Comment by sebstefan

>much in line with my reasoning, 0x11EC is the default key exchange algorithm used by Chrome, Firefox, and pretty much all other TLS clients that currently support PQC. So what’s the point of MLKEM1024? Well it turns out there is one customer who really really hates hybrids, and only wants to use ML-KEM1024 for all their systems. *And that customer happens to be the NSA.* And honestly, I do not see a problem with that.

...Really, you don't? I can hardly imagine anything more suspicious

>the US plans to use ML-KEM themselves, [a “Nobody but us backdoor”] would be the only backdoor they could reasonably insert into a standard.

Is that really convincing

And secondly, would we really know in advance? They can say that and then just use X25519MLKEM768 exclusively for stuff that matters.

I'm convinced they would love a broken algorithm in the IETF standard.