● Covered by 1 source · 1 reportMedium impact1 negative
Software Bugs Make Solo Post-Quantum Cryptography an Inexcusable Security Risk
Key points
- Solo PQ is riskier than ECC+PQ due to software bugs.
- ML-DSA and ML-KEM implementations have had bugs and timing leaks.
- Examples include a 2017 Dilithium bug and KyberSlash timing leaks.
- Hybrid ECC+PQ maintains existing security while adding PQ protection.
The Risk of Solo Post-Quantum Cryptography
The debate between upgrading cryptographic protocols to ECC+PQ (Elliptic Curve Cryptography plus Post-Quantum) versus switching to solo PQ (Post-Quantum only) highlights a critical security concern. Proponents of ECC+PQ argue that relying solely on new post-quantum algorithms without the established security of ECC is an unacceptable risk due to the high likelihood of software bugs in new implementations.
Historical Vulnerabilities in PQ Implementations
Experience with cryptographic libraries shows a history of vulnerabilities. Implementations of Dilithium (ML-DSA) and Kyber (ML-KEM) have already exhibited various bugs and timing leaks. Notable issues include a bug in the original official Dilithium implementation in 2017 and two timing leaks, KyberSlash1 and KyberSlash2, present in official reference Kyber implementations from 2017 through late 2023. Most Kyber/ML-KEM implementations subsequently issued patches for KyberSlash.
Why Software Bugs Are a Major Concern
The argument against solo PQ emphasizes that security readers, often software experts themselves, can readily understand the implications of software bugs. The predictable influx of software bugs in new post-quantum software is estimated to lead to a significant number of breakable keys, particularly for ML-KEM due to its higher usage rate compared to signature keys. This makes the software argument a difficult one for solo PQ advocates to counter.
Beyond Software: Spec Vulnerabilities
While software bugs are a primary focus, there is also a risk of vulnerabilities within the PQ specifications themselves, which could affect all software based on that spec. However, some claims of stability regarding ML-KEM and ML-DSA specifications are viewed as pseudoscience, potentially misleading those who are not sufficiently skeptical of such assertions.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub celabshq/libcrux GitHub veorq/awesome-post-quantum arXiv 2107.04940 CVE CVE-2026-419904.0 MEDIUM CVE CVE-2026-227056.4 MEDIUM CVE CVE-2026-248505.3 MEDIUMReporting from
Upgrading cryptographic protocols to use only post-quantum (PQ) algorithms like ML-KEM and ML-DSA, rather than combining them with existing ECC, introduces significant security risks due to inevitable software bugs. Past implementations of PQ algorithms have already shown vulnerabilities, including timing leaks and other defects, making a solo PQ approach less secure than a hybrid ECC+PQ strategy.