[ls612]

Is there any downside to hybrid schemes other than using a bit more compute? If so than merely being able to hedge against unknown classical algorithmic flaws in the PQC candidates (which are not nearly as battle tested as ECC) seems like enough of a reason to do it.

[some_furry]

Read https://soatok.blog/2026/04/13/hybrid-constructions-the-post... for a longer explanation.

The main thing I want to stress here is: I'm not anti-hybrid. Some people are. They tend to argue that less code / complexity is better, but you'll want to find one of them to ask directly.

[ls612]

So the argument boils down to

1. A mathematical attack against the PQC candidates would also break ECC (I have no ability to judge this claim).

2. Implementation bugs also exist in classical implementations.

#2 seems questionable to me unless you think the same implementation bugs will exist in Curve25519 and whatever PQC algorithm you are using. If the concern is side-channel attacks then that is irrelevant to a HNDL attack. But for most communications the cost of a HNDL attack being executed several years minimum from now is far lower than the cost of an implementation bug in ML-KEM breaking their security today. Whereas Curve25519 is very well tested in its standard implementations.

[some_furry]

You mostly got it, yeah. Point 1, ECC is only also broken after Q-Day.

Hybrids obviously help if you believe Q-Day is far into the future, or never coming.

But if you take Q-Day happening as possible in our lifetime, the HNDL threat means data being encrypted today depends entirely on PQ security in the long run (since breaking EC with a Quantum Computer has an attack cost of like 2^30 or so instead of 2^120 or so).

[ls612]

So it seems like it comes down to a question of risk and cost. If your threat model is that it is much more costly for your communications to be decrypted today vs in 10 years then hybrid is a good strategy.