[CFRG] Re: RG Last Call on draft-irtf-cfrg-hybrid-kems-12 and draft-irtf-cfrg-concrete-hybrid-kems-04

[Ilari Liusvaara <[e-mail]>]

On Fri, Jul 10, 2026 at 04:53:56PM -1000, Richard Barnes wrote:
> This message is a reply to D. J. Bernstein, but not directly on account of
> not wanting to run afoul of his copyright lawyering
> 
> If you think there is specific new information that the RG should consider,
> please present that information in some manner more concrete than "the CVEs
> we've seen this year".  And please explain how that information bears on
> the specific question of whether implementers will make bad choices about
> which algorithms to combine, ignoring clear advice in the relevant
> specification.

It is very unlikely implementers will be making bad choices about which
algorithms to combine. That is only relevant with free combiners, and
nothing I know wants those. The protocols will be specifying the
algorithms that get combined.

Most protocols can not use free combiners for technical reasons. And
while the LAMPS stuff could, the WG was very clear they did not want
free combiners.

And looking at the CVEs, the 10097 one looks like one where "unified"
combiner does not help in most cases, and the 46590 one looks like GFUL
that just pentrates through anything.




-Ilari