RFC Editor freezes two PQC TLS drafts after Bernstein complaints

The RFC Editor has placed draft-ietf-tls-mlkem and draft-ietf-tls-mldsa on Stream Hold while the IESG sorts out a cluster of formal complaints from D. J. Bernstein. Both drafts aim to standardize pure post-quantum options for TLS. Bernstein argues that path throws away existing elliptic-curve protection without a hybrid fallback and that the working group process around the documents has broken down.

Sandy Ginoza of the RFC Production Center told the TLS list the holds were set after discussion with the IESG and will stay until that discussion is resolved. The pause covers both the ML-KEM key-exchange draft and the ML-DSA signature draft.

Bernstein’s most direct process attack targets the ML-KEM document alone. He told the TLS chairs and the RFC Editor that 82 people registered unambiguous, non-withdrawn opposition during the latest working-group last call, the third after two earlier failures, and that for 75 of those messages no reasonable reading left room for a fix that would clear the objection. He says the chairs nevertheless forwarded the draft to the IESG “on behalf of the TLS working group” and claimed rough consensus to publish it as an informational working-group document. He asked the chairs to withdraw those claims, reverse the forwarding, and resign, and he asked the RFC Editor not to advance the document until the complaint is fully resolved.

In parallel he filed two complaints with the Security Area Directors that cover both drafts. One invokes RFC 2026’s “jeopardy” procedure, arguing the working group made an incorrect technical choice that puts the integrity of the work at risk: deploying solo ML-KEM or ML-DSA discards status-quo ECC protection while the claimed upgrade rests on primitives he says are not ready. The other argues that solo post-quantum designs fall outside the TLS working-group charter and therefore violate RFC 2418. Both letters ask the ADs to stop the documents and ask the RFC Editor to freeze processing until the complaints are settled.

TLS chair Sean Turner locked the consensus-complaint and jeopardy-complaint threads once the full working group had been copied, so further traffic on those subject lines is held while new threads remain open. The charter complaint produced the concrete procedural result: both drafts are now on Stream Hold pending Area Director and IESG direction.

The episode leaves two high-profile post-quantum TLS specifications parked at the RFC Editor and puts the burden on the ADs to rule on consensus counting, charter scope, and the technical case against pure PQ without hybrid ECC.