[Ssh] Re: PQ signatures - where do we want to end up?

[Mouse <[e-mail]>]

> [...]  I'm not opposed to specifying both hybrid and pure schemes,
> but think we should strongly limit the number of hybrid constructions
> that we specify (ideally to one).

I think I might disagree.  Having only one of _anything_ strikes me as
a risk; if some systemic bug is found in whatever is picked, the whole
thing falls down.  We've seen two examples on this list recently
(pre-crypto message injections leading to Terrapin and its ilk, with
ssh protocol design as the one thing; and all the crypto primitives
which depend on the one thing of integer factoring being hard).

Of course, having multiple things increases various costs, too.  But I
think we should discuss the tradeoffs as tradeoffs, rather than picking
one alternative or another without discussion.

As for the specific case of hybrid constructions, I don't consider
myself competent to comment.  Life has happened and I have not had the
time I'd like to put into crypto.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[e-mail]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B