Keygen cost isn't the lattice, it's rejection and secret lifetimes on Cortex-M4, per a controlled study of LWR, ML-KEM, HAETAE.

ML-KEM on Cortex-M7, where moving bytes around buys 2.5% unless you also recycle public data like it's 1999.

MPC threshold ML-KEM, one scheme keeps NIST formats intact, the other cuts rounds and compatibility, because tradeoffs still exist.

One power trace from optimized ML-KEM keygen on Cortex-M4 is enough for key recovery, courtesy of CBD and NTT leakage.

1Password explains how it shipped hybrid post-quantum TLS via ALB and rustls/aws-lc-rs, no app code touched, naturally.

Post-quantum stealth address anonymity, swapping ECDH discovery for ML-KEM and poking at ERC-5564/6538 assumptions, because standards lov...

So, can the MATZOV FFT dual attack on ML-KEM be made rigorous? This paper says yes, with explicit thresholds and costs.

Turns out Apache and NGINX get PQC by way of OpenSSL, and this shows the hybrid ML-KEM knobs plus how to verify the handshake.

Explains RFC 10024, which finalizes hybrid ML-KEM+ECDH in TLS 1.3, because the internet needed one more key exchange.