Skip to main content
EP Cybertools Logo
NEW Visit News Portal
PQC Updates · Engineering briefing Español

Post-quantum cryptography: what is live today and what lands next

A sourced, engineer-to-engineer briefing on the quantum threat, the NIST standards, hybrid TLS and SSH in production, government deadlines through 2035, and a practical migration path.

Test your site’s PQC readiness → Daily PQC news

Last updated:

65%+

of human HTTPS traffic to Cloudflare already uses PQ key agreement (Apr 2026)

Cloudflare post-quantum roadmap (Apr 2026)
3

final NIST PQC standards: FIPS 203, 204 and 205 (Aug 2024)

NIST news, Aug 13 2024
2030

NIST draft: 112-bit RSA/ECC deprecated after this year

NIST IR 8547 (initial public draft)
2035

quantum-vulnerable public-key algorithms disallowed (NIST draft IR 8547)

NIST IR 8547 (initial public draft)

Why the clock is already running

Shor’s algorithm lets a cryptographically relevant quantum computer (CRQC) solve integer factorization and discrete logarithms efficiently. That breaks RSA, finite-field Diffie-Hellman, ECDH, ECDSA and EdDSA — every public-key primitive the Internet uses today.

Symmetric crypto fares better: Grover’s algorithm gives at most a quadratic speed-up, so AES-256 and SHA-256/384 remain the recommended choices. The urgent work is all on the public-key side.

Resource estimates keep falling. That is why agencies set hard dates even though nobody can name the year a CRQC arrives.

How big must a quantum computer be?

RSA-2048

Could be factored in under a week with fewer than one million noisy qubits (Gidney, May 2025) — a 20× cut versus the 2019 estimate.

Gidney 2025, arXiv:2505.15917
256-bit elliptic curves

Google Quantum AI (Mar 2026) estimates fewer than 1,200 logical qubits and under 500,000 physical qubits to break 256-bit ECDLP.

Google Quantum AI 2026, arXiv:2603.28846

Harvest now, decrypt later

Traffic recorded today can be decrypted once a CRQC exists. If your data must stay confidential for longer than the time left until then, it is already at risk — which is why key agreement moved first.

Harvest now, decrypt laterEncrypted traffic is captured today → Stored for years at low cost → A future quantum computer recovers the key → Today’s secrets are exposedTODAYYEARSQ-DAYUserServerAdversaryArchive|ψ⟩Quantum computerplaintext
  1. 1Encrypted traffic is captured today
  2. 2Stored for years at low cost
  3. 3A future quantum computer recovers the key
  4. 4Today’s secrets are exposed

The standards: final, drafting and in the pipeline

NIST finalized three standards in August 2024. Two more are in progress, and an “on-ramp” is evaluating additional signature schemes that do not depend on lattices.

FIPS 203 Final · Aug 13 2024

ML-KEM

Key encapsulation (lattice)

Based on: CRYSTALS-Kyber

NIST FIPS 203 (ML-KEM)
FIPS 204 Final · Aug 13 2024

ML-DSA

Digital signature (lattice)

Based on: CRYSTALS-Dilithium

NIST FIPS 204 (ML-DSA)
FIPS 205 Final · Aug 13 2024

SLH-DSA

Digital signature (hash-based, stateless)

Based on: SPHINCS+

NIST FIPS 205 (SLH-DSA)
FIPS 206 Draft not yet published (Oct 2026)

FN-DSA

Digital signature (NTRU lattice, compact)

Based on: Falcon

NIST PQC project
On-ramp Round 3 announced May 2026

Round 3

Additional signatures (non-lattice diversity)

Based on: FAEST, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV

NIST IR 8610
  • FN-DSA (FIPS 206) is the compact Falcon-based signature. NIST said in April 2026 the draft was in the administrative approval chain; as of this update no draft has been published.
  • HQC was chosen in March 2025 as a code-based backup to ML-KEM, so a single mathematical break cannot take down all PQ key exchange. NIST expected a draft about a year after selection and a final standard in 2027.
  • SP 800-227 (Sep 2025) gives implementation guidance for KEMs, and draft SP 800-230 (Apr 2026) adds SLH-DSA parameter sets.

NIST PQC project · NIST news: HQC selected (Mar 11 2025) · NIST IR 8610 · NIST SP 800-227 · NIST SP 800-230 (draft)

The price of quantum resistance: bytes on the wire

PQ keys and signatures are an order of magnitude larger than elliptic-curve ones. That is fine for a single key share, but it adds up in certificate chains, constrained devices and UDP-based protocols.

X25519
32 B
32 B
ECDH P-256
65 B
65 B
RSA-2048
256 B
256 B
ML-KEM-512L1
800 B
768 B
ML-KEM-768L3
1,184 B
1,088 B
ML-KEM-1024L5
1,568 B
1,568 B

Bytes, from FIPS 203/204/205 parameter tables. Logarithmic scale. ECDH P-256 shown as an uncompressed point. FIPS 203 · FIPS 204 · FIPS 205

Hybrid TLS 1.3 in one round trip

Browsers do not switch to ML-KEM alone. They combine it with X25519 so the session stays secure as long as either algorithm holds. Walk through the handshake:

Hybrid TLS 1.3 handshake with X25519MLKEM7681. ClientHello: The client sends a key share for X25519MLKEM768: an ML-KEM-768 encapsulation key plus an X25519 public key (1,216 bytes). 2. ServerHello: The server encapsulates to the ML-KEM key and returns the ciphertext plus its own X25519 share (1,120 bytes). 3. Combine: Both sides concatenate the ML-KEM shared secret and the X25519 secret and feed them into the TLS 1.3 key schedule. 4. Encrypted: Application data flows under keys an attacker would need to break both ML-KEM and X25519 to recover.ClientChrome · Firefox · SafariServerOpenSSL 3.5 · CDNClientHello · X25519MLKEM768ek(1,184 B) + X25519(32 B) = 1,216 BServerHello · ct + X25519ct(1,088 B) + X25519(32 B) = 1,120 BML-KEM ‖ X25519hybrid secretML-KEM ‖ X25519hybrid secret🔒 encrypted channel · TLS 1.3
RFC 10024 · FIPS 203

Authentication (certificates) is still classical in most deployments — the next migration wave.

Adoption is real, and fast

Share of human HTTPS requests to Cloudflare protected with post-quantum key agreement. Origins (the servers behind the CDN) lag far behind.

Adoption is real, and fastEarly 2024: <3%; Early 2025: 29%; Dec 2025: 52%; Feb 2026: >60%; Apr 2026: >65%0%25%50%75%100%<3%Early 202429%Early 202552%Dec 2025>60%Feb 2026>65%Apr 2026
Origin servers supporting PQ
Early 2025 <1%
Feb 2026 ~10%
Cloudflare Radar: origin PQ (Feb 2026) · Cloudflare Radar 2025 Year in Review · Cloudflare post-quantum roadmap (Apr 2026)

Where PQC already ships

  • TLS 1.3 X25519MLKEM768 (codepoint 0x11EC) plus SecP256r1MLKEM768 and SecP384r1MLKEM1024, standardized in RFC 10024 (Aug 2026). RFC 10024 (hybrid TLS 1.3)
  • Browsers Chrome (desktop Mar 2024, Android Nov 2024), Firefox desktop (Nov 2024) and Apple OS 26 (Oct 2025) negotiate hybrid ML-KEM by default. Cloudflare: State of the PQ Internet 2025
  • OpenSSL / Go OpenSSL 3.5 (Apr 2025) and Go 1.24 offer hybrid ML-KEM by default; OpenSSL 3.5 also adds ML-DSA and SLH-DSA. OpenSSL 3.5 release notes
  • SSH OpenSSH 10.0 (Apr 2025) made mlkem768x25519-sha256 the default key exchange; RFC 10042 documents it (Aug 2026). OpenSSH 10.0 release notes
  • PKI RFC 9881 defines ML-DSA identifiers for X.509. Chrome and Cloudflare are testing Merkle Tree Certificates to keep PQ authentication small. RFC 9881 (ML-DSA in X.509)
  • CDN origins About 10% of origin servers behind Cloudflare supported PQ key agreement in Feb 2026, up from under 1% in early 2025. Cloudflare Radar: origin PQ (Feb 2026)

Government deadlines

Regulators converge on 2030–2035. The dates below are what each body has published; NIST IR 8547 is still a draft.

European Union

  1. 2026National plans, inventories, pilots
  2. 2030High-risk use cases migrated
  3. 2035Medium-risk migrated; low-risk as feasible
EU coordinated PQC roadmap (NIS CG)

CNSA 2.0 (US national security systems)

NSA’s schedule: when CNSA 2.0 algorithms must be supported and preferred, and when they must be used exclusively.

  • Software & firmware signing 2025 → 2030
  • Web browsers, servers & cloud 2025 → 2033
  • Traditional networking (VPN, routers) 2026 → 2030
  • Operating systems 2027 → 2033
  • Niche equipment 2030 → 2033
Support & preferExclusive use

NSA CNSA 2.0 advisory · NSA CNSA 2.0 FAQ

Timeline 2016 → 2035

From the first experiments to the deadlines that are already on the calendar.

  1. 2016 Done

    NIST opens the PQC standardization process; Chrome runs its first PQ experiment (CECPQ)

    Cloudflare: State of the PQ Internet 2025
  2. Jul–Oct 2022 Done

    NIST picks Kyber, Dilithium, Falcon, SPHINCS+; NSA publishes CNSA 2.0; Cloudflare enables PQ server-side by default

    Cloudflare: State of the PQ Internet 2025
  3. Mar–Nov 2024 Done

    Chrome (desktop) enables PQ by default; FIPS 203/204/205 published Aug 13; Chrome Android and Firefox desktop follow in Nov

    NIST news, Aug 13 2024
  4. Mar–Oct 2025 Done

    HQC selected as backup KEM; OpenSSL 3.5 and OpenSSH 10.0 default to hybrid ML-KEM; EU roadmap; Apple ships PQ by default in OS 26

    NIST news: HQC selected (Mar 11 2025)
  5. May–Aug 2026 Done

    Signature on-ramp Round 3 (IR 8610); RFC 10024 standardizes hybrid TLS groups; RFC 10042 for SSH

    RFC 10024 (hybrid TLS 1.3)
  6. End of 2026 Upcoming

    EU: member states start national transition plans, inventories and pilots

    EU coordinated PQC roadmap (NIS CG)
  7. 2027 Upcoming

    CNSA 2.0: new US NSS acquisitions must comply (Jan 1); Chrome plans MTC bootstrapping (Q1) and a quantum-resistant root store (Q3); HQC standard expected

    NSA CNSA 2.0 FAQ
  8. 2028 Upcoming

    UK NCSC: discovery and migration plan completed

    UK NCSC migration timelines
  9. 2030 Upcoming

    EU high-risk systems migrated; NIST (draft) deprecates 112-bit RSA/ECC; CNSA 2.0 exclusive for signing and networking

    NIST IR 8547 (initial public draft)
  10. 2031 Upcoming

    UK NCSC: highest-priority migrations completed

    UK NCSC migration timelines
  11. 2033 Upcoming

    CNSA 2.0: exclusive use for browsers, servers, cloud and operating systems

    NSA CNSA 2.0 advisory
  12. 2035 Upcoming

    NIST (draft) disallows quantum-vulnerable public-key crypto; UK migration complete; EU medium-risk done

    NIST IR 8547 (initial public draft)

A migration plan that works

Five steps we see working in real environments. Start with the ones that protect confidentiality today.

  1. 01

    Inventory

    Find every place that uses RSA, ECDH, ECDSA or EdDSA: TLS endpoints, VPNs, SSH, code signing, HSMs, libraries and third-party SaaS. Record it as a CBOM (CycloneDX).

  2. 02

    Prioritize

    Rank by data lifetime and exposure. Long-lived secrets in transit are exposed to harvest-now-decrypt-later today; signatures matter once a quantum computer exists.

  3. 03

    Quick wins

    Enable hybrid X25519MLKEM768 on TLS terminators and mlkem768x25519-sha256 on SSH. Upgrade to OpenSSL 3.5+ / OpenSSH 10+.

  4. 04

    Crypto-agility

    Abstract algorithms behind configuration, test larger keys and handshakes (MTU, middleboxes, HSM limits) and plan certificate rotation.

  5. 05

    Signatures & PKI

    Pilot ML-DSA for code/firmware signing first (CNSA 2.0 exclusive by 2030), then follow WebPKI work on PQ certificates and MTC.

CycloneDX CBOM · OpenSSH: post-quantum · Google: quantum-safe HTTPS (MTC) · Chrome Quantum-resistant Root Program FAQ

Daily PQC news

An automated digest of standards, vendor and research updates, refreshed several times a day, with every past day archived.

Open the PQC news archive →

Check your own exposure

Run our free post-quantum readiness check against any domain: TLS groups, certificates and hybrid key exchange.

Test your site’s PQC readiness →

FAQ

Is my HTTPS traffic already post-quantum?

Probably for the key agreement, if both the browser and the server (or CDN) support X25519MLKEM768. Chrome, Firefox and Apple OS 26 offer it by default. Certificates and signatures are still classical in most cases.

Which algorithm should I use first?

ML-KEM-768 in hybrid mode (X25519MLKEM768) for TLS, and mlkem768x25519-sha256 for SSH. For signatures, ML-DSA-65 is the general-purpose choice; SLH-DSA suits long-lived roots and firmware where size matters less.

When is the quantum deadline?

Nobody knows when a CRQC will exist. The planning dates are regulatory: NIST’s draft IR 8547 deprecates 112-bit RSA/ECC after 2030 and disallows quantum-vulnerable algorithms after 2035; the EU and UK target 2030–2035 for critical systems.

Do I need to replace AES?

No. Use AES-256 and SHA-384 or stronger. Grover’s algorithm only gives a quadratic speed-up against symmetric primitives.

What is a CBOM?

A Cryptography Bill of Materials (CycloneDX) lists which algorithms, keys, certificates and protocols a system uses. It is the inventory you need to plan and prove a migration.

Primary sources

Figures are quoted from the linked sources and dated. Draft documents may change. Last updated: .