[tptacek]

The outputs of an RLWE and ECDH handshake are both fed into the TLS KDF.

[cm3]

Thanks for the info. May I ask if you figured that out from the blog or BoringSSL code?

[pbsd]

The hybrid ciphersuite idea comes from [1, Section 5.2], though you could also chalk it up to common sense. I don't think the blog spells out how it's done.

[1] https://eprint.iacr.org/2014/599

[wolf550e]

Adam Langley answered this on HN: https://news.ycombinator.com/item?id=12051438