On Mon, 13 Jul 2026, Jacob Appelbaum wrote:

It is not a red herring against pure ML-KEM. ML-KEM is not broken.

I'm glad to hear you think this,

I agree that both ML-KEM drafts should get equal treatment.

I'm glad to hear you say this.

The equal treatment should be to restore the Kyber hash in both drafts.

I don't think that is an option in MLKEM drafts. It could be an option
in a Kyber draft if you submit that.

The sentence added would be about using good strong random, not about
adding a hash. If as part of good strong random, an implementer feels
the need to run a hash over RDRAND() or whatever OS source you are using,
implementers can decide to do so on their own. It would be generic
advise and apply to all parts that need randomness.

Paul

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to