[JuniperMesos]

The classical cipher component is additonal complexity in the protocol and maybe some meaningful amount of additonal time to compute and key data to store/transmit, is it not? I can see why we'd like to avoid effectively encrypting the same data twice with different protocols, one of which is known to be vulnerable to quantum computer based attacks.

[vrighter]

good thing quantum computers that can factor numbers have never been built. No number was ever really factored without cheating, the actual shor's algorithm has never been implemented. And we're not really any closer to

[ameliaquining]

That last sentence is not true; we have gotten much closer to building a quantum computer that can run Shor's algorithm. Organizations like Google and Cloudflare have declared a 2029 deadline to completely stop depending on the security of pre-quantum algorithms; hitting that deadline is going to cost a lot of engineering resources, but they're paying that cost because they think there's too great a chance that nation-state adversaries will have scalable quantum computers by then. See https://words.filippo.io/crqc-timeline/ and the various posts linked therein, including from the aforementioned companies.

[IsTom]

Have they factored 21 yet? That metric hasn't changed for some time.

[ameliaquining]

That's not a very useful benchmark if the thing you care about is CRQC timelines. See https://bas.westerbaan.name/notes/2026/04/02/factoring.html (which the above post links to) for an explanation of why.

[quotemstr]

Classic ciphers are damn fast and small compared to PQC. If you're doing PQC anyway, doing classical cryptography at the same time has negligible cost.

That makes attempts to push PQC-only modes super suspicious to me. Smells like Dual_EC_DRBG.