Hacker News Reader

The outputs of an RLWE and ECDH handshake are both fed into the TLS KDF.

Thanks for the info. May I ask if you figured that out from the blog or BoringSSL code?

The hybrid ciphersuite idea comes from [1, Section 5.2], though you could also chalk it up to common sense. I don't think the blog spells out how it's done.

[1] https://eprint.iacr.org/2014/599

Adam Langley answered this on HN: https://news.ycombinator.com/item?id=12051438

Reply on news.ycombinator.com