I'm afraid you've misunderstood. These codepoints are for the pure MLKEM key establishment that DJB is railing against.
All of these libraries also support the hybrid forms, which have different codepoints and are used by default. Nothing in the IETF process has any bearing on this.
Does the specification recommend using a hybrid? At the level of at least SHOULD if not MUST, in the sense of RFC 2119? I have the opposite impression but haven't checked.
Comments
I'm afraid you've misunderstood. These codepoints are for the pure MLKEM key establishment that DJB is railing against.
All of these libraries also support the hybrid forms, which have different codepoints and are used by default. Nothing in the IETF process has any bearing on this.
Does the specification recommend using a hybrid? At the level of at least SHOULD if not MUST, in the sense of RFC 2119? I have the opposite impression but haven't checked.
In effect, yes it does.
The Recommended flag is set for X25519MLKEM768. It is not set for any of the pure PQ key exchanges.
https://www.iana.org/assignments/tls-parameters/tls-paramete...