4 ms·
Unlikely that signatures will ever be hybrid. Fairly likely we move off of hybrid for key exchange once NIST finishes standardization.
by dadrian 2y ago
Unlikely that signatures will ever be hybrid.
Fairly likely we move off of hybrid for key exchange once NIST finishes standardization.
- thadt 2y agoGeez, turbolaser X-Wing before it even gets in the air. Can y'all just give us a SCW death-match debate on this? Jokes aside, it would be interesting to have your optimistic take on the current PQ security trajectory. Do you think that it has proven comparably secure to ECC? Or just that by the time PQ primitives are ready to be rolled out they'll be load bearing enough that it is better to use them solo rather than the added overhead/complexity of a hybrid?
- dadrian 2y agoI don't see TLS adopting anything other than the current hybrid or a pure Kyber, but Bas would know better than me. Signatures are very difficult to do hybrid in a way that's not strippable. I think lattices are in the realm of boring crypto these days, but I ask the actual mathematical cryptographers when I need real opinions.
- tptacek 2y agoWe're gonna fight about this!