Post #1249801

2026-04-11 16:12 UTC

@rsalz @djb @darkuncle dumb questions from the sidelines: 1: doesn’t it make sense to treat NSA preferences with a bit of suspicion given their history and mission? 2: if there is strong opposition to non-hybrid, besides djb’s, doesn’t that bear listening to? What’s the benefit here in overriding the concerns? Very much not a crypto expert, I’m assuming there’s a lot I don’t know or understand here. Appreciate any answers.

Replies (2)

@djb@mastodon.cr.yp.to 2026-04-12 19:17

@jzb @rsalz @darkuncle Side note re "crypto expert": The issue here is basic security risk management. For example, Google and Cloudflare tried ECC+SIKE (CECPQ2b: https://web.archive.org/web/20260411125124/https://blog.cloudflare.com/the-tls-post-quantum-experiment/) for tens of millions of user connections, and then SIKE was publicly broken years later. The only reason this didn't immediately expose all those user connections to attackers is that the connections were still encrypted with ECC.

Open ##1249803
@rsalz@ioc.exchange 2026-04-12 16:15

@jzb To answer your questions: 1. If it were only the NSA, sure, be suspicious. But it's not (IEEE, Ericsson I believe, others) and I do not believe they were all cofrupted. 2. Sure, the IETF is having that discussion. See what you think of https://github.com/tlswg/draft-ietf-tls-mlkem/pull/14/changes for example.

Open ##1387736