Huh, just noticed that CNSA 2.0 mandates ML-KEM-1024, but all browsers and service providers currently implement (hybrid) X25519MLKEM*768*. So if you're an NSS system or a compliant service provider or vendor... you need to support multiple #pqc key groups, but we we currently don't even have code points for ML-KEM-1024 hybrids. So yay?
(Edit: there's SecP384r1MLKEM1024, but of course nobody has implemented that yet, I think. And we still need to solve the keygroup-selection problem.)
How do we prove our cryptography is secure? 
Join a talk by our Chief Researcher, Karthikeyan Bhargavan, on the rise of formally verified crypto! Learn how libraries like HACL* & libcrux are securing Firefox, Signal & OpenSSH with formally verified guarantees, even against quantum computers. 
We'll cover recent breakthroughs, challenges, and a vision for verifying giants like OpenSSL.
#cryptography #formalverification #cybersecurity #PQC #infosec
https://cfp.openssl-conference.org/openssl-conference-2025/talk/NPWQHG/
#PQC If you haven't already seen it, DJB has a great page on answers to common objections about post-quantum cryptography adoption https://blog.cr.yp.to/20250118-flight.html
the FAQ on this page is pretty good (and concise), and in particular this response to an assertion that quantum computers will never be practical for factoring large integers:
“If we're right about quantum computers being practical, then we will have protected vast quantities of user data. If we're wrong about it, then all we'll have done is moved to cryptographic algorithms with stronger mathematical underpinnings.” #PQC
Newest OpenSSH (10.1) will now warn users if they are not utilizing post-quantum algorithms for the current session: https://www.openssh.com/pq.html #PQC
Quantum Key Distribution is the cryptocurrency of post-quantum cryptography.
Conceptually interesting, sure, but not practically useful, doesn't actually solve the problem its advertised for, yet snake-oil salesmen peddle it left and right while business fools fall for the high buzz word density of the pitch.
I wrote a bit about Post-Quantum Cryptography Implementation Considerations in TLS for Akamai's ongoing blog series on #pqc, including keygroup preferences in OpenSSL and BoringSSL.
(And psst, PQC Akamai-to-Origin is something you can enable now, client-to-Akamai coming September 1st.)
https://www.akamai.com/blog/security/post-quantum-cryptography-implementation-considerations-tls
Researchers have established a new foundation for future quantum cryptographic protocols—not just new algorithms like the current crop of #PQC standards, but entirely new approaches to some of the primitives that modern cryptography relies on (like one-way state generators). The fundamental mathematical and quantum computing research here is still underway, but the number of open problems here is now down to one—and if quantum advantage is proven here, quantum cryptography will rely on a stronger theoretical footing than almost any classical cryptography (moving from NP-hard problems to #P-hard problems like the matrix permanent problem).
The next decade is going to be an amazing time for breakthroughs in fundamental research and new capabilities that upend assumptions that have underpinned computing for 50+ years.
https://www.quantamagazine.org/quantum-scientists-have-built-a-new-math-of-cryptography-20250725/
“Whoever develops quantum computing first will have palpable military advantages”  – that quote sums it up. The allure of being able to crack any encryption (think reading adversaries’ secret comms) has nations racing to both build quantum computers and also upgrade their own crypto (#PQC) before someone else’s quantum machine can undermine their security. It’s an arms race where qubits are the warheads... #QuantumSecurity https://postquantum.com/quantum-computing/quantum-geopolitics/
Hah, the power of not doing anything and just having your underlying library do the work:
Kubernetes since version 1.33 supports X25519MLKEM768 - automatically and simply by using Go 1.24.
The Lean roadmap for Ethereum introduces Post-Quantum security
At the consensus layer, hash-based aggregate signatures upgrade BLS signatures
At the data layer, hash-based DAS commitments upgrade KZG commitments
A ZK-friendly, possibly RISC-V-based, execution layer where a hash-based real-time zkVMs upgrades EVM re-execution
https://blog.ethereum.org/en/2025/07/31/lean-ethereum
Follow Progress: https://leanroadmap.org
This paper has learnings outside of cryptocurrencies in how to prepare for the post-quantum transition.
Protocols using seeds as private keys, can generate post-quantum private keys from that seed, and then prove in zero knowledge of the "seed" used in key derivation.
EdDSA signatures (Cosmos) provide this out of the box, making them post-quantum ready whereas ECDA (Bitcoin) private keys expose the scalar in derivation and therefore don't have the same properties
I put up a few #TLS hybrid key exchange post-quantum cryptography (not "Pavement Quality Concrete"!) proofs of concept to let you test X25519MLKEM768 compatibility:
https://www.netmeister.org/blog/pqc-pocs.html
Code here:
https://github.com/jschauma/pqcpoc/
Roads? I thought where we're going we wouldn't need any... roads. #PQC
@darkuncle thanks! An interesting read indeed.
But! His moon landing analogy doesn't hold here: we're not asking some random on the street if quantum computing (moon landing!) is possible. @hweimer is in his analogy the engineer that can actually assess if this ship can land on the quantum moon or not.
His statement about Gutmann's assessment is also problematic:
A model of steady progress in the number of qubits and in the reliability of qubits implies that the graph of quantum factorizations will look like RSA-tiny, RSA-tiny, RSA-tiny, RSA-tiny, etc., and then suddenly RSA-1024, and soon after that RSA-2048.
It implies that if we have enough qubits, the rest is just technicality. No word about other components such as quantum gates etc.
The most convincing part is the beginning: migrating to #pqc is not hard and does not hurt, so let's do it!
@darkuncle I have a couple of examples to make my point:
I mean #PQC algorithms are available in nearly every crypto library, so it's easy to catch up with little to no practical disadvantages. But still I think the hurdles are too high for any adversary to collect data now in hope of decrypting it later in world where Microsoft, Fortinet, etc. software is much easier to hack.
Does it make sense?
"harvest now, decrypt later" (#HNDL) is the only argument that people put forth to justify post #quantum crypto (#pqc). But it's unclear who is harvesting what and how did they manage to get their hands on the data? It's not like that every type of communication runs over the Internet though nodes that are controlled by adversaries. Even if you could partially observe data, I don't understand how you want to put fragmented data together if they happen to run through different routes that an adversary cannot control? I could go on forever, but it wouldn't as sexy as the FUD concept of HNDL...
Context:
Joint Analytic Report (JAR) from the Cyber Threat Alliance: Approaching Quantum Dawn
Die unterschätzte Bedrohung: Quantencomputer und Kryptographie
Was ich in meinem Artikel bereits betont habe, wird jetzt Realität.
Die #EU zieht nach – mit einem offiziellen Fahrplan zur Post-Quantum-Kryptographie. Frühzeitiges Handeln war nie optional – sondern zwingend.
Denn wie schon im Artikel beschrieben: Wer heute nicht vorbereitet, läuft morgen Gefahr, dass Jahrzehnte an vertraulichen Daten entschlüsselt werden – ganz im Sinne von „Store now, decrypt later“.
Mein Artikel: https://www.secunis.de/post-quantum-kryptographie/
100 logical qubits with built-in error correction in 2029, 1,000 in 2031, dramatically smaller size and energy requirements vs current HPC setups. Of course, not all problem spaces are subject to quantum advantage, and this new hardware approach needs further testing and development - but still, yet another promising advance in error correction. #quantum #PQC
https://mas.to/@AlexJimenez/114745196120568570
New paper from a team at Shanghai University outlines how a team there factored a 22-bit RSA integer on a #quantum computer (D-Wave's Advantage).
They reframed integer factoring as combinatorial optimization (which matches well with quantum annealing hardware) instead of Shor's period-finding approach. The previous best effort was 19 bits and was less efficient (more qubits per variable required).
The researchers also attacked some AES underlying algorithms including Present, Rectangle, and the Gift-64 block cipher.
(Notable context: Back in 2022 a different team in China claimed to have factored a 48-bit semiprime with a 10 qubit quantum computer, but that was later retracted.)
n.b., headline is clickbait but article is actually pretty good.
