With X25519MLKEM, we are concerned that MLKEM might be broken *xor* that a quantum computer might break X25519. But, we’re not concerned about the case where MLKEM is broken *and* a quantum computer breaks X25519?
What’s the best write-up for how we got there? I’m looking for linkable source that argues in favor of X25519MLKEM over P384MLKEM and P521MLKEM, that wouldn’t also favor, say, P192MLKEM over X25519MLKEM.
What’s the best write-up for how we got there? I’m looking for linkable source that argues in favor of X25519MLKEM over P384MLKEM and P521MLKEM, that wouldn’t also favor, say, P192MLKEM over X25519MLKEM.
1
