From Fear to Hybrid: Making PQC Less Scary

European agencies such as ANSSI and BSI recommend the hybrid use of post-quantum cryptographic algorithms alongside traditional schemes, driven by concerns regarding the maturity and long-term security assurance of purely post-quantum solutions. This talk focuses on two prominent approaches to fulfilling this requirement through compound algorithms: the IETF's composite signatures and KEMs, as well as Intelligent Composed Algorithms.

The original motivations behind each approach and their respective design decisions will be presented in detail, including the cryptographic construction and the security properties they aim to achieve. The advantages and drawbacks of both approaches will be examined, highlighting how they can contribute to crypto agility and how they differ from other hybridization concepts such as hybrid certificates or multiple signatures. The talk also addresses current interoperability considerations and implementation challenges. Finally, the state of standardization within the IETF and other relevant bodies will be reviewed, alongside existing support and an outlook on future work in the field of hybrid algorithms.