
Post-quantum confidentiality for TLS - jgrahamc
https://www.imperialviolet.org/2018/04/11/pqconftls.html
======
DanGarcia595
I could be reading this wrong but in the article it seems like SI has the
advantage of key size and SL has the advantage of performance. I understand
the sentiment of subtle bugs in elliptic-curve implementations and the new
field of Supersingular-Isogenies, but in general algorithms are optimized and
improved, but key sizes don't change too much.

If that's the case, why go with SL over SI?

~~~
chasil
If I am reading this correctly, there is one SI submission, SIKE. Microsoft is
intimately involved, although it appears that Amazon, Texas Instruments, and
Infosec have made major contributions.

[https://github.com/Microsoft/PQCrypto-
SIKE](https://github.com/Microsoft/PQCrypto-SIKE)

~~~
tptacek
A bunch of work on making Supersingular Isogeny DH (what SIKE is based on)
viable was done at Microsoft Research.

