Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Meh don't care about the actual PQ parts. I'm with Peter Gutmann [0] in that PQ is just a waste of time and draining resources that could be put to better use.
- Okay - so... they're saying... don't use p384? :3
- Will look back fondly to that period of short, ed25519 sigs…by LVB
- Would've been interesting to see something about when to use MLKEM-1024-X448 and ML-DSA-87-ed448.by maqp
- Hurray for mostly-non-controversial opinions!by hdmoore
- Have to say the I get a bit frustrated with all the acronyms in the cryptography space; it’s hard to keep up for those of us with a passing interest.by meling
- I really never managed to understand why we keep suggesting SHA-256 even though we know it's vulnerable to length extension attacks?
Everywhere else in cryptography we favor recommendations that are harder to misuse, or that shrink the surface area of "things you have to think about and get right", but for some reason SHA-256 keeps finding its way into new designs (such as Git 3.0), even though things would be much nicer if I never had to remember that length extensions are a thing :/
On another note, as someone who defaults to BLAKE3 unless I have a good reason not to, it would be nice to have more context on Filippo's comment about it being very fast "but complex and uncommon enough that you want to have a good reason to use it and a good reason to trust your implementation".
I've peeked into the guts of Zig's BLAKE3 implementation before, it's merkle-tree-ish and not very scary looking, the primitives are a lot more recognizable than Keccak for example...
by luizfelberti - Excellent post as always.
Filippo is my favorite way to keep myself abreast of the newest (professionally relevant!) drama in the cryptography community. As a colleague said today, "life is too short to read through all the TLS working group mailing list".
by BoppreH