Hacker News Reader

Comment by d1sxeyes | Hacker News Reader

Basically the idea is use hybrid. AES-GCM-256 or ChaCha20-Poly1305 for symmetric encryption (which is already PQ-safe), and ML-KEM looks set to become the standard for key encapsulation.

ML-KEM-768 is fast as an algorithm, faster than X25519 in terms of pure computation, but uses large keys, so has higher overheads on small payloads. Most of the time, they’re about equal, or the absolute time is so slow it doesn’t matter.

Most folks now are doing hybrid ML-KEM and X25519 to guard against undiscovered flaws in ML-KEM.

View on HN

For people reading this, you may want to know the the NSA is allegedly trying to weaken hybrid ML-KEM and X25519 down to just ML-KEM. This is a good thing to pay attention to!

Here is a 6-part article about the topic: https://blog.cr.yp.to/20251004-weakened.html

> Here is a 6-part article about the topic: https://blog.cr.yp.to/20251004-weakened.html

* https://news.ycombinator.com/item?id=45477206

* https://news.ycombinator.com/item?id=45477206#unv_45477799

See various "NSA and IETF":

* https://news.ycombinator.com/from?site=cr.yp.to

I haven't met a single cryptographer who takes this series of posts seriously and if you have I'd love to talk to them.

is this insinuating that we, collectively, are not 100% confident that ML-KEM on it's own is going to be enough & deduct that the NSA wants the omission of X25519 as sort of a backdoor possibility?

this is great, thanks. i'm a little lost on where I even need to apply this in my own work. for the most part I can think of like a small handful of places where i just symmetrically encrypt at rest, im guessing those should be updated. but for other things, i guess theres going to be a lot of waiting for a platform i dont control for instance to update it's support for things like private/public key authentication and more. i understand openssl supports a lot of these pq methods now, trying to gauge how much of a head start i can reasonably get.

> ChaCha20-Poly1305

ha! i ran into this when looking at the source for yaak (guy who made the insomnia rest client who's now making yaak). i never got to the bottom of how it worked.

> for the most part I can think of like a small handful of places where i just symmetrically encrypt at rest

Current best practices for symmetric encryption are considered PQ-safe (provided your key length is long enough). The real question the above algorithms solve is how do you safely share the key for the symmetric encryption. That’s where X25519 and ML-KEM come in. X25519 is not PQ-safe, but it is very well studied and considered robust. ML-KEM is PQ-safe, but new, and not as well tested/audited.

It’s worth noting that e.g. the Go stdlib has this hybrid construction built-in via crypto/hpke.

thank you!!! i shall be using this immediately

So low not so slow

Reply on news.ycombinator.com