3 ms·

I just was surprised no one really made post-quantum AKE with PFS. Or at least I haven't managed to find it. The closest thing I saw is this one: http://csrc.ni

• tptacek 11y ago
  It's too early to do that. Researchers are trying to study whether the primitives are going to work --- ie, that the new hard problems they're based on will hold up against quantum speedups and that they're secure against conventional adversaries. Simple DH is a straightforward backdrop for that problem. Composing DH into an AKE doesn't much help, as long as the primitive is flexible enough.