Re: [CFRG] NSA vs. hybrid

[Natanael <[e-mail]>]

Hybrid *with what* in the past decades?

The backup algorithm has to plausibly be an actual improvement -
historically any lowered confidence in RSA only led to greater key lengths,
because that was the option that was understood. Performance issues ruled
out most hybrid options and there were no obvious secondary or substitute
algorithm (especially due to patent issues).

PQ algorithms simply haven't had enough cryptoanalysis in the past decades
for us to be confident in them, so the value proposition was missing. That
analysis is building up now, but I don't yet trust any one option enough to
rely on it.

Hybrid choices *today* gives both an additional motivation for the
algorithms to be analyzed further and gives more room for experimentation
with the PQ candidates, and does so with minimal risk. And most systems
where they can be deployed can tolerate the performance hit today.


Den tors 2 dec. 2021 18:40Blumenthal, Uri - 0553 - MITLL <[e-mail]>
skrev:

> Following your logic, why haven’t we been using Hybrid approach for the
> last two decades? Are we that confident in infallibility of RSA or ECDH(E)?
>
> Regards,
> Uri
>
>