Skip to content

TLS PQC migration: ECDHE-MLKEM hybrid + ML-DSA auth + Trust Anchor IDs — draft-ietf-tls-ecdhe-mlkem, draft-ietf-tls-mldsa, draft-ietf-tls-trust-anchor-ids#

IETF 123 (Madrid) digest Program Core pick Madrid · 19–25 July 2025

  • Tier: Core
  • Why: This is the post-quantum transition arriving in the protocol you actually deploy. Hybrid key agreement is shipping in browsers/servers now; ML-DSA authentication and the certificate-size problems it creates are the next wave. Trust Anchor IDs is the quiet but important piece for surviving large/multiple CA sets during the migration.
  • What: ecdhe-mlkem defines three hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) combining ML-KEM with classical ECDHE. mldsa specifies using ML-DSA (FIPS 204) for TLS 1.3 authentication. trust-anchor-ids lets relying parties convey trusted CAs compactly and lets servers advertise available certification paths (including via DNS) so clients select one — addressing the bloat of carrying many trust anchors. (from abstract only)
  • How: Hybrids run PQ and classical key exchange together so you're safe if either holds; ML-DSA replaces classical signatures for handshake auth; Trust Anchor IDs trims what has to be sent and supports path negotiation, which matters once PQ certs make chains larger.
  • Where applicable: General TLS 1.3 deployments. Hybrid KEX is the low-risk piece to adopt first; ML-DSA auth and cert-size mitigations (see also draft-ietf-tls-cert-abridge, below in Adjacent) are where the operational pain concentrates.