一位密码学专家通过分析软件漏洞数据，论证在后量子密码部署中保留椭圆曲线密码（ECC）层优于单独使用后量子（PQ）算法1。这位专家自2016年起就开始推荐ECC+PQ的混合方案，并于2024年提出"始终从ECC升级到PQ+ECC而非抛弃ECC层"的核心规则1。
ML-KEM和ML-DSA等新型后量子算法的软件实现存在多个已知漏洞1。Dilithium在2017年曾发现bug，而KyberSlash1和KyberSlash2两个漏洞在官方Kyber实现中从2017年持续存在至2023年末1。密码库平均每1000行代码产生1个CVE，其中八分之一为严重漏洞，而单个ML-KEM实现通常超过1000行代码1。2017年Kyber原始论文声称软件以常数时间运行防御定时攻击，但KyberSlash实际证明并非如此，用时超过6年才被发现并修复1。2026年6月允许移除ECC的投票后仅一天，即6月25日，宣布了CVE-2026-6330 ML-KEM软件bug1。
已报告的2026年ML-DSA代码库CVE包括libcrux（两次）、libgcrypt、RustCrypto（两次）和wolfSSL（两次）1。单独使用PQ会导致数百万用户因软件缺陷而立即暴露于攻击，而ECC层可显著降低这类风险1。Cloudflare 2025年9月报告显示，95%的后量子HTTPS连接使用X25519MLKEM768（ECC+PQ混合方案），纯ML-KEM仅占0.01%1。IETF在TLS规范中为ECC+ML-KEM提供三个选项，每个仅需在现有ECC和ML-KEM软件基础上增加几行代码1。
A cryptography researcher has made a case for retaining elliptic curve cryptography (ECC) alongside post-quantum (PQ) algorithms rather than abandoning ECC entirely, citing widespread vulnerabilities in software implementations of new PQ standards.1 The argument centers on the practical reality that ML-KEM and ML-DSA, the emerging post-quantum algorithms, have already accumulated multiple known bugs in their software implementations, including KyberSlash vulnerabilities that persisted from 2017 to late 2023 and CVE-2026-6330, which was disclosed on June 25, 2026—notably one day after a vote permitting ECC removal.1
The researcher established a principle in 2024 that organizations should always upgrade to ECC+PQ combinations rather than discard the ECC layer entirely.1 Analysis of cryptographic libraries indicates that roughly one bug emerges per thousand lines of code, with approximately one in eight being severe, and typical ML-KEM implementations exceed one thousand lines.1 Reported ML-DSA code vulnerabilities in 2026 have affected major cryptographic libraries including libcrux, libgcrypt, RustCrypto, and wolfSSL.1 Real-world deployment patterns support this hybrid approach: Cloudflare reported in September 2025 that ninety-five percent of post-quantum HTTPS connections use X25519MLKEM768, a hybrid scheme, while pure ML-KEM accounts for only 0.01 percent.1 The IETF has standardized three options for combining ECC and ML-KEM in TLS specifications, each requiring only minor additions to existing ECC and ML-KEM software implementations.1
评论
还没有评论，欢迎留下第一条。