briansmith
· 2w
With X25519MLKEM, we are concerned that MLKEM might be broken *xor* that a quantum computer might break X25519. But, we’re not concerned about the case where MLKEM is broken *and* a quantum compute...
@nprofile1q... https://cr.yp.to/papers/mldsa-20260601.pdf#breakable-keys is a graph estimating the number of breakable keys each year for Ed25519, ML-DSA-44, and the Ed25519+ML-DSA-44 combination. That's for signatures but the KEM situation is similarly scary. No idea where you're getting the idea that we aren't worried about the combined risk; we're fighting multiple fires at once here.