Question 1

What is post-quantum cryptography (PQC)?

Accepted Answer

Post-quantum cryptography refers to cryptographic algorithms designed to resist attacks from both classical and quantum computers. These algorithms rely on mathematical problems — such as lattice structures, hash functions, and error-correcting codes — that remain hard even for quantum computers. The PQC 101 module walks through the core concepts and why migration is urgent.

Question 2

What is ML-KEM and what FIPS standard covers it?

Accepted Answer

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is standardized in FIPS 203, published by NIST in August 2024. It is a lattice-based KEM that replaces classical ECDH and RSA key exchange for establishing shared secrets. The Algorithms page provides parameter details for ML-KEM-512, ML-KEM-768, and ML-KEM-1024.

Question 3

What is ML-DSA and what FIPS standard covers it?

Accepted Answer

ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is standardized in FIPS 204, published by NIST in August 2024. It is a lattice-based digital signature scheme that replaces RSA and ECDSA for authentication and integrity. The Algorithms page compares ML-DSA-44, ML-DSA-65, and ML-DSA-87 across security levels and performance.

Question 4

What is SLH-DSA (SPHINCS+)?

Accepted Answer

SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), formerly known as SPHINCS+, is standardized in FIPS 205, published in August 2024. It offers 12 parameter variants across three security levels with fast and small optimization profiles, serving as a conservative hash-based fallback. The Algorithms page details all 12 variants with their signature and key sizes.

Question 5

What is FN-DSA (Falcon)?

Accepted Answer

FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm), formerly known as Falcon, is expected to be standardized as FIPS 206 in 2025. It produces more compact signatures than ML-DSA, making it attractive for bandwidth-constrained environments like smart cards, though its implementation is more complex due to floating-point arithmetic. The Algorithms page compares FN-DSA-512 and FN-DSA-1024 parameters.

Question 6

What is a hybrid cryptographic approach?

Accepted Answer

A hybrid cryptographic approach combines a classical algorithm (such as ECDH or RSA) with a post-quantum algorithm (such as ML-KEM) so that the combined scheme remains secure as long as either algorithm is unbroken. This hedging strategy is recommended by ANSSI, BSI, and other agencies during the transition period while confidence in PQC algorithms matures. The Hybrid Crypto module covers composite certificates, dual key exchange, and deployment patterns.

Question 7

What is the difference between a KEM and traditional key exchange?

Accepted Answer

A Key Encapsulation Mechanism (KEM) uses a recipient's public key to encapsulate a randomly generated shared secret, producing a ciphertext that only the private key holder can decapsulate. Traditional Diffie-Hellman key exchange, by contrast, derives a shared secret through an interactive exchange of public values. The Algorithms page explains how KEMs simplify protocol design and why NIST chose the KEM paradigm for post-quantum key establishment.

Question 8

What NIST security levels exist?

Accepted Answer

NIST defines five security levels for PQC algorithms: Level 1 targets at least AES-128 equivalent security, Level 2 targets SHA-256 collision resistance, Level 3 targets AES-192, Level 4 targets SHA-384, and Level 5 targets AES-256. Most deployments use Level 1 (ML-KEM-512, ML-DSA-44) or Level 3 (ML-KEM-768, ML-DSA-65) to balance security and performance. The Algorithms page maps each algorithm variant to its security level.

Question 9

What classical algorithms are quantum-vulnerable?

Accepted Answer

RSA, ECDSA, ECDH, DSA, and Diffie-Hellman are all vulnerable to quantum attack because they rely on the hardness of integer factoring or the discrete logarithm problem, both of which Shor's algorithm solves efficiently. Symmetric algorithms like AES and hash functions like SHA-256 are weakened but not broken by Grover's algorithm. The Quantum Threats module explains the mathematical basis and timelines for each vulnerability.

Question 10

Why is RSA vulnerable but AES is not?

Accepted Answer

Shor's algorithm can factor large integers and compute discrete logarithms in polynomial time on a quantum computer, directly breaking RSA and elliptic curve cryptography. Grover's algorithm, the best known quantum attack on symmetric ciphers, only provides a quadratic speedup — halving the effective key length — so AES-256 retains 128-bit security even against a quantum adversary. The Quantum Threats module illustrates these attack complexities side by side.

Question 11

What is a "Harvest Now, Decrypt Later" (HNDL) attack?

Accepted Answer

In an HNDL attack, an adversary intercepts and stores encrypted communications today with the intent of decrypting them once a sufficiently powerful quantum computer becomes available. Data with long confidentiality requirements — such as state secrets, health records, and financial data — is especially at risk. The Threats dashboard quantifies HNDL exposure windows across industries.

Question 12

What is HNFL (Harvest Now, Forge Later)?

Accepted Answer

Harvest Now, Forge Later (HNFL) is a threat where an adversary collects signed artifacts and public keys today, waiting until a quantum computer can forge valid digital signatures to impersonate trusted entities. This threatens long-lived code signing certificates, firmware authentication, and legal non-repudiation. The Threats dashboard models HNFL risk timelines alongside HNDL.

Question 13

What is a CRQC and when might one exist?

Accepted Answer

A Cryptographically Relevant Quantum Computer (CRQC) is a quantum computer capable of running Shor's algorithm against production key sizes, requiring on the order of thousands of stable logical qubits. Expert estimates for a CRQC range from the early 2030s to beyond 2040, with a rough consensus of 15 to 20 years from now, though breakthroughs could accelerate this. The Threats dashboard tracks expert timeline estimates and updated forecasts.

Question 14

What industries face the highest quantum risk?

Accepted Answer

Financial services, healthcare, government and defense, and critical infrastructure face the highest quantum risk due to their combination of long data confidentiality requirements, strict regulatory obligations, and high-value targets. Industries handling data with decades-long sensitivity windows are most exposed to HNDL attacks. The Threats dashboard ranks industry-specific risk levels with mitigation strategies.

Question 15

What is the quantum threat to Bitcoin and Ethereum?

Accepted Answer

Bitcoin and Ethereum rely on ECDSA signatures (secp256k1) for transaction authorization, which Shor's algorithm would break by recovering private keys from exposed public keys. Ethereum co-founder Vitalik Buterin has published a defense roadmap that includes account abstraction and PQC signature migration. The Digital Assets module covers the specific vulnerabilities and proposed countermeasures for both blockchains.

Question 16

How does Grover's algorithm affect symmetric encryption?

Accepted Answer

Grover's algorithm provides a quadratic speedup for brute-force search, effectively halving the security level of symmetric ciphers — AES-128 drops to 64-bit security and AES-256 drops to 128-bit security. Because 128-bit security remains computationally infeasible, AES-256 is considered quantum-safe, while AES-128 may need to be phased out for high-security applications. The Quantum Threats module visualizes these security reductions.

Question 17

What is Mosca's Theorem?

Accepted Answer

Mosca's Theorem states that if the sum of your data's required confidentiality period and your organization's migration timeline exceeds the estimated time until a CRQC is available, then you must begin migrating now. It provides a simple inequality — shelf life + migration time > time to quantum — for deciding migration urgency. The PQC 101 module includes an interactive Mosca calculator.

Question 18

How many industries does the PQC Today Threats dashboard cover?

Accepted Answer

The Threats dashboard covers 12 or more industries, each with detailed threat criticality levels, HNDL and HNFL risk assessments, and actionable mitigation strategies. Industries include financial services, healthcare, government, telecom, energy, automotive, aerospace, and more. The dashboard allows filtering by industry to see sector-specific threat profiles and compliance requirements.

Question 19

What are the four FIPS standards for PQC?

Accepted Answer

NIST has published three PQC FIPS standards and is finalizing a fourth: FIPS 203 (ML-KEM, lattice-based key encapsulation), FIPS 204 (ML-DSA, lattice-based digital signatures), FIPS 205 (SLH-DSA, stateless hash-based signatures), and the forthcoming FIPS 206 (FN-DSA, NTRU-lattice signatures). FIPS 203, 204, and 205 were all published in August 2024. The Reference Library has the full text and cross-references for each standard.

Question 20

What is NIST IR 8547?

Accepted Answer

NIST IR 8547 (Interagency Report) provides transition guidance for migrating federal cryptographic systems to post-quantum algorithms, recommending that classical algorithms like RSA and ECDSA be deprecated by 2030 and disallowed by 2035. It serves as the authoritative US government transition timeline and complements the FIPS algorithm standards. The Reference Library links to the full document with implementation details.

Question 21

What is CNSA 2.0?

Accepted Answer

CNSA 2.0 (Commercial National Security Algorithm Suite 2.0) is NSA guidance for protecting national security systems, mandating ML-KEM and ML-DSA adoption by 2025 and the complete disallowance of all classical public-key algorithms by 2033. It is more aggressive than civilian timelines and applies to defense, intelligence, and classified environments. The Compliance Tracker shows CNSA 2.0 milestones alongside other frameworks.

Question 22

What is SP 800-208?

Accepted Answer

NIST Special Publication 800-208 standardizes the use of LMS (Leighton-Micali Signature) and XMSS (eXtended Merkle Signature Scheme) stateful hash-based signature algorithms. These schemes are suitable for firmware signing and other use cases where the signer can reliably maintain state to prevent key reuse. The Reference Library provides the full SP 800-208 text and related implementation guidance.

Question 23

What does RFC 9629 cover?

Accepted Answer

RFC 9629 specifies how to use post-quantum algorithms within the Cryptographic Message Syntax (CMS), enabling PQC-protected S/MIME email encryption and digital signatures. It defines algorithm identifiers and encoding rules for ML-KEM and ML-DSA within the existing CMS framework. The Reference Library includes this RFC alongside related email security standards.

Question 24

What is ETSI TS 103 744?

Accepted Answer

ETSI TS 103 744 is a European Telecommunications Standards Institute specification providing migration guidance for adopting post-quantum cryptography in telecom networks. It addresses the specific challenges of network function virtualization, 5G infrastructure, and subscriber identity protection during the PQC transition. The Reference Library catalogs this alongside other ETSI PQC publications.

Question 25

What does BSI TR-02102 recommend?

Accepted Answer

BSI Technical Guideline TR-02102 is the German Federal Office for Information Security's cryptographic recommendations, which include PQC algorithm guidance and transition timelines for German government and critical infrastructure systems. It recommends hybrid classical-plus-PQC approaches during the transition and specifies minimum key sizes for each security level. The Reference Library provides the guideline alongside BSI's broader PQC program.

Question 26

What is the ANSSI PQC position?

Accepted Answer

France's ANSSI (Agence nationale de la securite des systemes d'information) requires hybrid classical-plus-PQC deployment for all lattice-based algorithms as a transitional security measure, reflecting caution about the maturity of lattice hardness assumptions. ANSSI has set some of the most aggressive European timelines, requiring PQC support in qualified products. The Reference Library links to ANSSI's published position papers and technical guidance.

Question 27

What is NIST CSWP 39?

Accepted Answer

NIST Cybersecurity White Paper 39 provides practical guidance for organizations preparing their migration to post-quantum cryptography, covering cryptographic inventory, risk assessment, and phased transition planning. It complements the FIPS algorithm standards by addressing organizational and operational readiness. The Reference Library includes CSWP 39 with cross-references to related NIST publications.

Question 28

What are RFC 9881 and RFC 9882?

Accepted Answer

RFC 9881 and RFC 9882 are IETF standards that define the algorithm identifiers and encoding rules for using ML-KEM and ML-DSA within CMS (Cryptographic Message Syntax), enabling their use in protocols like S/MIME, code signing, and timestamping. They provide the wire format and OID assignments needed for interoperability across implementations. The Reference Library catalogs these alongside the broader suite of PQC-related RFCs.

Question 29

When does NIST plan to deprecate classical algorithms?

Accepted Answer

According to NIST IR 8547, classical public-key algorithms such as RSA and ECDSA should be deprecated by 2030 and fully disallowed by 2035 in federal systems. This creates a clear 10-year window for organizations to complete their post-quantum migration. The Timeline view plots these milestones alongside country-specific deadlines.

Question 30

Which country has the most aggressive PQC deadline?

Accepted Answer

France, through ANSSI, has set some of the most aggressive PQC timelines in Europe, requiring PQC support in qualified security products and mandating hybrid deployment as an immediate transitional measure. South Korea (KISA) and the United States (CNSA 2.0 for national security systems) also have aggressive timelines. The Timeline view lets you compare country deadlines side by side.

Question 31

What is the EU's PQC transition target?

Accepted Answer

EU Recommendation 2024/1101 calls on member states to develop coordinated national strategies for transitioning to post-quantum cryptography, emphasizing crypto agility and hybrid approaches during the migration period. The recommendation aligns with the broader NIS2 and eIDAS 2.0 frameworks to ensure interoperability across the EU. The Timeline view shows EU-level milestones and member state progress.

Question 32

When does the UK plan to complete PQC transition?

Accepted Answer

The UK's National Cyber Security Centre (NCSC) has published a PQC migration roadmap with a target completion date of 2035, aligned with NIST's disallowance timeline. NCSC recommends organizations begin with a cryptographic inventory and prioritize systems handling long-lived sensitive data. The Timeline view shows the UK's phased approach alongside other countries.

Question 33

What are Canada's PQC migration phases?

Accepted Answer

The Canadian Centre for Cyber Security published ITSM.40.001, which defines a phased PQC migration approach including discovery (cryptographic inventory), planning (risk assessment and roadmap), and migration (implementation and validation). Canada's guidance emphasizes alignment with NIST standards while accommodating Canadian-specific regulatory requirements. The Timeline view details Canada's phase structure and key milestones.

Question 34

What is Germany's QUANTITY initiative?

Accepted Answer

QUANTITY is a BSI-led initiative to deploy quantum-safe cryptography across German government infrastructure, covering both federal IT systems and critical infrastructure operators. The program coordinates with broader EU efforts and emphasizes hybrid deployment and crypto agility as transitional measures. The Timeline view shows Germany's milestone dates within the European context.

Question 35

What is the CNSA 2.0 exclusive phase deadline?

Accepted Answer

The CNSA 2.0 exclusive-use phase deadline is 2033, after which all classical public-key algorithms will be disallowed for national security systems — only post-quantum algorithms will be permitted. This is two years earlier than the NIST IR 8547 civilian disallowance date of 2035, reflecting the higher security posture required for classified systems. The Timeline view plots the CNSA 2.0 phases against civilian timelines.

Question 36

What web browsers support ML-KEM for TLS?

Accepted Answer

Chrome (since version 124), Microsoft Edge, and Firefox all support the X25519MLKEM768 hybrid key exchange in TLS 1.3, combining classical X25519 ECDH with ML-KEM-768 for post-quantum protection. Safari support is still pending as of early 2026. The Migrate catalog tracks browser PQC support alongside other infrastructure categories.

Question 37

What is the G7 financial sector PQC target?

Accepted Answer

The G7 Cyber Expert Group has recommended that financial sector institutions begin PQC transition planning, recognizing the systemic risk that quantum computing poses to the global financial system. This recommendation influences national regulators and aligns with parallel efforts by the BIS (Bank for International Settlements) and FSB (Financial Stability Board). The Timeline view shows financial sector milestones across G7 nations.

Question 38

When did Microsoft announce PQC transition?

Accepted Answer

Microsoft has announced the integration of ML-KEM across its core infrastructure including Azure cloud services, Windows, and Microsoft 365, with hybrid PQC key exchange already available in some services. The rollout covers TLS, code signing, and internal authentication systems. The Timeline view tracks Microsoft's milestones alongside other major vendor announcements.

Question 39

What is FIPS 140-3 and why does the validation backlog matter?

Accepted Answer

FIPS 140-3 is the US standard for cryptographic module security certification, required for federal procurement and widely adopted in regulated industries. The validation backlog at NIST's CMVP (Cryptographic Module Validation Program) means that PQC module certifications can take 18 months or longer, creating a gap between algorithm standardization and deployable certified products. The Compliance Tracker shows validation status across PQC products.

Question 40

What is eIDAS 2.0's PQC requirement?

Accepted Answer

eIDAS 2.0 is the updated EU regulation governing electronic identification and trust services, including the European Digital Identity Wallet (EUDI Wallet). While it does not mandate specific PQC algorithms yet, it requires crypto agility and quantum-readiness in qualified trust services to ensure long-term signature validity. The Compliance Tracker details eIDAS 2.0 requirements alongside other EU frameworks.

Question 41

What is DORA and when did it take effect?

Accepted Answer

The Digital Operational Resilience Act (DORA) is an EU regulation that took effect in January 2025, requiring financial institutions to address ICT risk management including cryptographic resilience. DORA mandates that organizations assess and mitigate risks from emerging technologies, which includes the quantum computing threat to current encryption. The Compliance Tracker maps DORA requirements to PQC migration actions.

Question 42

What does NIS2 require for PQC?

Accepted Answer

The EU NIS2 Directive (Network and Information Security Directive 2) mandates comprehensive risk management for essential and important entities, requiring them to adopt appropriate and proportionate technical measures — which increasingly includes quantum-resilient cryptography. NIS2 applies to energy, transport, health, digital infrastructure, and other critical sectors. The Compliance Tracker shows how NIS2 intersects with PQC migration requirements.

Question 43

What is Executive Order 14306?

Accepted Answer

Executive Order 14306 directs US federal agencies to migrate their cryptographic systems to post-quantum algorithms, referencing NIST standards and establishing timelines for inventory, assessment, and migration. It builds on NSM-10 (National Security Memorandum 10) and mandates annual progress reporting by agency CISOs. The Compliance Tracker tracks the EO 14306 milestones and agency compliance status.

Question 44

What is NERC-CIP's relevance to PQC?

Accepted Answer

NERC-CIP (North American Electric Reliability Corporation — Critical Infrastructure Protection) standards mandate security controls for the bulk electric system, including the protection of electronic security perimeters and communications. As quantum computing threatens the cryptographic foundations of these protections, NERC-CIP compliance will require PQC upgrades to encryption and authentication. The Compliance Tracker shows energy sector requirements.

Question 45

What is Common Criteria's role in PQC?

Accepted Answer

Common Criteria (ISO/IEC 15408) is the international framework for evaluating IT product security, and the Common Criteria Recognition Arrangement (CCRA) enables mutual recognition across 31 member nations. Protection profiles for PQC-capable products are under development, and future evaluations will require demonstrating quantum resilience. The Compliance Tracker includes Common Criteria PQC developments.

Question 46

What is ISO/SAE 21434?

Accepted Answer

ISO/SAE 21434 is the international standard for automotive cybersecurity engineering, requiring threat analysis and risk assessment throughout the vehicle lifecycle including cryptographic components. It mandates crypto agility — the ability to update algorithms without hardware replacement — which is critical given 15-year vehicle lifetimes spanning the quantum transition. The Compliance Tracker maps ISO 21434 to PQC requirements.

Question 47

What are the seven phases of PQC migration?

Accepted Answer

The PQC migration lifecycle consists of seven phases: Discover (cryptographic inventory), Assess (risk evaluation), Prepare (architecture and planning), Test (validation and interoperability), Deploy/Launch (production rollout), Ramp Up (expand coverage), and Stay Agile (ongoing monitoring and algorithm updates). Each phase has specific deliverables and success criteria. The Migrate catalog organizes products and guidance by migration phase.

Question 48

What infrastructure layers does the Migrate catalog cover?

Accepted Answer

The Migrate catalog covers seven infrastructure layers: cryptographic libraries, PKI and certificate authorities, network and VPN appliances, web servers and load balancers, cloud services and KMS, hardware security modules (HSMs), and application frameworks and SDKs. Each layer includes products with PQC readiness status and FIPS validation tiers. The catalog also tracks web browser PQC support as a separate category.

Question 49

What do the three FIPS badge tiers mean?

Accepted Answer

The Migrate catalog uses three FIPS badge tiers: Validated (green) means the product has achieved FIPS 140-3 certification with PQC algorithms; Partial (amber) means the vendor claims FIPS-mode operation, FedRAMP authorization, or WebTrust audit but full PQC validation is pending; No (gray) means no FIPS validation is available. The catalog shows these badges on every product entry.

Question 50

What should organizations do first for PQC migration?

Accepted Answer

The first step in PQC migration is conducting a comprehensive cryptographic inventory — identifying every place your organization uses cryptography across code, configuration files, certificates, protocols, and third-party dependencies. This inventory becomes the foundation for risk assessment and migration prioritization. The Crypto Agility module includes tools for building a Cryptography Bill of Materials (CBOM).

Question 51

How does the PQC Risk Assessment wizard work?

Accepted Answer

The PQC Risk Assessment is a 14-step wizard that evaluates your organization across dimensions including industry, country, cryptographic usage, data sensitivity, compliance requirements, migration readiness, infrastructure maturity, and vendor dependencies. It produces a scored report with risk categories, compliance gap analysis, and a prioritized migration roadmap. The report can be exported as a PDF.

Question 52

What is a CBOM (Cryptography Bill of Materials)?

Accepted Answer

A Cryptography Bill of Materials (CBOM) is a machine-readable inventory of all cryptographic algorithms, keys, certificates, and protocols used in a system, typically formatted using the CycloneDX standard. It enables automated detection of quantum-vulnerable components and tracking of migration progress across an organization. The Crypto Agility module includes a CBOM scanning workshop.

Question 53

How many PQC-ready products does the catalog track?

Accepted Answer

The Migrate catalog tracks over 140 products across seven infrastructure layers, each assessed for PQC readiness with specific algorithm support details and FIPS validation status. Products range from open-source libraries like OpenSSL and liboqs to commercial HSMs and cloud services from AWS, Azure, and GCP. The catalog is regularly updated as vendors announce new PQC capabilities.

Question 54

Can the assessment report be exported as PDF?

Accepted Answer

Yes, the PQC Risk Assessment report can be printed or saved as a PDF directly from your browser, preserving the full compliance gap analysis, threat landscape visualization, and prioritized migration roadmap. The print layout includes a professional header with your assessment parameters and a methodology explanation. The report is designed for board-level and audit presentations.

Question 55

How does ML-KEM change the TLS 1.3 handshake?

Accepted Answer

In a PQC TLS 1.3 handshake, the client includes an ML-KEM public key (or hybrid key share) in the ClientHello message, and the server encapsulates a shared secret in the ServerHello response. This adds approximately 1KB to the handshake compared to classical ECDH, primarily from the larger key and ciphertext sizes. The TLS Basics module includes a step-through handshake simulator comparing classical, hybrid, and pure PQC modes.

Question 56

What is X25519MLKEM768?

Accepted Answer

X25519MLKEM768 is a hybrid key exchange method for TLS 1.3 that combines the classical X25519 ECDH key exchange with ML-KEM-768 (NIST Level 3 security), producing a combined shared secret that is secure against both classical and quantum attacks. It is already supported in Chrome, Firefox, and Edge, making it the most widely deployed PQC mechanism on the internet today. The TLS Basics module demonstrates this handshake interactively.

Question 57

What PQC algorithms work for VPN/IPsec?

Accepted Answer

For VPN and IPsec, ML-KEM provides post-quantum key exchange within IKEv2 (supported by strongSwan and other implementations), while ML-DSA provides PQC certificate authentication for tunnel endpoints. Hybrid modes combining classical and PQC algorithms are recommended during the transition to ensure backward compatibility and defense in depth. The VPN/SSH module covers configuration for strongSwan, WireGuard, and OpenVPN.

Question 58

What OpenSSH version supports PQC?

Accepted Answer

OpenSSH 9.x introduced the sntrup761x25519-sha512 hybrid key exchange, which combines the NTRU Prime lattice-based KEM with classical X25519 ECDH. More recent OpenSSH development includes support for ML-KEM-768-based hybrid key exchange, aligning with NIST's standardized algorithms. The VPN/SSH module explains host key migration and client configuration for PQC.

Question 59

How does S/MIME support PQC?

Accepted Answer

RFC 9629 defines how to use ML-KEM for key encapsulation and ML-DSA for digital signatures within the CMS framework that underpins S/MIME email security. Hybrid mode is especially important for email because archived messages must remain confidential for years or decades after encryption. The Email Signing module covers S/MIME PQC deployment and backward compatibility.

Question 60

What is the JWT size problem with PQC?

Accepted Answer

ML-DSA-65 digital signatures are approximately 3.3KB compared to only 256 bytes for an ECDSA P-256 signature, which causes JWT tokens signed with PQC algorithms to exceed many API gateway and HTTP header size limits. This impacts OAuth 2.0 flows, microservice authentication, and any system that passes signed tokens in HTTP headers. The API Security module explores mitigation strategies including token compression and reference tokens.

Question 61

How do PQC certificates affect TLS chain size?

Accepted Answer

A typical ML-DSA certificate chain (root, intermediate, and leaf) totals approximately 14KB compared to about 3KB for an equivalent RSA chain, due to the larger public keys and signatures in PQC algorithms. This increased size is significant for IoT devices with limited bandwidth and for mobile connections with high latency. The PKI Workshop module quantifies the overhead and explores mitigation strategies.

Question 62

What is a Merkle Tree Certificate?

Accepted Answer

Merkle Tree Certificates are a compact certificate format that replaces full certificate chains with short Merkle inclusion proofs, dramatically reducing the TLS handshake overhead caused by large PQC signatures and public keys. Instead of transmitting the full chain, the server provides a proof that its certificate is included in a trusted Merkle tree maintained by a transparency log. The Merkle Tree Certificates module explores this emerging approach to PQC deployment.

Question 63

How does PKCS#11 v3.2 support PQC?

Accepted Answer

PKCS#11 version 3.2 introduces native PQC support through new mechanism types (CKM_ML_KEM, CKM_ML_DSA, CKM_SLH_DSA) and two new functions — C_EncapsulateKey and C_DecapsulateKey — for the KEM paradigm that does not fit the traditional encrypt/decrypt model. It also adds key type constants and parameter set identifiers for all NIST-standardized PQC algorithms. The HSM module provides a hands-on PKCS#11 v3.2 simulator.

Question 64

What HSMs support ML-KEM and ML-DSA?

Accepted Answer

Major HSM vendors including Thales (Luna), Entrust (nShield), Utimaco, and AWS CloudHSM have announced or delivered PQC algorithm support including ML-KEM and ML-DSA, with varying levels of FIPS 140-3 validation status. Some vendors offer firmware upgrades for existing hardware while others require new PQC-capable models. The Migrate catalog tracks HSM PQC support and FIPS validation status.

PQC Frequently Asked Questions

PQC Fundamentals

Quantum Threats

NIST Standards & Timeline

Migration Timeline

Compliance & Regulation

Migration Planning

Protocols & TLS

Infrastructure & Operations

Industry-Specific

PQC Today Platform

Role-Specific Guidance

Interactive Tools

What's New

Welcome to PQC Today