[TLS] Re: WG Adoption Call for ML-KEM Post-Quantum Key Agreement for TLS 1.3

[Bas Westerbaan <[e-mail]>]

On Wed, Apr 16, 2025 at 10:38 AM Bellebaum, Thomas <
[e-mail]> wrote:

> > This is misleading. There are many implementations of Kyber that
> require
> > much less memory. See eg [1] from 2019 where Kyber-512 only requires
> 2736
> > bytes.
>
> Thank you. Somehow I missed this, although the use of a reference
> implementation seemed suspicious.
>
> > By the way, for key agreement, between keygen and decapsulation, a
> client
> > only needs to keep around the private key seed (64 bytes).
>
> This actually emphasizes the point.
> For any ML-KEM capable device, we are still talking about a minimum RAM of
> at least two KB (ignoring significant future optimizations). Moreover, much
> of that memory is unused outside of ML-KEM operations.
> Then:
>
> 1. The unused memory should suffice to perform X25519, and therefore
> 2. Limited RAM is quite unlikely to be the bottleneck when choosing
> between ML-KEM and a hybrid.
>

Agreed.


>
> -- TBB
>