Post #3664741
2026-07-08 05:21 UTC
I was expecting popcorn. I was not expecting Jacob Applebaum to post a precise description of how a change made by NIST in the final stages of ML-KEM publication is exactly what you need to establish a secret backdoor. That's not popcorn, that's dynamite. I don't see how the IETF could publish the draft as is after this publication.
https://mailarchive.ietf.org/arch/msg/tls/BfV8R0Dr15PUOGfDi9d7_INJQzo/
Replies (2)
-
@0x00string@infosec.exchange 2026-07-08 14:07
@huitema@social.secret-wg.org i hope he didnt rape anyone on his way to making this false claim
-
@cazabon@mindly.social 2026-07-08 16:11
@huitema@social.secret-wg.org I was gobsmacked when I saw his message. It really is an understated way of drawing a line from the backdooring of DUAL_EC_DRBG and the removal of the hash over `m` in ML-KEM -- and why they want to publish a standard [1] for PQ ML-KEM *without* an ECC backstop/safety net. [1] `recommended = N` or not, `status: informational` or not, publishing it as an RFC makes it a standard to a large chunk of the world, and people *will* implement it.