On 7/7/26 11:57, Henrick Hellström wrote:
If a library supports X25519MLKEM768, it necessarily ships a complete ML-KEM-768 implementation, since the hybrid needs it. So the "don't link it" option only applies to the pure code points, not to the ML-KEM code itself; that code runs in every hybrid handshake either way.Firstly, there are at least two ways an implemented mechanism might be disabled at the library level; either by simply not linking it at build time (only shipping source and instructions on how to include it), or by a software switch that would have to be deliberately turned by the library consumer.
My worry is that hybrids invite the attitude "I have battle-tested ECDH, so ML-KEM quality matters less". That may hold for cryptanalytic risk, but not for implementation bugs. If that attitude takes hold, it would be disastrous for the migration to post-quantum crypto.
_______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
