+1 I've said this before; I'll say it again - if you don't believe that pure ML-KEM gives sufficient security, then (by the same logic) you have to believe that hybrid doesn't give sufficient postquantum security.
________________________________ From: Paul Wouters <[email protected]> Sent: Wednesday, July 8, 2026 11:16 AM To: [email protected] <[email protected]> Cc: [email protected] <[email protected]> Subject: [TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08) That is to say, I think selectively applying this argument to draft-ietf-tls-mlkem but not draft-ietf-tls-ecdhe-mlkem is invalid.
_______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
