Post #3668509

RE: https://social.secret-wg.org/@huitema/116882677008277980 That is not a backdoor - the change mentioned was made in conjunction with the Kyber developers, was well justified and was made in public. Follow the references in FIPS203 appendix C to see the full discussion and rationale. It is definitely not dynamite. Seriously, this TLS debate has rotted people's brains to the point where they are willing to swallow obvious disinformation if it reinforces their priors. I'll again recommend people read @sophieschmieg@infosec.exchange's excellent post on how ML-KEM literally cannot contain a backdoor: https://keymaterial.net/2025/11/27/ml-kem-mythbusting/ Lest anyone accuse me of being a NSA shill (this is now an occupational hazard it seems), I prefer hybrid PQ and have personally shipped more of them than almost anyone else than I'm aware of. The case for hybrids rests on the risks of implementation flaws and speculations that new cryptanalysis might uncover weaknesses. It doesn't need bullshit conspiracy theories.