proposal: crypto/tls: add support for NIST curve based ML-KEM hybrids

[tomato42]

Proposal Details

The current version of the draft-kwiatkowski-tls-ecdhe-mlkem draft includes two hybrid ML-KEM groups that use NIST curves:

• SecP256r1MLKEM768
• SecP384r1MLKEM1024

As explained in the draft, they are interesting for environments that require compliance, either with FIPS in general, or with higher security standards, like the Common Criteria Protection Profile v4.3 or CNSA 2.0.

I'd like to ask for their inclusion in a future Go release.

[ianlancetaylor]

CC @golang/security

[FiloSottile]

We were planning to ship at least the P-256 one in #69985, but with all the noise around making backwards incompatible changes to draft-kwiatkowski-tls-ecdhe-mlkem, we ended up shipping only the X25519 one, which at least has a large deployed base to hopefully protect it from changes.

[gabyhelp]

Related Issues

• crypto/tls: add X25519MLKEM768 and use by default; remove x25519Kyber768Draft00 #69985 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}