Bugs happen: Why solo PQ is an inexcusable security disaster
Bugs happen: The easy way to compare solo PQ to ECC+PQ
Daniel J. Bernstein argues that switching cryptographic protocols from ECC to solo post-quantum (PQ) cryptography is a security disaster waiting to happen, because PQ software will inevitably have bugs. He advocates for hybrid ECC+PQ schemes, where ECC remains as a safety net. The post catalogs recent vulnerabilities in ML-KEM and ML-DSA implementations, including KyberSlash and multiple CVEs in 2026, and systematically dismantles arguments from solo PQ proponents.
The libraries with CVEs or other bugs announced so far for ML-DSA code in 2026 include libcrux, libcrux again, libgcrypt, RustCrypto, RustCrypto again, wolfSSL, and wolfSSL again.
- Retr0id
I used to be pro-hybrid but I feel much more on the fence about it nowadays.
ECC software can have flaws too but I don't think anyone seriously suggested hybridizing two different ECC implementations, for example.
- rot256
Don't buy the argument, this stuff is simple enough that we can formally verify and audit it very carefully.
Additionally, NIST had the foresight to derandomize all the algorithms, so we can now check e.g. what a correct implementation will produce on particular seeds. This is a big deal because a bunch of e.g. ECDSA bugs, such as biased nonces or reused nonces, are trivally caught by such tests/derandomization.
TLDR: the bugs are going to be elsewhere.
- libeclipse
Why don't we use hybrid RSA and ECC then? Or hybrid AES and ChaCha20?
Software bugs is a weak argument for a new hybrid standard, and doesn't justify the additional complexity.