[CFRG] Re: Silithium - A Compact, Efficient and Non-separable Hybrid Signature

[John Mattsson <[e-mail]>]

Hi Neil,

Neil Madden wrote:
>Is this guesswork or based on something concrete? As I understand it there is still a non-negligible chance that cryptographically-relevant quantum computers (CRQCs) never happen and we end up reverting back to pure EC at some point in the future.

I think all estimates on when (or whether) CRQCs will appear are educated guesses. I believe there is a significant chance that CRQCs never materialize, I even made a bet against the quantum hype https://en.wikipedia.org/wiki/Scientific_wager

However, the probability that CRQCs never materialize is not the key consideration. The relevant probability is that a nation-state adversary will develop a CRQC in the not-too-distant future. In my view, that probability will remain non-negligible for the foreseeable future. Consequently, I do not expect anyone to revert from PQC back to standalone ECC, and I do not think we need to prepare for that outcome.

>From an industry perspective, governments across all regions of the world, Europe, Africa, North America, South America, Asia, and Oceania, are sending a clear and consistent message that migration to post-quantum cryptography is an urgent priority. Researchers are, of course, free to disagree with that assessment, but I believe that quantum-vulnerable cryptography will attract essentially no industry interest going forward.

Neil Madden wrote:
>but in the cryptographic community we seem to have already decided, ahead of the engineering, that CRQCs are inevitable and that pure-PQ is the only conceivable future

I think we are already well into the engineering, implementation, and deployment phase. I do not think standalone PQ is the only conceivable future. It may turn out that, even in the long run, there are not enough benefits to justify transitioning from, for example, X25519MLKEM768 to standalone ML-KEM or to a PQ/PQ hybrid such as ML-KEM + HQC-KEM. However, I would like to keep that option open.

Cheers,
John Preuß Mattsson

From: Neil Madden <[e-mail]>
Date: Thursday, 16 July 2026 at 12:06
To: John Mattsson <[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: Re: [CFRG] Re: Silithium - A Compact, Efficient and Non-separable Hybrid Signature



On 16 Jul 2026, at 09:17, John Mattsson <john.mattsson=[e-mail]> wrote:


There seem to be different opinions about the purpose of hybrids. The more obsolete cryptographic components PQ/T hybrids rely on, the more important it is to enable a migration path for removing those components once they become pure overhead and no longer provide meaningful security. In my view that will happen sometime around 2035.

Is this guesswork or based on something concrete? As I understand it there is still a non-negligible chance that cryptographically-relevant quantum computers (CRQCs) never happen and we end up reverting back to pure EC at some point in the future. Do I think that is the most likely scenario? No. But I don’t think it’s a foregone conclusion yet. Certainly, progress in terms of actual “qubits on the ground” doesn’t currently seem too alarming [1]. But I also accept I could be wrong about that.

If that scenario were to happen, I think we’re in danger of losing an awful lot of credibility.
A competent risk assessment would surely consider all plausible possible outcomes and have contingencies for all, but in the cryptographic community we seem to have already decided, ahead of the engineering, that CRQCs are inevitable and that pure-PQ is the only conceivable future. I hope we are collectively correct in that bet, otherwise I suspect we may not be taken seriously again.

Hybrid designs that allow smooth migration from EC to hybrid and then to *either* pure PQ or back to pure EC seem sensible to me.

[1]: https://neilmadden.blog/2026/07/02/are-we-any-closer-to-the-quantum-apocalypse/

— Neil