GoKawiilCryptographer D.J. Bernstein argues against replacing ECC with standalone post-quantum encryption
Bernstein's cr.yp.to blog post argues that switching protocols entirely to post-quantum (PQ) cryptography, rather than combining it with existing ECC, creates unnecessary security risk. He contends that PQ implementations will inevitably contain exploitable bugs, and keeping ECC alongside PQ limits the damage those flaws can cause, at minimal extra cost.
GoKawiil's interpretation of the reporting above, not reported fact.
As NIST-standardized algorithms like ML-KEM and ML-DSA get deployed, the decision to drop legacy ECC entirely could expose systems to failures unique to new, less battle-tested PQ code. Bernstein's argument reinforces the case for hybrid ECC+PQ schemes as a safer transition strategy while post-quantum implementations mature and undergo more scrutiny.
- Bernstein warns that solo post-quantum cryptography risks amplifying damage from inevitable software bugs.
- He advocates hybrid ECC+PQ deployments, citing consistent recommendations since 2016.
- He criticizes claims that ML-KEM and ML-DSA specs are inherently low-risk as unsupported by evidence.
YubiKey 5 NFC Security Key — If cryptographic defense-in-depth is on your mind, a hardware security key is the practical everyday version of that idea. The YubiKey 5 NFC supports FIDO2/WebAuthn, OTP and smart card protocols, so your logins don't rest on a password alone, and it works over USB-A or NFC with a phone.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: blog.cr.yp.to, 2026-09-01
Published there as: “Bugs happen: The easy way to compare solo PQ to ECC+PQ”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.