> TLS handshake would contain 52420 + 21312 = 14,724 bytes of signatures and public keys, an over 10x increase. > Barring a large-scale quantum computer starin

> TLS handshake would contain 52420 + 21312 = 14,724 bytes of signatures and public keys, an over 10x increase. > Barring a large-scale quantum computer staring us in the face, this is not a tenable amount of data to send simply to open a connection. Do we not run the risk of it simply being the case that Dilithium is the best TLS compatible algorithm for signatures we're going to get for a while? Then the question becomes: does a rodent of unusual size cough large, fault tolerant quantum computer...actually exist? I think the answer is probably no, but if I understand attacks against the current Web PKI, it's not like an attacker would sit on the wire running Shor's algorithm in real time. The work to make a MITM attack possible would be done ahead of time, (e.g. running Shor's algorithm against a Ed25519 public key to find the private scalar) then the attack proceeds as normal. Which is to say, if they[0] can make it work at all, they can start cracking keys and MITM attacks on connections become a reality. Does that mean that we should implement Dilithium? I don't know, but I also don't know if we should sit on our hands until something better comes along. [0]: whoever ends up building one of these things