IETF Advances Pure ML-KEM Key Exchange for TLS 1.3 to Last Call

The IETF has moved draft-ietf-tls-mlkem to IETF-wide Last Call, advancing a specification that defines pure ML-KEM-512, ML-KEM-768, and ML-KEM-1024 NamedGroups for key establishment in TLS 1.3. If approved, the document would become an Informational RFC and give implementers a stable reference for standalone ML-KEM in TLS, while the IANA registry would continue to mark the pure ML-KEM groups as Recommended = N and the hybrid X25519MLKEM768 group as Recommended = Y.

The proposal remains contentious after multiple Working Group Last Calls, appeals, and objections from cryptographers who argue that pure ML-KEM lacks the resilience of hybrid key exchange if one component later proves weak. The latest draft adds clarification on the meaning of the registry recommendation flag and expands security considerations around randomness exposure in ML-KEM. Despite the debate, downstream standards bodies including O-RAN, IEEE 802.11, and 3GPP have backed publication to obtain a stable post-quantum reference for their own specifications.