September 25, 2026 at 1:21 AM
Bernstein's main achievements, by decade:
1990s: Bernstein v. United States
2000s: ChaCha20, Poly1305, Curve25519, Ed25519
2010s: SPHINCS
2020s: sabotaging the post-quantum transition
This is so f***ing frustrating. And sad. But mostly frustrating.
1990s: Bernstein v. United States
2000s: ChaCha20, Poly1305, Curve25519, Ed25519
2010s: SPHINCS
2020s: sabotaging the post-quantum transition
This is so f***ing frustrating. And sad. But mostly frustrating.
[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)
Search IETF mail list archives
mailarchive.ietf.org
June 28, 2026 at 9:11 AM
Bernstein's main achievements, by decade:
1990s: Bernstein v. United States
2000s: ChaCha20, Poly1305, Curve25519, Ed25519
2010s: SPHINCS
2020s: sabotaging the post-quantum transition
This is so f***ing frustrating. And sad. But mostly frustrating.
1990s: Bernstein v. United States
2000s: ChaCha20, Poly1305, Curve25519, Ed25519
2010s: SPHINCS
2020s: sabotaging the post-quantum transition
This is so f***ing frustrating. And sad. But mostly frustrating.
bertie.cryspen.com now available with mlkem TLS and Bertie
We've launched bertie.cryspen.com with mlkem TLS, powered by our Bertie TLS 1.3 implementation. This provides a secure and efficient endpoint for your applications.
Read more here: https://buff.ly/3ZOiJT3
#mlkem #TLS #pqc
We've launched bertie.cryspen.com with mlkem TLS, powered by our Bertie TLS 1.3 implementation. This provides a secure and efficient endpoint for your applications.
Read more here: https://buff.ly/3ZOiJT3
#mlkem #TLS #pqc
X25519MLKEM768 TLS-Handshake in Bertie
bertie.cryspen.com
December 24, 2024 at 9:54 AM
bertie.cryspen.com now available with mlkem TLS and Bertie
We've launched bertie.cryspen.com with mlkem TLS, powered by our Bertie TLS 1.3 implementation. This provides a secure and efficient endpoint for your applications.
Read more here: https://buff.ly/3ZOiJT3
#mlkem #TLS #pqc
We've launched bertie.cryspen.com with mlkem TLS, powered by our Bertie TLS 1.3 implementation. This provides a secure and efficient endpoint for your applications.
Read more here: https://buff.ly/3ZOiJT3
#mlkem #TLS #pqc
nsa.2026.action.cr.yp.to
"NSA's SIGINT Enabling Project includes sabotaging cryptographic standards. NSA is now overtly paying for standardization of "ietf-tls-mlkem", a weakening of the much more sensible "ietf-tls-ecdhe-mlkem".
"NSA's SIGINT Enabling Project includes sabotaging cryptographic standards. NSA is now overtly paying for standardization of "ietf-tls-mlkem", a weakening of the much more sensible "ietf-tls-ecdhe-mlkem".
nsa.2026.action.cr.yp.to
June 27, 2026 at 10:42 PM
nsa.2026.action.cr.yp.to
"NSA's SIGINT Enabling Project includes sabotaging cryptographic standards. NSA is now overtly paying for standardization of "ietf-tls-mlkem", a weakening of the much more sensible "ietf-tls-ecdhe-mlkem".
"NSA's SIGINT Enabling Project includes sabotaging cryptographic standards. NSA is now overtly paying for standardization of "ietf-tls-mlkem", a weakening of the much more sensible "ietf-tls-ecdhe-mlkem".
I am not part of the drama, but isn’t his argument that hybrid mlkem+ecdhe is better than mlkem alone given that mlkem is relatively new and given the recent sike and rainbow stories one should exercise caution? Am I wrong?
June 28, 2026 at 12:27 PM
I am not part of the drama, but isn’t his argument that hybrid mlkem+ecdhe is better than mlkem alone given that mlkem is relatively new and given the recent sike and rainbow stories one should exercise caution? Am I wrong?
I released Graviola 0.4.0 yesterday, with a new and quite quick ML-KEM-768 implementation. More perf work to do on this, but it is already quicker than libcrux-ml-kem, and competitive with mlkem-native on ARM64. And still builds mega fast!
Consider supporting this work on github.com/sponsors/ctz
Consider supporting this work on github.com/sponsors/ctz
June 18, 2026 at 6:07 AM
I released Graviola 0.4.0 yesterday, with a new and quite quick ML-KEM-768 implementation. More perf work to do on this, but it is already quicker than libcrux-ml-kem, and competitive with mlkem-native on ARM64. And still builds mega fast!
Consider supporting this work on github.com/sponsors/ctz
Consider supporting this work on github.com/sponsors/ctz
ML-KEM v1.0.0
github.com/pq-code-pack...
github.com/pq-code-pack...
GitHub - pq-code-package/mlkem-native: Secure, fast, and portable C90… | Hanno Becker
Formal is Fast!
Happy to announce v1 of mlkem-native (https://lnkd.in/gcDHZPzi), a C/ASM implementation of ML-KEM using automated reasoning to bridge assurance, performance, and maintainability.
mlk...
www.linkedin.com
June 5, 2025 at 6:21 AM
ML-KEM v1.0.0
github.com/pq-code-pack...
github.com/pq-code-pack...
Rebased an old community contribution from 2021 that adds Armv8.2 SHA-3 instruction support. (Debugged by another community member!)
-50% on crypto/sha3 and -13% on crypto/mlkem on Apple M2!
But apparently it's slower than pure Go on AWS Graviton 3!?
https://go.dev/cl/667675
-50% on crypto/sha3 and -13% on crypto/mlkem on Apple M2!
But apparently it's slower than pure Go on AWS Graviton 3!?
https://go.dev/cl/667675
April 23, 2025 at 10:03 PM
Rebased an old community contribution from 2021 that adds Armv8.2 SHA-3 instruction support. (Debugged by another community member!)
-50% on crypto/sha3 and -13% on crypto/mlkem on Apple M2!
But apparently it's slower than pure Go on AWS Graviton 3!?
https://go.dev/cl/667675
-50% on crypto/sha3 and -13% on crypto/mlkem on Apple M2!
But apparently it's slower than pure Go on AWS Graviton 3!?
https://go.dev/cl/667675
hybrid kex in tls 1.3 is the easiest case, but either way not having an rfc for mlkem, without hauling the extra curve compute (mlkem is faster at security above '128bit') feels like a gap
July 1, 2026 at 9:22 PM
hybrid kex in tls 1.3 is the easiest case, but either way not having an rfc for mlkem, without hauling the extra curve compute (mlkem is faster at security above '128bit') feels like a gap
I may be cringe, but I'm not "tell a native German speaker to use AI to translate a German phrase" cringe.
mailarchive.ietf.org/arch/msg/tls...
mailarchive.ietf.org/arch/msg/tls...
[TLS] Re: WG Last Call: draft-ietf-tls-mlkem-08 (Ends 2026-07-08)
Search IETF mail list archives
mailarchive.ietf.org
July 15, 2026 at 3:11 PM
I may be cringe, but I'm not "tell a native German speaker to use AI to translate a German phrase" cringe.
mailarchive.ietf.org/arch/msg/tls...
mailarchive.ietf.org/arch/msg/tls...
All this debate about whether MLKEM breaks formal methods results on the TLS protocol, when the answer all along was simply to deploy Additive Cryptography.
February 25, 2026 at 1:23 AM
All this debate about whether MLKEM breaks formal methods results on the TLS protocol, when the answer all along was simply to deploy Additive Cryptography.
I think the NSA’s insistence on pure MLKEM in TLS also suggests the timeline is a lot shorter than we thought. To me, it suggests they have similar predictions internally.
Which is a shame because we were starting to get some cool new primitives: OPRF, VRF, etc.
Which is a shame because we were starting to get some cool new primitives: OPRF, VRF, etc.
April 6, 2026 at 10:34 PM
I think the NSA’s insistence on pure MLKEM in TLS also suggests the timeline is a lot shorter than we thought. To me, it suggests they have similar predictions internally.
Which is a shame because we were starting to get some cool new primitives: OPRF, VRF, etc.
Which is a shame because we were starting to get some cool new primitives: OPRF, VRF, etc.
There are now 18 "votes" on draft-ietf-tls-mlkem by people who never before emailed the WG, and without an In-Reply-To header (suggesting senders were not subscribed).
2 in favor vs. 16 against. The rest are 41 vs. 9.
If this campaign by Bernstein is allowed, the IETF is just a popularity contest.
2 in favor vs. 16 against. The rest are 41 vs. 9.
If this campaign by Bernstein is allowed, the IETF is just a popularity contest.
June 30, 2026 at 12:33 PM
There are now 18 "votes" on draft-ietf-tls-mlkem by people who never before emailed the WG, and without an In-Reply-To header (suggesting senders were not subscribed).
2 in favor vs. 16 against. The rest are 41 vs. 9.
If this campaign by Bernstein is allowed, the IETF is just a popularity contest.
2 in favor vs. 16 against. The rest are 41 vs. 9.
If this campaign by Bernstein is allowed, the IETF is just a popularity contest.
I released Graviola 0.4.1 yesterday, which improves ML-KEM-768 performance via the parallel SHAKE strategy -- compared to mlkem-native as included in aws-lc it is now 30% quicker on aarch64 and 8% quicker on x86-64 for combined keygen+encaps+decaps.
I released Graviola 0.4.0 yesterday, with a new and quite quick ML-KEM-768 implementation. More perf work to do on this, but it is already quicker than libcrux-ml-kem, and competitive with mlkem-native on ARM64. And still builds mega fast!
Consider supporting this work on github.com/sponsors/ctz
Consider supporting this work on github.com/sponsors/ctz
June 25, 2026 at 11:25 AM
I released Graviola 0.4.1 yesterday, which improves ML-KEM-768 performance via the parallel SHAKE strategy -- compared to mlkem-native as included in aws-lc it is now 30% quicker on aarch64 and 8% quicker on x86-64 for combined keygen+encaps+decaps.
This is the best argument I've seen that there is not a NOBUS backdoor in MLKEM. Simple entropy argument.
The longer, better explained version by @sophieschmieg.infosec.exchange.ap.brid.gy.
ML-KEM Mythbusting
What is this? There have been some recent concerns about ML-KEM, NIST’s standard for encryption with Post-Quantum Cryptography, related standards of the IETF, and lots of conspiracy theories …
keymaterial.net
November 28, 2025 at 11:42 AM
This is the best argument I've seen that there is not a NOBUS backdoor in MLKEM. Simple entropy argument.
There's only one correct way forward for handling the introduction of MLKEM into TLS, and, indeed, all future tls-wg cryptography debates, and it's this proposal:
snkth.com/add-crypto/
snkth.com/add-crypto/
Additive Cryptography for TLS
This document defines Additive Cryptography for TLS, a transition
framework in which algorithms are never replaced and only accreted.
Implementations MUST NOT negotiate a single key exchange algorithm...
snkth.com
February 25, 2026 at 1:22 AM
There's only one correct way forward for handling the introduction of MLKEM into TLS, and, indeed, all future tls-wg cryptography debates, and it's this proposal:
snkth.com/add-crypto/
snkth.com/add-crypto/
mlkem and mldsa are very fast period
September 26, 2025 at 7:09 PM
mlkem and mldsa are very fast period
After doing a bit of research the whole NSA arc was a distraction to my understanding of the story.
The options are not how Bernstein act like they are: ietf-tls-mlkem vs ietf-tls-ecdhe-mlkem
They are infact: ietf-tls-mlkem + ietf-tls-ecdhe-mlkem vs ietf-tls-ecdhe-mlkem
The options are not how Bernstein act like they are: ietf-tls-mlkem vs ietf-tls-ecdhe-mlkem
They are infact: ietf-tls-mlkem + ietf-tls-ecdhe-mlkem vs ietf-tls-ecdhe-mlkem
June 29, 2026 at 6:54 AM
After doing a bit of research the whole NSA arc was a distraction to my understanding of the story.
The options are not how Bernstein act like they are: ietf-tls-mlkem vs ietf-tls-ecdhe-mlkem
They are infact: ietf-tls-mlkem + ietf-tls-ecdhe-mlkem vs ietf-tls-ecdhe-mlkem
The options are not how Bernstein act like they are: ietf-tls-mlkem vs ietf-tls-ecdhe-mlkem
They are infact: ietf-tls-mlkem + ietf-tls-ecdhe-mlkem vs ietf-tls-ecdhe-mlkem
Future paper title: "My MLKEM SHAKE Brings All The Boys To The Yard"
October 26, 2024 at 8:03 AM
Future paper title: "My MLKEM SHAKE Brings All The Boys To The Yard"
Peergos now uses post-quantum encryption! A hybrid of x25519 and MLKEM is used to protect shared files (Unshared files were already quantum resistant).
github.com/Peergos/web-...
github.com/Peergos/web-...
Release Fix Post-Quantum friending upgrade · Peergos/web-ui
This release upgrades friending to use post-quantum encryption - a hybrid of X25519 and MLKEM. This means that shared files are safe against a quantum computer, now or in the future. It has a fix t...
github.com
June 30, 2025 at 11:42 AM
Peergos now uses post-quantum encryption! A hybrid of x25519 and MLKEM is used to protect shared files (Unshared files were already quantum resistant).
github.com/Peergos/web-...
github.com/Peergos/web-...
At one level, the rationale to disable MLKEM is understandable (ClientHello packet bloat can cause connectivity issues on specific MTU paths), but the issue for me is that (a) this is not documented, and (b) a security-relevant downgrade is applied in a non-reproducible way between OSS and binary.
June 9, 2026 at 6:35 PM
At one level, the rationale to disable MLKEM is understandable (ClientHello packet bloat can cause connectivity issues on specific MTU paths), but the issue for me is that (a) this is not documented, and (b) a security-relevant downgrade is applied in a non-reproducible way between OSS and binary.
The directive to disable MLKEM exists in _none_ of Tailscale's public source AFAICT - not the app, not the build scripts, not the Go fork. I assume it's applied as a pre-build or post-build step in their private release pipeline. So the shipped clients are not reproducible from public source.
June 9, 2026 at 6:30 PM
The directive to disable MLKEM exists in _none_ of Tailscale's public source AFAICT - not the app, not the build scripts, not the Go fork. I assume it's applied as a pre-build or post-build step in their private release pipeline. So the shipped clients are not reproducible from public source.
This new graviola release is amazing!
aws-lc-rs v1.17.0: 18 dependencies - 16s release build
rustls-graviola v0.3.4: 45 dependencies - 9s release build
rustls-graviola v0.4.0: 19 dependencies - 5.5s release build
Tested on a 24 vCPU 5950X VM.
github.com/ctz/graviola...
aws-lc-rs v1.17.0: 18 dependencies - 16s release build
rustls-graviola v0.3.4: 45 dependencies - 9s release build
rustls-graviola v0.4.0: 19 dependencies - 5.5s release build
Tested on a 24 vCPU 5950X VM.
github.com/ctz/graviola...
Release 0.4.0 · ctz/graviola
A new ML-KEM-768 implementation using verified assembler from the mlkem-native project.
This drops the dependency on libcrux-ml-kem from rustls-graviola and the crate feature. Runtime performance i...
github.com
June 17, 2026 at 3:28 PM
This new graviola release is amazing!
aws-lc-rs v1.17.0: 18 dependencies - 16s release build
rustls-graviola v0.3.4: 45 dependencies - 9s release build
rustls-graviola v0.4.0: 19 dependencies - 5.5s release build
Tested on a 24 vCPU 5950X VM.
github.com/ctz/graviola...
aws-lc-rs v1.17.0: 18 dependencies - 16s release build
rustls-graviola v0.3.4: 45 dependencies - 9s release build
rustls-graviola v0.4.0: 19 dependencies - 5.5s release build
Tested on a 24 vCPU 5950X VM.
github.com/ctz/graviola...
👏 Great talk by Sam Burns! From quantum threats to Go’s crypto/mlkem package — a fascinating look at how Go is preparing for tomorrow’s challenges. 🚀
#golang #golab2025
#golang #golab2025
October 7, 2025 at 3:15 PM
👏 Great talk by Sam Burns! From quantum threats to Go’s crypto/mlkem package — a fascinating look at how Go is preparing for tomorrow’s challenges. 🚀
#golang #golab2025
#golang #golab2025
April 19, 2024 at 6:37 PM