Post #1710983
2026-04-19 22:55 UTC
@Elliptickiwi @djb Yeah, I think that's the most plausible argument for dismissing hybrid crypto. If practical QC for cryptanalysis comes very soon, then layering on ECC or any other non-PQ crypto won't be of any use. So if you're real sure of that timeline, then you may as well skip it.
(I agree with you and Dan that that level of certainty seems unwise. Even if one thinks that timeline is 80% likely, then cheap measures that maintain security in the 20% case are worthwhile.)
Even then, though, I don't see what the HNDL story has to do with it. For one thing, in that world, the QC means the non-PQ layer is easy for the adversary to "decrypt later".
Replies (1)
-
@bartavi@mastodon.nl 2026-04-20 09:34
@gregprice @Elliptickiwi @djb if I understand correctly, their argument is that maintaining hybrids is not cheap, given the complexity of hybrid key management and, according to them, the vulnerabilities resulting from that complexity. Add to that that PQC has to work anyway, so they pour all their resources into that. I mean, I can understand that.