There's a lot of stuff in this post I agree with. There's also a lot of stuff that hints that the author doesn't believe in the worst case they name: that there might be a classical cryptanalytic attack on ML-KEM that occurs before Q-day.
No comments yet.