4 ms·
Classic ciphers are damn fast and small compared to PQC. If you're doing PQC anyway, doing classical cryptography at the same time has negligible cost. That ma
by quotemstr 3mo ago
Classic ciphers are damn fast and small compared to PQC. If you're doing PQC anyway, doing classical cryptography at the same time has negligible cost.
That makes attempts to push PQC-only modes super suspicious to me. Smells like Dual_EC_DRBG.
- ameliaquining 3mo agoI recommend reading https://keymaterial.net/2025/11/27/ml-kem-mythbusting/ https://keymaterial.net/2025/11/27/ml-kem-mythbusting/, which explains (1) why it's not possible for ML-KEM (the thing most people are using for post-quantum encryption) to be backdoored the way Dual_EC_DRBG was, and (2) some of the reasons some people don't like hybrids, not all of which are good but none of which should serve to undermine confidence in ML-KEM's security.