https://www.rfc-editor.org/authors/rfc10024.pdf > https://www.rfc-editor.org/authors/rfc10024.txt > > Diff file of the text: > https://www.rfc-editor.org/authors/rfc10024-diff.html > https://www.rfc-editor.org/authors/rfc10024-rfcdiff.html (side by side) > > Diff of the XML: > https://www.rfc-editor.org/authors/rfc10024-xmldiff1.html > > > Tracking progress > ----------------- > > Details on the status of your Final Review are here: > https://queue.rfc-editor.org/final-review/rfc10024/ > > Please let us know if you have any questions. > > Thank you for your cooperation, > > RFC Editor > > -------------------------------------- > RFC 10024 (draft-ietf-tls-ecdhe-mlkem) > > Title : Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLSv1.3 > Author(s) : K. Kwiatkowski, > P. Kampanakis, > B. Westerbaan, > D. Stebila > WG Chair(s) : Joseph Salowey, Sean Turner, Deirdre Connolly > Area Director(s) : Deb Cooley, Christopher Inacio -- auth48archive mailing list -- [email protected] To unsubscribe send an email to [email protected]
