[raron]

> Since then, public cryptographic research has been ahead or even with state work.

How can we know that?

> Who knows what is happening inside the NSA or military facilities?

Couldn't have NSA found an issue with ML-KEM and try to convince people to use it exclusively (not in hybrid scheme with ECC)?

[tptacek]

Couldn't NSA have not known about an issue with ML-KEM, and thus wanted to prevent its commercial acceptance, which it did simply by approving the algorithm?

What's the PQC construction you couldn't say either thing about?

[deknos]

> Couldn't NSA have not known about an issue with ML-KEM, and thus wanted to prevent its commercial acceptance, which it did simply by approving the algorithm?

Could, but they did not do that. So, the question is to be stated: Why?

[tptacek]

I think you may have missed my point.

[goalieca]

Follow nsa suite-b and what the USA forces on different levels of classification.

[formerly_proven]

Kyber/ML-KEM-only is exactly the suite b (CNSA 2) recommendation.