On Mon, Feb 23, 2026 at 04:27:11PM +0200, Marc Penninga wrote:
> Hi,
>
> I support publication of this document. As has been remarked before, the code
> points have already been allocated so the question is really only whether we
> want to document them.
>
> I think that OpenSSL's decision, as described by Viktor, to include
> pure ML-KEM but hide it behind a compiler flag, is the right choice:
> that way it's available for people who need it and won't bother anyone
> else. I guess that other TLS libraries and web browsers will take the
> same approach.
For the record, sorry if my earlier post was unclear, the ML-KEM-only
groups are not *by default* disabled at compile time, though a user
building OpenSSL from source can choose to do that.
Rather, the default *runtime configuration* does not include these among
either the server's or the client's supported groups. To use these,
both the server and the client (if both are OpenSSL) have to choose
non-default supported group settings:
$ openssl s_server -tls1_3 -enable_server_rpk -cert apps/server.pem -groups
mlkem768 \
-accept 12345 -naccept 1 -brief
Protocol version: TLSv1.3
Client cipher list:
TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
Ciphersuite: TLS_AES_256_GCM_SHA384
Signature Algorithms:
mldsa65:mldsa87:mldsa44:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ed25519:ed448:ecdsa_brainpoolP256r1tls13_sha256:ecdsa_brainpoolP384r1tls13_sha384:ecdsa_brainpoolP512r1tls13_sha512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:rsa_pkcs1_sha256:rsa_pkcs1_sha384:rsa_pkcs1_sha512:sm2sig_sm3
Own signature type: rsa_pss_rsae_sha256
No peer certificate or raw public key
Supported groups: MLKEM768
Peer Temp Key: ML-KEM-768
$ openssl s_client -tls1_3 -expected-rpks apps/server.pem -groups mlkem768 \
-connect 127.0.0.1:12345 -servername localhost -brief </dev/null
Connecting to 127.0.0.1
CONNECTION ESTABLISHED
Protocol version: TLSv1.3
Ciphersuite: TLS_AES_256_GCM_SHA384
Peer used raw public key
Signature type: rsa_pss_rsae_sha256
Verification: OK
DANE TLSA 3 1 0 ...a9f0a16595938d0203010001 matched the peer raw public key
Negotiated TLS1.3 group: MLKEM768
DONE
--
Viktor. 🇺🇦 Слава Україні!
_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]
