[CFRG] Re: Silithium - A Compact, Efficient and Non-separable Hybrid Signature

[Neil Madden <[e-mail]>]

> On 16 Jul 2026, at 09:17, John Mattsson <john.mattsson=[e-mail]> wrote:
> 
> 
> There seem to be different opinions about the purpose of hybrids. The more obsolete cryptographic components PQ/T hybrids rely on, the more important it is to enable a migration path for removing those components once they become pure overhead and no longer provide meaningful security. In my view that will happen sometime around 2035.

Is this guesswork or based on something concrete? As I understand it there is still a non-negligible chance that cryptographically-relevant quantum computers (CRQCs) never happen and we end up reverting back to pure EC at some point in the future. Do I think that is the most likely scenario? No. But I don’t think it’s a foregone conclusion yet. Certainly, progress in terms of actual “qubits on the ground” doesn’t currently seem too alarming [1]. But I also accept I could be wrong about that. 

If that scenario were to happen, I think we’re in danger of losing an awful lot of credibility. 
A competent risk assessment would surely consider all plausible possible outcomes and have contingencies for all, but in the cryptographic community we seem to have already decided, ahead of the engineering, that CRQCs are inevitable and that pure-PQ is the only conceivable future. I hope we are collectively correct in that bet, otherwise I suspect we may not be taken seriously again. 

Hybrid designs that allow smooth migration from EC to hybrid and then to *either* pure PQ or back to pure EC seem sensible to me. 

[1]: https://neilmadden.blog/2026/07/02/are-we-any-closer-to-the-quantum-apocalypse/

— Neil