They are slower, larger, and less tested. Specifically the hope was to develop hybrids that could also provably be more pre-quantum secure then what they are replacing. History dose not favour rushing cryptography.

▲

bwesterb 3 days ago | parent | next [-]

They are large, but they're not that slow actually. We've been testing them for almost a decade now. I agree that rushing is bad. That's why we need to start moving now, so that we're not rushing even closer to the deadline.

▲

Hendrikto 3 days ago | parent | prev [-]

You misread the comment you replied to.

	▲	KAMSPioneer 3 days ago \| parent [-]
		Which, to be fair, is easy to do because they used a triple-negative. Rephrased, they meant to say "there is no reason to remove support for quantum-vulnerable algorithms in the near future." IMO that's much less likely to be accidentally misinterpreted.