> Additionally, SPHINCS+ will be standardized to avoid only relying on the security of lattices for signatures
> Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices
What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach?
Is this a security concern, or is there some performance (ops/sec or size) related trade-off?
> Both BIKE and HQC are based on structured codes, and either would be suitable as a general-purpose KEM that is not based on lattices
What's up with this caveat? Why would the standard require algorithms not based on lattices assuming there is confidence in the lattice based approach?
Is this a security concern, or is there some performance (ops/sec or size) related trade-off?