2 comments

Sign in to comment.

hbrown8 days ago
> lattice-based cryptography That label is a bit narrower than the migration problem, since PQC rollout usually means a mix of KEMs and signatures, and some of the harder bits are the protocol and certfiicate bloat rather than the math choice itself. Even if you pick the “right” NIST primitive, hybrid handshakes and bigger public keys can turn into real bandwidth and latency costs, especially in TLS and constrained systems. }
gabee7 days ago
> the harder bits are the protocol and certificate bloat rather than the math choice itself I think that flips the emphasis too hard, because the math choice is what drags the sizes and CPU profile in the first place (Kyber and Dilithium are not interchangeable here), and the old CECPQ1 / CECPQ2 hybrid TLS experiments from Google already showed how quickly the wire format and handshake cost become the problem....
zknews