{"id":46076499,"user":"westurner","time":1764316465,"time_ago":"2 months ago","type":"comment","content":"

Is this the thing with ML-KEM, then:

> [With AuthKEM,] you would replace the ~2.4 KB ML-DSA signature with a ~1 KB ML-KEM ciphertext.","comments":[{"id":46078288,"user":"durumcrustulum","time":1764335012,"time_ago":"2 months ago","type":"comment","content":"

What "the thing"? AuthKEM isn't being deployed anywhere.","comments":[{"id":46081119,"user":"westurner","time":1764353307,"time_ago":"2 months ago","type":"comment","content":"

How much more complex is the difference than 2.4 KB w/ ML-DSA or ~1 KB w/ ML-KEM?","comments":[{"id":46115712,"user":"durumcrustulum","time":1764635656,"time_ago":"2 months ago","type":"comment","content":"

I'm sorry I don't understand what you're asking","comments":[{"id":46130301,"user":"westurner","time":1764736021,"time_ago":"2 months ago","type":"comment","content":"

Though there is a difference between a cert signature (ML-DSA) and a challenge (ML-KEM), ultimately and fundamentally, isn't real key size still a relevant metric for comparison.

(Everyone dnvoted this like -6/-7. I guess they didn't understand the relevance.)

IDK a terse analogy then:

MerkleCerts + ML-DSA : ML-DSA :: \nChallenge (ML-KEM,) : ____ (ML-DSA)

Merkle-signing cert trust roots is a security/bytes-transferred efficiency tradeoff.

What is the difference in number of bytes seemed usefully relevant to me at least.","comments":[],"comments_count":0,"level":3,"url":"item?id=46130301"}],"comments_count":1,"level":2,"url":"item?id=46115712"}],"comments_count":2,"level":1,"url":"item?id=46081119"}],"comments_count":3,"level":0,"url":"item?id=46078288"}],"comments_count":4,"url":"item?id=46076499"}

Comment by westurner