I object to the publication of this document. My concern is that the solo pq draft specifying use of only ML-KEM places all confidentiality on a single primitive whereas if we use a secure KEM combiner then total compromise requires breaking both primitives.
In my estimation it would put people's lives in jeopardy if this document were published because many manufacturers/implementers would end up implementing it just to be complete. Some of them would even make it their default. I understand the other side's argument that blocking publication of the document may slow down pq adoption. That's fine with me if those venders were going to be implementing the solo pq design. Sincerely, David
_______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
