Why both X25519+Kyber512 and P256+Kyber512? Note that Anything+Kyber512, in particular X25519+Kyber512, will be FIPS certifiable after NIST standardized Kyber512.*
Best, Bas — * With the tiny caveat that apparently the order of the shares does matter atm. [insert facepalm.] > - X25519 + Kyber512 > - P256 + Kyber512 > - X448 + Kyber768 > - P384 + Kyber768 > > I don't see the point of including finite field groups. I would hope to > hold off on national curves, such as Brainpool and the GOST curves > (although they're likely to be forced on us anyways). I personally see > Kyber1024 as overkill (of course, if you disagree, please say so). > > Of course, it's possible that NIST will tweak the definition of Kyber; > that's just a possibility we'll need to live with (and wouldn't change what > hybrid combinations we would initially define) > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
