Tag
作者批评 ML-DSA 和 Ed25519 在签名时先对公钥哈希的做法，认为这破坏了验证端先哈希消息再逐个试验签名密钥的高效流程，并建议把公钥哈希拼接在消息末尾以保留流式哈希的优势。
Filippo Valsorda 更新了经典的《Cryptographic Right Answers》指南，为开发者给出面向后量子时代的加密推荐，包括 ML-KEM-768+X25519 密钥交换、ML-DSA-44 签名以及 XAES-256-GCM/XChaCha20Poly1305 数据加密，并强调 2029 年前完成后量子迁移的紧迫性。
A detailed overview of the ongoing transition to post-quantum cryptography, covering NIST's standardization of ML-KEM and ML-DSA, the 'harvest now, decrypt later' threat, hybrid key exchange adoption, and the fragmentation of PKI into MTC and X.509 with ML-DSA.
Apple published formal verification methods and tools for their corecrypto library's quantum-secure algorithms ML-KEM and ML-DSA, providing mathematical proofs of correctness and releasing the implementations for independent evaluation.