I think it’s mostly fine. Some questions though: * Why support non-hybrids at all? * Why support ML-KEM-512 at all? Especially non-hybrid. * Why support P-256 at all? X25519 is a better choice, and P-384 is there for anyone still hampered by an irrational government. I’m also raising my eyebrows a bit at the ChaPoly variants. The usual rationale for ChaPoly over AES is that it’s fast and timing-channel-resistant on hardware that lacks AES acceleration. But are people really going to be running PQ hybrids on such low end hardware? That’s a huge code size to be pulling in at the least, not to mention memory pressure and energy draw. I’ll defer to the COSE people here on what’s likely in this space, but it feels a bit like filler rather than something that meets a genuine need. Re: P-521, I think the main reason no one uses it is because it is incredibly slow. Neil On 19 Feb 2026, at 08:54, tirumal reddy <[email protected]> wrote:
|
_______________________________________________ jose mailing list -- [email protected] To unsubscribe send an email to [email protected]
