IETF last call on pure ML-KEM for TLS and related protocol work

IETF lists saw a heated last-call debate on publishing non-hybrid ML-KEM for TLS 1.3, alongside process complaints about consensus calls and smaller proposals on AI control categories, SSH certificates, and IPv6 gateways. The day's activity focused on post-quantum security trade-offs, working-group transparency, and vocabulary scope.

Last Call for Non-Hybrid ML-KEM in TLS 1.3

The IETF opened last call on draft-ietf-tls-mlkem-09.txt, advancing pure ML-KEM post-quantum key agreement for TLS 1.3 as an Informational RFC. Opponents argued that unaddressed security risks remain, while supporters pointed to working-group consensus. Operators and library authors preparing quantum-resistant TLS deployments need to weigh the non-hybrid approach against hybrid alternatives still under discussion.

TLS Chairs Face Challenges on Consensus Weighting

TLS working-group chairs issued a rough-consensus determination on the ML-KEM document that participants contested for undisclosed weighting of expert voices and lack of transparency. The 22-message thread from 13 people also examined ways to raise the quality of list discussion. Cryptographic protocol developers should watch how such process questions affect the final status of post-quantum TLS mechanisms.

AIPREF Considers AI Inference and User-Input Categories

The AIPREF working group reviewed a pull request that would add "AI System Inference" and "AI User Input" categories to its control vocabulary. Seven participants spent a dozen messages debating precise definitions and the intended scope of each label. Authors of content-preference signals and AI-service implementers have a direct stake in whether these terms become standard.

SSH Certificate Draft Draws CA-Key Hashing Suggestion

Discussion of draft-ietf-sshm-cert included a proposal to hash certification-authority keys in order to keep ML-DSA signatures manageable in size. An unrelated zero-trust identity draft was rejected as outside the working group's charter. SSH server and client maintainers planning post-quantum certificate support will want to evaluate the hashing approach before the document advances.

Further Dispute on AI Control Terminology

A publisher pressed for explicit inference-control vocabulary inside the AI-Control group, while an implementer challenged both the chosen terms and the breadth of the effort. The exchange continued earlier definitional arguments across 14 messages. Clarity on these labels will shape how automated systems declare and honor usage constraints.

Adoption Call Opens for IPv6 Resolved-Gateway Draft

The INT area began a call for adoption of draft-vanmook-intarea-ipv6-resolved-gateway-01, closing 21 August 2026. The document describes carrying IPv4 traffic across IPv6-only segments by means of a sentinel gateway address taken from the neighbor-discovery cache. Network operators running dual-stack or IPv6-mostly networks may find the technique useful for residual IPv4 reachability.