What breaks first in PQC migration, key exchange or the part where certificates blow up and downgrades get cute?
3 comments
The part they seem to skate past is certificate chain size, not just the leaf cert, a hybrid ML-DSA chain can get large enough that you start caring about fragmentation and middleboxes before the math itself is the problem.
That makes the authentication side feel more operationally painful than ML-KEM, since you can usually hide key exchange changes behind one round trip, but certs have to survive every ancient parser in the path.
Certificate size is the annoying part, sure. But the harder failure mode is still downgrade and compatibility, because a fat chain is survivable if the handshake never gets quietly steered back to RSA.
> "the harder failure mode is still downgrade and compatibility"
I think the size path breaks first in practice, because it shows up even when nobody is actively trying to steer you back to RSA, and you hit it in places you don't control, like path building, MTU, and proxies that just truncate or reject oversized handshakes. Downgrade is the scarier security bug, but it usually presumes the new suite was negotiated enough to matter, while a swollen chain can fail before any of that logic runs.
What surprised me is how much of this is really about the certificate stack, not ML-DSA itself, one extra signature algorithm choice can ripple into intermediates, OCSP, and TLS records all at once.