It's normal for post-quantum cryptography to be rolled out as an extra layer of security on top of traditional pre-quantum cryptography, rather than as a replacement.
For example, Google's CECPQ1 experiment was double encryption with traditional pre-quantum ECC (specifically X25519) and post-quantum NewHope1024. CECPQ2, a joint experiment between Google and Cloudflare, was ECC+NTRUHRSS701. CECPQ2b was ECC+SIKEp434. Ten SSH implementations support ECC+sntrup761. Today's usage of post- quantum cryptography by browsers is approaching half of the connections seen by Cloudfiare, where 95% of that is ECC+MLKEM768 and 5% is ECC+Kyber768
If post-quantum cryptography is designed to be super-strong, so strong that it even survives future quantum computers, then why are we keeping the ECC layer? Same reason that you wear your seatbelt: in the real world, cars sometimes crash, and seatbelts reduce the damage.
2025.10.04: NSA and IETF: Can an attacker simply purchase standardization of weakened cryptography?
blog.cr.yp.to/20251004-wea...
#PQcrypto #hybrids #NSA #IETF #antitrust