On Mon, Feb 23, 2026 at 11:03:09PM +0100, Muhammad Usama Sardar wrote: > On 23.02.26 22:20, Nico Williams wrote: > > The controversy has to do with the cryptanalytic strength of PQ-only > > KEMs and not much else. No formal analysis tools can address that > > question! Insisting on that in that context is a category error. > > Well, not necessarily. This may possibly be your misunderstanding of the > scope of FATT. Please see the FATT process statement [0] which is */_very_/* > explicit about it:
Great, now please show us all how ML-KEM is really as strong as or stronger than X25519 or X448. (You can't. FATT can't. But go ahead and show us.) Nico -- _______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
