DJB seems to have a disagreement regarding some statements that NIST made https://twitter.com/hashbreaker/status/1288039119805747200 https://twitter.com/hashbre

DJB seems to have a disagreement regarding some statements that NIST made https://twitter.com/hashbreaker/status/1288039119805747200 https://twitter.com/hashbreaker/status/1288039119805747200 "Misrepresentations of security proofs are starting to cause serious damage. The embarrassingly wrong idea that there's a proof that the "security of NewHope is never better than that of KYBER" is the centerpiece of NIST removing NewHope from #NISTPQC. See https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8309.pdf https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8309.pdf Known hybrid attacks are faster against Kyber than against NewHope. (Kyber missed this because its security analysis was oversimplified; I'm writing a paper on this.) More to the point, it's clear that there isn't and won't be a proof that Kyber is at least as secure as NewHope. Cryptographers who condone exaggerations of what has been proven share responsibility for any resulting security failures. We cannot simply ignore the increased influence of dangerously oversimplified "provable security" claims upon standards and deployment. This is not a game."