On Mon, 13 Jul 2026, Jacob Appelbaum wrote:
It is not a red herring against pure ML-KEM. ML-KEM is not broken.
I'm glad to hear you think this,
I agree that both ML-KEM drafts should get equal treatment.
I'm glad to hear you say this.
The equal treatment should be to restore the Kyber hash in both drafts.
I don't think that is an option in MLKEM drafts. It could be an option in a Kyber draft if you submit that. The sentence added would be about using good strong random, not about adding a hash. If as part of good strong random, an implementer feels the need to run a hash over RDRAND() or whatever OS source you are using, implementers can decide to do so on their own. It would be generic advise and apply to all parts that need randomness. Paul _______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
