Re: [CFRG] [EXTERNAL] What I want from the "KEM hybrids"

[Watson Ladd <[e-mail]>]

On Tue, Feb 20, 2024, 3:24 PM Mike Ounsworth <[e-mail]> wrote:
>
> Hi Neil.
>
>
>
> Assuming there are people who would answer Yes, then what? Is the answer “You will need to touch your RSA code / hardware / whatever because the closest we’ll give you ML-KEM + RSA-OAEP hybrids” ?

Do these people have email addresses? Can they join the list to speak
for themselves? It's a lot more convincing if you can talk about
actual clients or implementations or problems you face rather than
hypothetical third parties with what seems to me to be very shoddy
reasoning about the likelihood of issues.

To be clear there's an argument of the form "we have certified device
X that is ancient and only supports PKCS 1.5, but we want to use it
with hybrids for postquantum transition until it's replaced". But that
isn't the argument I think you've made about code being more
trustworthy because it's older in the eyes of these customers.

Sincerely,
Watson Ladd