PQC Library

GSS-API Key Exchange with Hybrid ML-KEM

Defines GSS-API key exchange methods using hybrid PQ/T cryptography for SSH, updating RFC 4462 and reusing schemes from I-D.ietf-sshm-mlkem-hybrid-kex for GSS-API authentication.

Web page · 60 KB · a short read

Post-quantum Key Encapsulation with ML-KEM in Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)

Specifies ML-KEM key encapsulation for the initial public-key exchange in the protocol it profiles.

Web page · 93 KB · a short read

Hash-based Signatures: State and Backup Management

Guidance on managing stateful HBS (LMS/XMSS) state to prevent catastrophic key reuse. Covers state persistence and distributed signing strategies.

Web page · 112 KB · a short read

Hybrid key exchange in TLS 1.3

Framework for hybrid key exchange combining traditional and PQ algorithms in TLS 1.3.

Web page · 80 KB · a short read

Composite ML-KEM for use in Cryptographic Message Syntax (CMS)

LAMPS WG-adopted draft specifying composite ML-KEM (ML-KEM + RSA-OAEP / ECDH / X25519 / X448) within CMS KEMRecipientInfo per RFC 9629. Profiles the X.509 composite-KEM construction into CMS for S/MIME-encrypted email and CMS-based protocols. Latest revision -01, Proposed Standard.

Web page · 91 KB · a short read

OASIS Approves Two Public-Key Cryptography Standards to Advance Post-Quantum Security and Interoperability - OASIS Open

OASIS announcement approving two public-key cryptography standards advancing post-quantum adoption — a dated marker for procurement references.

Web page · 146 KB · a short read

Post-Quantum Algorithm Requirements for Public Trust Certificates

CA/Browser Forum requirements for ML-DSA certificates in Web PKI.

Web page · 7 KB · a quick skim

ML-DSA for TLS 1.3

Specifies use of ML-DSA-44/65/87 signature schemes in TLS 1.3 server authentication.

Web page · 59 KB · a short read

Post-Quantum and Post-Quantum/Traditional Hybrid Algorithms for HPKE

Extends HPKE (RFC 9180) with post-quantum and hybrid PQ/T key encapsulation mechanisms including ML-KEM and hybrid combinations with X25519 and P-256. Enables quantum-safe HPKE for email encryption, messaging, and ECH.

Web page · 208 KB · a long read

MLS Extensions Framework

Generic MLS extensions framework supporting PQ ciphersuites and other extensions.

Web page · 123 KB · a short read

Use of Hybrid Public Key Encryption (HPKE) with JOSE

Defines how JWE uses HPKE in two modes: Integrated Encryption (HPKE encrypts the payload; the header carries only "alg", the JWE Encrypted Key is the encapsulated secret, IV and tag are empty) and Key Encryption (HPKE wraps the CEK; the encapsulated secret goes in "ek"). Registers the classical DHKEM suites HPKE-0 to HPKE-7; the post-quantum and PQ/T suites are registered separately in draft-ietf-jose-hpke-pq-pqt.

Web page · 224 KB · a long read

Hybrid Post-Quantum Password-Authenticated Key Exchange (CPaceOQUAKE+)

Hybrid aPAKE combining classical CPace with post-quantum OQUAKE+ (ML-KEM-based); addresses Harvest-Now-Decrypt-Later exposure of classical PAKEs like OPAQUE-3DH/SPAKE2+.

Web page · 150 KB · a short read

Multi-Authentication in IKEv2 with Post-Quantum Security

Lets IKEv2 peers negotiate two or more authentication methods via a new IKEv2 Authentication Method registry value (17) and SUPPORTED_AUTH_METHODS notify, for PQC transition defense-in-depth.

Web page · 74 KB · a short read

Post-Quantum Key Encapsulation Mechanisms (PQ-KEMs) for COSE

WG-track draft specifying ML-KEM-512/768/1024 for COSE Direct Key Agreement and Key Agreement with Key Wrap modes; hybrid PQ KEMs explicitly out of scope for this document.

Web page · 78 KB · a short read

Module-Lattice-Based Signatures with Merkle Tree Ladders (ML-DSA-MTL) for DNSSEC

Applies Merkle tree ladders to ML-DSA for DNSSEC, addressing the response-size problem post-quantum signatures create for DNS.

Web page · 89 KB · a short read

N-PAMP: Native Post-Quantum Agent Messaging Protocol

Proposes a messaging protocol for software agents built post-quantum from the start rather than retrofitted.

Web page · 117 KB · a short read

JOSE HPKE PQ & PQ/T Algorithm Registrations

Registers the post-quantum and PQ/T hybrid HPKE algorithms for JOSE: HPKE-12/13 (ML-KEM-768/1024) and HPKE-8/9/10 (ML-KEM-768+P-256, ML-KEM-768+X25519 i.e. X-Wing, ML-KEM-1024+P-384), all with SHAKE256 and AES-256-GCM, for Integrated Encryption and Key Encryption (-KE) per draft-ietf-jose-hpke-encrypt. Keys use the AKP key type of RFC 9964. Appendix A publishes test vectors for every algorithm.

Web page · 192 KB · a long read

Preventing Key Reuse and Cross-Key Forgeries in Composite ML-DSA

Addresses a real attack class in composite ML-DSA: reusing a component key across contexts, and forging across the pair.

Web page · 55 KB · a short read

ML-KEM in IKEv2 (draft-ietf-ipsecme-ikev2-mlkem-09)

ML-KEM key exchange for IKEv2 (IPsec), pure and hybrid. Section 2.1 allows ML-KEM-512 alone in IKE_SA_INIT over UDP; ML-KEM-768/1024 SHOULD NOT be used there without a guaranteed path MTU or reliable transport.

Web page · 82 KB · a short read

Post-Quantum Cryptography Recommendations for TLS-Based Applications

WG-adopted best-practice recommendations for quantum-ready TLS/DTLS 1.3 application profiles: hybrid key exchange preferred, composite certificates for transition, External PSK as CRQC mitigation.

Web page · 103 KB · a short read

TLS 1.3 PQ-Traditional Dual Certificate Authentication

This document defines a TLS 1.3 extension for dual-certificate hybrid authentication using separate traditional and post-quantum signature algorithms.

Web page · 85 KB · a short read

KEM-Based Authentication for IKEv2 with Post-Quantum Security

Proposes ML-KEM-based authentication for IKEv2 (more efficient than ML-DSA signatures) using an Encrypted Certificate payload; accommodates ideas from the PQuAKE protocol.

Web page · 96 KB · a short read

Post-Quantum Signature Algorithm Profile and Migration Considerations for the Resource Public Key Infrastructure (RPKI)

Profiles which post-quantum signature algorithms apply to its target protocol, and what migrating to them involves.

Web page · 109 KB · a short read

Post-Quantum Cryptography Readiness Guide

Singapore guidance for organizations preparing for PQC transition.

PDF · 1.7 MB · a reference document — dip in, don’t read it through

draft-ietf-lake-edhoc-psk

This document specifies a Pre-Shared Key (PSK) authentication method for the Ephemeral Diffie-Hellman Over COSE (EDHOC) key exchange protocol. The PSK method enhances computational efficiency while providing mutual authentication, ephemeral key exchange, identity protection, and quantum resistance. It is particularly suited for systems where nodes share a PSK provided out-of-band

Web page · 116 KB · a short read

RFC 9846 — The Transport Layer Security (TLS) Protocol Version 1.3

Obsoletes RFC 8446; consolidates TLS 1.3 errata/clarifications (does not itself define PQC key exchange -- catalogued as the current base TLS 1.3 spec that PQC hybrid-KEM drafts like draft-ietf-tls-hybrid-design extend).

Web page · 611 KB · a long read

X.509v3 ML-DSA Certificates for the Secure Shell (SSH) Protocol

Defines X.509v3 certificates carrying ML-DSA keys for use with SSH.

Web page · 54 KB · a short read

CCN-TEC 009 / BP-37 (Spain) - Recomendaciones para una transicion postcuantica segura

Spain’s CCN recommendations for a post-quantum transition, including its phased approach.

PDF · 3.1 MB · a reference document — dip in, don’t read it through

One Signature Certificates (draft-ietf-lamps-one-signature-certs-02)

Defines certificates for single-use signing keys bound to one signed document through a signedDocumentBinding extension, so the key needs no revocation or long validity. X.509 work relevant to large PQC signatures, but not a hybrid certificate mechanism.

Web page · 95 KB · a short read

NIST ESV Certificate E335

Web page · 41 KB · a short read

Microsoft Quantum Safe Program (QSP) — Product Roadmap to 2033

Microsoft publishes comprehensive QSP roadmap detailing transition to quantum-safe cryptography across all products through 2033. Covers Windows platform, Azure, signing services, and core infrastructure.

Web page · 283 KB · a long read

draft-ietf-opsawg-rfc5706bis

New Protocols and Protocol Extensions are best designed with due consideration of the functionality needed to operate and manage them. Retrofitting operations and management considerations is suboptimal. The purpose of this document is to provide guidance to authors and reviewers on what operational and management aspects should be addressed when writing documents in the IETF Stream

Web page · 186 KB · a long read

Post-Quantum/Traditional (PQ/T) Hybrid PKI Authentication in IKEv2

Hybrid PKI authentication for IKEv2: component keys/algorithms must not be reused across the hybrid scheme, and hybrid IKEv2 key exchange must independently be CRQC-resilient.

Web page · 73 KB · a short read

A Post-Quantum Hybrid-Commitment Certificate Extension (PQCHC)

Proposes an X.509 extension that commits to a post-quantum key alongside a classical one, so a certificate can carry both without a new format.

Web page · 64 KB · a short read

OMB Memorandum M-26-15 — Execution of the Migration to Post-Quantum Cryptography

OMB memorandum implementing Executive Order 14412, directing federal agencies to execute prioritized PQC migration by December 31 2030 and submit PQC Migration Plans to OMB and ONCD within 120 days. Establishes a 5-phase migration schedule (Discovery 2026-27, Pilots 2027-28, Key-Establishment Migration 2028-30, Signature Migration 2031, Full Migration by 2035) and does not apply to national security systems.

PDF · 283 KB · a short read

EPC 342-08 v16.0.1 — Guidelines on Cryptographic Algorithms Usage and Key Management (2026)

The European Payments Council’s guidance on cryptographic algorithms and key management — the reference European payment schemes size their migrations against.

PDF · 1.4 MB · a long read

Executive Order 14412 (June 22, 2026): Securing the Nation Against Advanced Cryptographic Attacks

U.S. Executive Order signed June 22 2026 mandating federal post-quantum migration: agencies name a PQC migration lead within 30 days; OMB issues guidance to inventory High Value Assets and submit migration plans within 90 days; a NIST migration pilot completes by 2027; HVAs and high-impact systems transition to PQC for key establishment (FIPS 203) by Dec 31 2030 and digital signatures (FIPS 204) by Dec 31 2031; covered contractors comply by 2030; CISA and NIST publish CBOM minimum elements and accelerate FIPS 140-3 validation.

Web page · 289 KB · a long read

Executive Order 14413 — Ushering in the Next Frontier of Quantum Innovation

Companion order to EO 14412, signed the same day. Establishes the Quantum Computer for Application Development and Discovery Science (QC-ADDS) initiative, targeting delivery of a scientifically useful quantum computer to a Department of Energy facility by 2028, and directs a National Quantum Strategy update within 180 days. Does not itself impose cryptography compliance obligations.

Web page · 296 KB · a long read

Analysis of Hybrid Key Establishment and Standalone ML-KEM in TLS 1.3

Compares hybrid key establishment against standalone ML-KEM in TLS 1.3, and what each choice costs.

Web page · 86 KB · a short read

Post-Quantum Key Encapsulation Mechanisms (PQ-KEMs) in EAP-AKA'

WG-adopted draft integrating ML-KEM into EAP-AKA' FS for quantum-resistant perfect forward secrecy; defines AT_PUB_KEM/AT_KEM_CT attributes, ML-KEM-512/768/1024 parameter sets.

Web page · 91 KB · a short read

Enhancing Security in EAP-AKA' with Hybrid Post-Quantum Cryptography

WG-adopted draft using HPKE-wrapped hybrid ML-KEM to protect EAP-AKA' Forward Secrecy against CRQC; requires ML-KEM key pairs be used in only one EAP session.

Web page · 74 KB · a short read

Use of ML-DSA in TLS 1.3 (draft-ietf-tls-mldsa-04)

Defines ML-DSA (FIPS 204) signature algorithms for TLS 1.3 authentication. Submitted to the IESG; on the 2026-07-02 telechat.

Web page · 57 KB · a short read

New Pure Post-Quantum Protocol Specification

Specifies a protocol using post-quantum algorithms alone, with no classical component to fall back on.

Web page · 76 KB · a short read

Post-quantum Key Exchange with ML-KEM in IKEv2 (draft-ietf-ipsecme-ikev2-mlkem-06)

ML-KEM key exchange for IKEv2 (IPsec). Submitted to the IESG; on the 2026-07-02 telechat.

Web page · 81 KB · a short read

Matter 1.6 Core Specification

The Matter smart-home core specification, including the device attestation and commissioning cryptography embedded in shipped hardware.

PDF · 15.7 MB · a reference document — dip in, don’t read it through

New Hybrid Post-Quantum Protocol Specification

Specifies a hybrid post-quantum protocol combining classical and PQC key establishment.

Web page · 24 KB · a quick skim

OAuth Status List (draft-ietf-oauth-status-list-20)

IETF specification for a compact bit-array status list to check validity states of credentials (valid revoked suspended). Provides privacy-preserving revocation: the verifier cannot determine which specific credential is being checked from the status list position alone. Used in EUDI Wallet ecosystem for credential revocation checking without revealing holder identity to the issuer.

Web page · 217 KB · a long read

Use of Post-Quantum Key Encapsulation Mechanisms in JOSE and COSE

Revision -05 (cited here) defined ML-KEM for JOSE/JWE direct key agreement (alg ML-KEM-512/768/1024, KMAC256 key derivation) and for COSE. Revision -06 (2026-07-06) was retitled 'Post-Quantum Key Encapsulation Mechanisms (PQ KEMs) for COSE' and no longer covers JOSE; post-quantum JWE now goes through HPKE (draft-ietf-jose-hpke-encrypt with draft-ietf-jose-hpke-pq-pqt).

Web page · 42 KB · a short read

NIST SP 800-73-6 (Initial Working Draft), Interfaces for Personal Identity Verification: Part 1 – PIV Card Application Namespace, Data Model and Representation

Proposed PQC updates to PIV card interfaces: dual-stack model preserving classical keys while adding ML-DSA/ML-KEM key references and certificate containers for backward-compatible, incremental deployment.

Web page · 40 KB · a short read

NIST SP 800-73-6 (Initial Working Draft), Interfaces for Personal Identity Verification: Part 2 – PIV Card Application Card Command Interface

Proposed PQC updates to PIV card interfaces: dual-stack model preserving classical keys while adding ML-DSA/ML-KEM key references and certificate containers for backward-compatible, incremental deployment.

Web page · 40 KB · a short read

NIST SP 800-78-6 (Initial Working Draft), Cryptographic Algorithms and Key Sizes for Personal Identity Verification

Companion PQC algorithm/key-size update to SP 800-73-6: specifies ML-DSA and ML-KEM parameter sets approved for use within the dual-stack PIV credential model.

Web page · 40 KB · a short read

AFiR: Post-Quantum Signed Inference Receipts as a TEE-Free Profile for IETF SPICE Inference Chain

Proposes post-quantum signed receipts for AI inference, as an alternative to trusted-execution-environment attestation.

Web page · 71 KB · a short read

An Assessment Framework for Application-Level Cryptographic Agility

Proposes a way to measure how cryptographically agile an application actually is, rather than treating agility as a yes/no property.

Web page · 43 KB · a short read

PQC Continuity: Downgrade Protection for TLS

Proposes a TLS-layer mechanism for servers to make a cached commitment that they support PQC key exchange. Clients that have cached the commitment refuse future connections that omit PQC, providing protection against active MITM downgrade attacks that suppress ML-KEM negotiation during the quantum transition. Introduces the concept of a downgrade limit (cached duration) analogous to HSTS for HTTP.

Web page · 70 KB · a short read

ASD (Australia) - Information Security Manual, Guidelines for Cryptography (verified current as of June 2026 release)

Australia’s ISM cryptography guidelines — the approved-algorithm list Australian government systems are held to, including its PQC dates.

PDF · 983 KB · a long read

Gaps in Operational Visibility for Post-Quantum Cryptographic Readiness in Networked Computing Environments

Identifies what network operators cannot currently see about their own post-quantum readiness, and what telemetry would be needed.

Web page · 60 KB · a short read

Requirements and Gaps for Post-Quantum Certificate Rotation in Multi-Tenant Public Key Infrastructure Environments

Sets out what multi-tenant public infrastructure needs for post-quantum certificate rotation, and which of those needs nothing currently meets.

Web page · 58 KB · a short read

Post-Quantum Guidance for Current Deployments of IETF Protocols

General guidance for deploying IETF-protocol applications with post-quantum algorithm support across current (non-PQC-native) deployments.

Web page · 63 KB · a short read

PKCS #11 Specification Version 3.2 (OASIS Standard)

PKCS#11 v3.2 finalized as an OASIS Standard (3 June 2026), technically identical in content to the prior Committee Specification Draft 01 / Committee Specification 01 — no substantive changes after Working Draft 13 (16 April 2025) per the spec's own Appendix C Revision History. Adds post-quantum mechanisms: ML-KEM (CKM_ML_KEM 0x00000017, CKM_ML_KEM_KEY_PAIR_GEN 0x0000000f), ML-DSA (CKM_ML_DSA 0x0000001d, CKM_ML_DSA_KEY_PAIR_GEN 0x0000001c, CKM_HASH_ML_DSA_*), and SLH-DSA (CKM_SLH_DSA, CKM_SLH_DSA_KEY_PAIR_GEN). Introduces C_EncapsulateKey() and C_DecapsulateKey() for KEM operations, and C_WrapKeyAuthenticated()/C_UnwrapKeyAuthenticated(). New key types: CKK_ML_KEM (0x49), CKK_ML_DSA (0x4a), CKK_SLH_DSA (0x4b). New attributes: CKA_PARAMETER_SET, CKA_ENCAPSULATE, CKA_DECAPSULATE, CKA_SEED.

Web page · 5.5 MB · a long read

PKCS #11 Cryptographic Token Interface Profiles Version 3.2 (OASIS Standard)

Defines the conformance profiles that PKCS#11 v3.2 conformance is measured against. Section 7 of the base specification states that an implementation is a conforming Provider only if it meets one or more provider profiles specified here, so the base spec mandates no mechanism on its own. Specifies Baseline Provider, Complete Provider, Extended Provider, Authentication Token, Public Certificates Token and HKDF TLS Token, plus Baseline and Extended Consumer. Baseline Provider requires a CKO_PROFILE object with CKP_BASELINE_PROVIDER and explicitly requires no mechanisms. Edited by Tim Hudson (Cryptsoft); supersedes Profiles v3.1.

PDF · 530 KB · a long read

ML-DSA-44/Ed25519 Composite Signatures in SSH (draft-miller-sshm-mldsa44-ed25519-composite-sigs-00)

Individual draft defining ML-DSA-44 + Ed25519 composite signatures for SSH. Replaces the earlier ML-DSA-65 composite draft.

Web page · 61 KB · a short read

ML-DSA 44/Ed255192 Composite Signatures in SSH

Specifies the ML-DSA-44 with Ed25519 composite signature pairing for SSH.

Web page · 14 KB · a quick skim

The Applied Quantum PQC Migration Framework (v2.1)

Major v2.1 (June 2026) of Marin Ivezic's (Applied Quantum) enterprise PQC migration methodology. Phase-by-phase guide across 8 phases (0-7) plus cross-cutting Skills, SOC, and GRC layers and sector packs. v2.0/v2.1 add a two-track approach, right-sizing profiles, AI-assisted migration guidance (5.7), a data-at-rest strategy (5.6), and new appendices: framework crosswalk (G) and protocol coverage matrix (H). Informed by NIST FIPS 203/204/205, IR 8547, CNSA 2.0, ETSI, and GSMA standards. Licensed CC BY 4.0.

PDF · 1.5 MB · a long read

Quantum-Resilient Organizational Identity: Governance, Business Wallets, and PQC Corridors

Three-author governance and systems-architecture analysis of organizational identity in the PQC transition. Distinguishes harvest-now-decrypt-later confidentiality risk from the integrity / non-repudiation risk created by future forgery of legacy digital signatures. Introduces the "PQC Corridor" — a bounded governance + technical migration domain coordinating scope, legal assurance, data horizons, trust boundaries, cryptographic profiles, and audit. Treats business wallets (incl. proposed European Business Wallet), qualified Verifiable Data Registries (qVDRs), and Verifiable LEIs (vLEIs) as organizational interfaces for cross-jurisdiction trust. Targets B2B, B2G, G2G, M2M, and agent-to-agent ecosystems.

Web page · 421 KB · a long read

Crypto News, June 2026

Cloud Security Alliance monthly cryptography newsletter compiled by Dr. Dhananjoy Dey (IIIT Lucknow, CSA Quantum-Safe Security Working Group). June 2026 issue covers cryptographic maturity as a precursor to PQC, the new DST (Distributed Service Trust) Task Force report on quantum-safe thinking, and ongoing PQC migration coverage across standards bodies and industry. Published under the CSA Quantum-Safe Security Working Group.

Web page · 116 KB · a short read

Exploiting ML-DSA bugs

Cryptanalysis paper by Daniel J. Bernstein demonstrating exploitability of ML-DSA software vulnerabilities. Reproduces two distinct bug patterns (Dilithium 1.0 implementation flaw + PlayStation 3 ECDSA-style randomness reuse) as ML-DSA software variants, each forging signatures in ~1 second on a laptop core. Provides open-source attack demos that recover equivalent secret keys from public keys + a small number of signatures. Estimates breakable-key rates over time for ML-DSA solo vs. Ed25519+ML-DSA hybrid, arguing quantitatively for hybrid signature deployment.

PDF · 546 KB · a long read

ENISA — SBOM Adoption State of Play 2026: Survey Results and Analysis

ENISA survey-based analysis of Software Bill of Materials (SBOM) adoption across the EU (June 2026). Reports survey results on adoption readiness, formats (SPDX/CycloneDX), tooling and SDLC lifecycle integration, barriers and supplier requirements; finds the EU Cyber Resilience Act (CRA) is the primary accelerator, with 79% of organisations expecting to reach SBOM maturity before the CRA becomes fully applicable. Foundational to crypto-asset inventory and CBOM for PQC migration.

PDF · 2.9 MB · a reference document — dip in, don’t read it through

EU NIS Cooperation Group — Reference Document on Security Measures for Entities under NIS2 v1.0

NIS Cooperation Group reference document (v1.0, June 2026) detailing technical and methodological security measures for essential and important entities under the NIS2 Directive (EU) 2022/2555, aligned with Commission Implementing Regulation (EU) 2024/2690. Covers cybersecurity governance, risk management, supply-chain security, effectiveness assessment and a dedicated cryptography section (2.10 Cryptography); replaces the previous Cooperation Group reference document.

Web page · 50 KB · a short read

Post-Quantum Cryptography in OpenPGP

Published RFC form of draft-ietf-openpgp-pqc: defines post-quantum and hybrid public-key algorithms for OpenPGP — ML-KEM key encapsulation with ML-DSA / SLH-DSA / Ed25519 signatures.

Web page · 825 KB · a long read

RFC 9958

IETF guidance relevant to the post-quantum transition; see the document for its normative scope.

Web page · 161 KB · a long read

https://arxiv.org/pdf/2606.04669

PDF · 2.5 MB · a reference document — dip in, don’t read it through

ETSI TS 119 312 V2.1.1 - Electronic Signatures and Trust Infrastructures (ESI); Cryptographic Suites

ETSI cryptographic suites for electronic signatures and trust services — which algorithms and key sizes are approved for qualified signatures in the EU.

PDF · 303 KB · a short read

Circle's Post-Quantum Security Roadmap: Securing blockchains smart contracts and digital assets for the quantum era

Three-phase PQC migration roadmap for Circle (USDC issuer) and the Arc blockchain. Catalogs seven quantum attack vectors on the full blockchain stack (at-rest forgery via EVM ecrecover; retroactive privacy loss; consensus disruption; history rewrite; P2P session compromise via libp2p/Noise; RPC interception; on-spend). Readiness phase: SLH-DSA-SHA2-128s on-chain precompile for smart-account signature verification; X-Wing hybrid KEM (ML-KEM-768 + X25519) for TLS 1.3 and encrypted memos; TEE-based private execution environment (AWS Nitro/SGX/TDX). Transition phase: dual-mode USDC smart contracts; post-quantum ecrecover override; multi-sig cold storage; encrypted mempool. Switch phase: full PQ validator signatures; account recovery (dual-key BIP-39 derivation; TEE-attested ZK proof; off-chain). Policy section covers quantum flag day regulatory implications for stranded USDC assets. Co-authored with Dan Boneh (Stanford).

PDF · 607 KB · a long read

Downgrade Prevention for the Internet Key Exchange Protocol Version 2 (IKEv2)

Specifies a mechanism to prevent algorithm downgrade attacks in IKEv2, ensuring that PQC-capable peers cannot be forced to negotiate weaker classical algorithms. Companion to draft-ietf-ipsecme-ikev2-mlkem.

Web page · 28 KB · a quick skim

Hardware-Enabled Security: Confidential Computing of Data in Cloud Workloads

NIST IR 8320 Series Volume E. Defines a TEE plus remote-attestation plus key-release workflow for protecting AI/ML data in use within cloud workloads. Frames confidential computing as the third pillar (alongside data-at-rest and data-in-transit encryption) and ties hardware-anchored attestation into cloud KMS key release.

PDF · 907 KB · a long read

x402 Cryptographic Receipts: Format, Post-Quantum Discipline, and Starknet Anchor

Defines the x402 cryptographic receipt format and its post-quantum requirements, anchored to Starknet.

Web page · 137 KB · a short read

MVPS Proof Envelope: Tamper-Evident Binding of Theorem Catalogues, Validators, and Numerical Receipts, with an Optional Post-Quantum Profile

Proposes a tamper-evident envelope binding theorem catalogues to their validators and proofs.

Web page · 61 KB · a short read

PQ Key Exchange in SSH using ML-KEM

This document defines pure post-quantum key exchange methods based on Module-lattice post-quantum key encapsulation schemes for use in the SSH Transport Layer Protocol.

Web page · 53 KB · a short read

Post-quantum hybrid ECDHE-MLKEM Key Agreement for TLS 1.3 (draft-ietf-tls-ecdhe-mlkem-05)

Hybrid X25519MLKEM768 / SecP256r1MLKEM768 key agreement for TLS 1.3. IESG-approved; in the RFC Editor queue.

Web page · 84 KB · a short read

RFC 10024 — Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3

Specifies X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 hybrid groups for TLS 1.3. Normative hybrid framework: draft-ietf-tls-hybrid-design (also in RFC Ed Queue). Both drafts in final pre-publication stage as of Feb 2026.

Web page · 75 KB · a short read

Post-Quantum Cryptographic Discipline for x402 STARK Receipts

Sets out post-quantum requirements for x402 STARK-based payment receipts.

Web page · 83 KB · a short read

Merkle Tree Certificates

This document describes Merkle Tree certificates, a new form of X.509 certificate that integrates public logging with certificate issuance to reduce overhead for post-quantum signatures.

Web page · 194 KB · a long read

Composite ML-DSA for use in Cryptographic Message Syntax (CMS)

LAMPS WG-adopted draft specifying composite ML-DSA (ML-DSA + RSA-PSS / RSA-PKCS1 / ECDSA / Ed25519 / Ed448) SignerInfo for CMS per RFC 5652. Provides CMS-specific guidance for 18 composite signature algorithm combinations operating in pre-hash mode with algorithm-specific digests (SHA-256 / SHA-512 / SHAKE256). Latest revision -04, IESG state AD Followup (DISCUSS pending), Proposed Standard.

Web page · 49 KB · a short read

A Mechanism for X.509 Certificate Discovery (draft-ietf-lamps-certdiscovery-03)

Lets a primary certificate advertise where a related secondary certificate (for example one with a PQC key) can be fetched, using a new subjectInfoAccess access method (id-ad-certDiscovery) and a relatedCertificateDescriptor otherName. Supports migration where a relying party needs a certificate in another algorithm. Replaces draft-lamps-okubo-certdiscovery. OIDs are still TBD.

Web page · 85 KB · a short read

Use of the FN-DSA Signature Algorithm in the CMS (WG draft)

Defines FN-DSA (FALCON/FIPS 206) signature usage in CMS. Expires May 2026.

Web page · 30 KB · a quick skim

Algorithm Identifiers for FN-DSA in X.509 (draft-ietf-lamps-fn-dsa-certificates-00)

Defines how FN-DSA (the Falcon-based signature planned as FIPS 206) public keys and signatures appear in X.509 certificates and CRLs. Its OIDs under the NIST sigAlgs arc are still TBD and FIPS 206 is not final, so no deployable FN-DSA certificate exists yet. Watchlist item.

Web page · 94 KB · a short read

Hybrid Post-quantum Key Exchange SM2-MLKEM for TLSv1.3

Defines curveSM2MLKEM768 hybrid for TLS 1.3 combining Chinese SM2 curve with ML-KEM.

Web page · 15 KB · a quick skim

Use of Composite ML-DSA in TLS 1.3

Defines the use of Composite ML-DSA hybrid signatures in TLS 1.3, combining ML-DSA with classical algorithms (ECDSA, RSA) for backward-compatible migration. Extends draft-ietf-lamps-pq-composite-sigs into the TLS layer.

Web page · 33 KB · a quick skim

Algorand Post-Quantum Ledger

Algorand's three-phase quantum-resistance roadmap: (1) blockchain history protected via State Proofs with Falcon (deployed 2022), (2) lazy migration for current account security — single-sig, multisig, LSig, and App accounts each given specific Falcon rekeying paths, (3) native PQC accounts (stateless or stateful Falcon) with consensus PQC planned. First MainNet Falcon transaction via LSig account abstraction deployed November 2025.

Web page · 210 KB · a long read

Status Report on the Second Round of the Additional Digital Signature Schemes for the NIST Post-Quantum Cryptography Standardization Process

Status report on the second round of the NIST additional post-quantum digital signature candidates beyond the lattice-based standards.

PDF · 389 KB · a short read

Post-Quantum Enhancements to TLS-Based EAP Methods

WG-adopted successor to draft-reddy-emu-pqc-eap-tls: hybrid key exchange recommended for TLS-based EAP methods; addresses large-certificate round-trip/fragmentation risk and inner-auth exposure if the outer tunnel breaks.

Web page · 64 KB · a short read

ML-KEM Security Considerations

Implementation-guidance draft (co-authored by Scott Fluhrer et al.) on ML-KEM pitfalls: validate public keys via Encapsulation Key Check, guard entropy quality, retain public key alongside secret key, watch PAKE-context timing side-channels.

Web page · 74 KB · a short read

Key Management Interoperability Protocol Specification Version 3.0

Web page · 19.3 MB · a long read

SLH-DSA / SPHINCS+ Public Keys for SSH

Specification of SLH-DSA/Sphincs+ digital signatures for SSH, including standalone and hybrid modes with Ed25519/Ed448.

Web page · 107 KB · a short read

The Quantum Threat to Blockchains: 2026 Report

110-page comprehensive analysis of quantum threats to blockchain systems by Project Eleven. Projects Q-Day likely by 2030–2033. Covers secp256k1/ECDSA vulnerability, Bitcoin and Ethereum exposure, BIP-32 HD wallet risk, stablecoin quantification, and urgent PQC migration recommendations for blockchain operators and digital asset custodians.

Web page · 195 KB · a long read

AuthKEM with PSK Authentication in TLS 1.3

Extends TLS AuthKEM with pre-shared key authentication modes; provides a fully quantum-resistant TLS 1.3 handshake without relying on any classical asymmetric primitives.

Web page · 40 KB · a short read

KEM-based Authentication for TLS 1.3 (AuthKEM)

Replaces classical signature-based TLS 1.3 authentication with a KEM-based handshake.

Web page · 99 KB · a short read

Post-Quantum Cryptography Migration in Australian Real-Time Payment Infrastructure: A Monte Carlo Simulation Study of the New Payments Platform

Monte Carlo simulation (lognormal latency, M/M/c queueing, GEV tails) showing ML-DSA and Falcon meet payment SLAs, plus a four-phase bottom-up migration cost model and a harvest-now-decrypt-later exposure estimate. Illustrates the probabilistic and activity-based cost-model families for PQC migration.

PDF · 2.2 MB · a reference document — dip in, don’t read it through

RFC 9964 — ML-DSA for JOSE and COSE

This document specifies JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE) serializations for Module-Lattice-Based Digital Signature Standard (ML-DSA) defined in NIST FIPS 204. Registers ML-DSA-44/65/87 with the new Algorithm Key Pair (AKP) key type (kty=AKP, COSE kty=7) and JOSE alg names matching the COSE registrations (-48/-49/-50). HashML-DSA is explicitly out of scope (§7.2); private key is the 32-byte seed only.

Web page · 260 KB · a long read

Web Authentication: An API for accessing Public Key Credentials - Level 3

Web Authentication Level 3 specification for browser-based public-key authentication. Targeted by ML-DSA WebAuthn drafts that add PQ COSE algorithm identifiers for passkeys.

Web page · 2.7 MB · a long read

Preparing for Quantum Technologies: Key Considerations for Financial Sector Participants

G7 Central Bank Quantum Technologies Working Group analytical report co-chaired by Banque de France and Bank of Canada. Covers harvest-now-decrypt-later risks, PQC migration planning for financial infrastructures, and quantum computing applications in finance (optimisation, simulation, payment systems). Provides governance and interoperability considerations for central banks and financial institutions transitioning to quantum-resilient security.

Web page · 295 KB · a long read

From Strategy to Architecture: How Cisco Is Building a Quantum-Safe Future

Cisco blog outlining its internal quantum-safe architecture strategy: embedding PQC into firmware, hardware, and supply chain. Covers ML-KEM, ML-DSA adoption roadmap, crypto-agility framework, and lessons from large-scale enterprise migration planning.

Web page · 80 KB · a short read

PQShield: 4 Quantum Threats Enterprises Must Address Now

PQShield identifies four immediate quantum threats enterprises must address: harvest-now-decrypt-later attacks, vulnerable key exchange in TLS, insecure firmware signing, and inadequate crypto-agility. Recommends prioritized PQC migration starting with key establishment.

Web page · 162 KB · a long read

Hybridization of Traditional Cryptographic Mechanisms with PQC — Standardisation Status

ENISA/ECCG cross-protocol survey of IETF, ETSI, NIST, and ITU-T hybrid PQ/T standardisation status across 14 protocols (TLS, IKEv2, CMS/S-MIME, SSH, OpenPGP, COSE, JOSE, MLS, EAP-AKA', PKIX/X.509, HPKE, CFRG, MLKEM/FrodoKEM combiners). Maps hybrid key agreement (CatKDF/CasKDF, NIST SP 800-227) and hybrid signature status against ECCG Agreed Cryptographic Mechanisms v2.0; explicitly not an ENISA recommendation.

PDF · 1.1 MB · a long read

A Survey on Security Reductions in Post-Quantum Cryptography

Surveys the security reductions underpinning post-quantum schemes: what each construction actually proves, and against which assumption.

PDF · 686 KB · a long read

Post-Quantum Cryptographic Agility in Model Context Protocol Transport

Technical analysis of PQC agility requirements in MCP (Model Context Protocol) transport layer used by AI agents. Examines how LLM tool-calling infrastructure inherits TLS vulnerabilities and proposes hybrid PQC key exchange as a mitigation for AI-to-AI and AI-to-tool communication channels.

Web page · 152 KB · a long read

Why 2026 Matters for Quantum Security

The Quantum Insider analysis of why 2026 is a pivotal year for quantum security: NIST standards finalized, government migration deadlines approaching, enterprise procurement cycles beginning, and hardware progress accelerating. Frames 2026 as the year quantum security moves from planning to execution.

Web page · 229 KB · a long read

Monetizing the Quantum Shift: 11 PQC Channel Opportunities

ITPro/CSA analysis of 11 business channel opportunities emerging from the PQC migration wave. Covers managed PQC services, crypto-agility tooling, compliance consulting, hardware security modules, and post-quantum VPN products as revenue streams for technology vendors and MSSPs.

Web page · 1.0 MB · a long read

Quantum Security: Threats, Solutions, And The Race To Protect Data

Quantum Insider overview of the quantum security landscape: threat timeline, key cryptographic vulnerabilities (RSA, ECDSA, DH), PQC solution categories (KEM, signatures, agility), and the competitive race among enterprises, governments, and vendors to deploy quantum-safe infrastructure.

Web page · 244 KB · a long read

Q-Day: Accelerated Timeline Across Wider Attack Surface — Executive Summary

Quantum Computing Report executive summary on the accelerating Q-Day timeline. Synthesizes hardware progress (Google Willow, neutral-atom systems), algorithmic improvements reducing qubit requirements, and expanded attack surface beyond RSA to ECDSA and lattice-adjacent schemes. Projects credible Q-Day risk by 2029–2030.

Web page · 135 KB · a short read

MLS Combiner — Traditional + PQ MLS hybrid session

Specifies combining a traditional MLS session with a PQ MLS session for amortized hybrid security.

Web page · 45 KB · a short read

In a First, a Ransomware Family Is Confirmed to Be Quantum-Safe

Ars Technica reporting on the first confirmed ransomware family deploying post-quantum cryptography. The ransomware uses ML-KEM for key encapsulation, making traditional decryption-key recovery impossible even with law enforcement access to command-and-control infrastructure. Marks a new threat tier for incident response.

Web page · 147 KB · a short read

A Mechanism for Encoding Differences in Paired Certificates (Chameleon Certs)

Defines an X.509v3 extension encoding differences between two paired certificates. Allows a relying party to reconstruct both traditional and PQC certificates from a single cert. Alternative to composite and related-certificate (RFC 9763) hybrid approaches. Backed by DigiCert and Entrust.

Web page · 191 KB · a long read

Cryptologist Finds AES-128 Likely Safe from Quantum Attack

Quantum Insider coverage of new cryptanalysis research concluding AES-128 remains secure against quantum attack under revised Grover algorithm resource estimates. Higher parallelization requirements and error correction overhead mean AES-128 provides adequate quantum security margin, contrary to earlier conservative estimates.

Web page · 222 KB · a long read

Common Policy X.509 Certificate and CRL Profiles — PQC (DRAFT, April 2026)

The draft post-quantum profile for US Federal PKI certificates and CRLs — what a federal PQC certificate is allowed to contain.

PDF · 700 KB · a long read

Output Schema Based on Cryptographic Bill of Materials (CBOM) for Post-Quantum Cryptography Inventory

Proposes an organizational-level Cryptographic Asset Inventory schema extending CycloneDX CBoM (component-level) to hardware/software/services, with quantum-readiness compliance indicators and criticality scoring.

Web page · 68 KB · a short read

IPv4.5: A Locator/Identifier-Separated Extension to IPv4 with Post-Quantum Session Security

Single-author proposal for a 96-bit locator/identifier-separated IPv4 extension with hybrid ML-KEM-768+X25519 session security over UDP/4242; addresses IPv4 exhaustion, not adopted by any WG.

Web page · 108 KB · a short read

SP 800-133 Rev. 3 (IPD): Recommendation for Cryptographic Key Generation

NIST draft recommendation specifying methods for generating cryptographic keys. Rev. 3 adds ML-KEM-based symmetric key establishment, PQC signature algorithm support (ML-DSA), seed-expansion via SHAKE and DRBGs, and aligns randomness guidance with SP 800-90C. Public comment period closes June 16, 2026.

Web page · 46 KB · a short read

Post-Quantum Cryptography Strategy for DNSSEC

Strategy document recommending SLH-DSA-MTL, Falcon, XMSS, LMS plus "drop-in" NIST onramp algos for DNSSEC.

Web page · 57 KB · a short read

GhostLock: A Hybrid Post-Quantum Encryption Protocol Combining Classical and Lattice-Based Cryptography

File-level hybrid encryption protocol (X25519/Ed25519 + Kyber768, ChaCha20-Poly1305 AEAD) defining a .glock container format; individual submission, not a protocol used by any deployed system in this catalog.

Web page · 39 KB · a quick skim

Building your cryptographic inventory: a customer strategy for cryptographic posture management

Microsoft Security Blog on establishing a cryptographic inventory as the foundation of a CPM program; four-phase approach from discovery to continuous monitoring.

Web page · 307 KB · a long read

Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways

Meta Engineering case study on a large-scale PQC migration with explicit inventory, policy, and rollout framework.

Web page · 125 KB · a short read

Additional SLH-DSA Parameter Sets for Limited-Signature Use Cases (Initial Public Draft)

NIST SP 800-230 extends FIPS 205 with six new SLH-DSA parameter sets (SHA2 and SHAKE at levels 1/3/5) optimised for firmware signing, software distribution, and certificate signing. Signatures are roughly half the size of FIPS 205 variants but carry a strict 2^24 signatures-per-key limit. Not for general-purpose use.

Web page · 49 KB · a short read

Hybrid Post-Quantum and Traditional Authentication for IKEv2

Defines composite-certificate hybrid authentication for IKEv2 (traditional + PQC signatures in one cert) without changing base protocol messages; requires IKEv2 Fragmentation support for larger messages.

Web page · 58 KB · a short read

CryptoNext Security First in EU With Full NIST Quantum-Safe Certification

CryptoNext Security becomes the first EU company to achieve full NIST quantum-safe certification across ML-KEM, ML-DSA, and SLH-DSA. Coverage of their C-Pqc library FIPS compliance milestone and implications for European organizations seeking certified PQC implementations.

Web page · 152 KB · a long read

Yikes, Encryption's Y2K Moment Is Coming Years Early

EFF policy analysis drawing parallel between Y2K remediation urgency and the PQC migration challenge. Argues the quantum cryptography deadline is arriving faster than expected with less organizational readiness. Calls for immediate government action, vendor support timelines, and user-facing communication.

Web page · 65 KB · a short read

Google, Cloudflare Want Post-Quantum Cryptography by 2029

Australian Computer Society coverage of Google and Cloudflare jointly pushing for industry-wide PQC deployment by 2029. Both companies cite accelerating quantum hardware progress and HNDL risks as justification for a 2029 deadline — three years earlier than previously communicated targets.

Web page · 33 KB · a quick skim

Quantum XChange Launches Phio TX Management Console

Quantum XChange announces Phio TX Management Console for centralized PQC key management and crypto-agility across enterprise networks. Enables policy-based PQC algorithm selection, inventory tracking, and rollout orchestration for hybrid classical/PQC environments.

Web page · 218 KB · a long read

SSH Support of ML-DSA

This document describes the use of ML-DSA digital signatures for authentication within the Secure Shell (SSH) protocol.

Web page · 61 KB · a short read

Decrypting the Future: Global Timelines for Post-Quantum Cryptography and Why They Matter

Charter of Trust PQC Working Group report comparing global PQC transition timelines across US, EU, UK, Japan, Singapore, and Australia. Covers sectoral prioritization, quantum threat landscape, attack scenarios, and a practitioner playbook for PQC migration. Contributors include Siemens, IBM, Microsoft, Infineon, Atos, and Bosch.

Web page · 100 KB · a short read

Cloudflare's Post-Quantum Roadmap

Cloudflare's official post-quantum roadmap blog. Details phased deployment: X25519MLKEM768 hybrid in TLS already deployed to all customers, plans for ML-DSA certificate signing, 2029 target for full quantum-safe infrastructure, and migration guidance for customers.

Web page · 504 KB · a long read

QSE Launches Enterprise Post-Quantum Migration Platform with QPA v2 Release

QSE launches QPA v2, an enterprise post-quantum migration platform providing automated cryptographic inventory discovery, risk scoring, and migration orchestration. Integrates with existing PKI and key management systems to enable phased PQC rollout without infrastructure replacement.

Web page · 137 KB · a short read

Use of Hybrid Public-Key Encryption (HPKE) with COSE

Adds HPKE (RFC 9180 base mode plus PQ/T hybrid KEM algorithms) to COSE, enabling pure and hybrid post-quantum key encapsulation for COSE_Encrypt structures. Revision -25 submitted to IESG for publication; in AD evaluation as of 2026-04-07.

Web page · 269 KB · a long read

Adapting Constrained Devices for Post-Quantum Cryptography

Guidance for integrating PQC into resource-constrained devices including IoT nodes and lightweight HSMs; covers seed-based key generation, ephemeral key handling, cryptographic task offloading, and post-quantum firmware authentication.

Web page · 65 KB · a short read

Streamlined NTRU Prime sntrup761 Key Exchange for SSH

Specifies sntrup761x25519-sha512 hybrid key exchange for SSH; supersedes draft-ietf-sshm-ntruprime-ssh.

Web page · 89 KB · a short read

Content Credentials: C2PA Technical Specification, Version 2.4

C2PA's normative specification for Content Credentials — cryptographically signed provenance manifests (claims, assertions, hard/soft bindings) embedded in media assets, with an X.509/COSE trust and validation model. Cited by the ai-security-pqc module for content provenance; the specification is not about post-quantum cryptography, and its allowed signature algorithms are ECDSA, RSASSA-PSS and Ed25519 only.

Web page · 1.1 MB · a long read

NIST SP 1800-40B (Initial Public Draft) — Automation of the NIST Cryptographic Module Validation Program

Initial public draft of NIST SP 1800-40B (April 2026), the NCCoE practice guide volume on automating the Cryptographic Module Validation Program.

PDF · 2.5 MB · a reference document — dip in, don’t read it through

NIST IR 8259 Rev. 1 Foundational Cybersecurity Activities for IoT Product Manufacturers

NIST report describing recommended cybersecurity activities manufacturers should consider before their IoT products are sold, so customers get the product cybersecurity capabilities and information they need; supersedes NIST IR 8259 (2020). Recommends considering quantum-safe approaches and updatable hardware to allow a later move to post-quantum cryptography (pp. 31-32), without setting a deadline.

PDF · 2.6 MB · a reference document — dip in, don’t read it through

NIST CMVP Certificate #5223

Web page · 83 KB · a short read

Looking Beyond the CBOM: Building Stronger Cryptographic Posture

Argues a CBOM is necessary but insufficient; posture management adds lifecycle, policy, observability, and assurance layers.

Web page · 84 KB · a short read

Study of Post Quantum Status of Widely Used Protocols

Cisco Research survey examining PQC migration status across nine widely deployed protocols: TLS, IPsec, BGP, DNSSEC, SSH, QUIC, OpenID Connect, OpenVPN, and Signal Protocol. Analyses cryptographic foundations, quantum risks, and current state of PQC migration per protocol. Finds TLS and Signal lead with hybrid PQC key exchange deployed at scale; DNSSEC and BGP face structural barriers due to signature size constraints.

PDF · 603 KB · a long read

Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations

Google Quantum AI and Ethereum Foundation whitepaper providing new resource estimates for breaking secp256k1 (256-bit ECDLP) with Shor's algorithm — under 1,200 logical qubits and 90 million Toffoli gates. Introduces fast-clock vs slow-clock CRQC distinction and "on-spend" attack concept. Surveys cryptocurrency vulnerabilities including mempool exposure, reused addresses, and P2PK outputs. Recommends migration to PQC signatures for blockchain systems.

PDF · 1.7 MB · a reference document — dip in, don’t read it through

Shor's Algorithm is Possible with as Few as 10,000 Reconfigurable Atomic Qubits

Demonstrates that Shor's algorithm for breaking RSA and ECC can be executed with as few as ~10,000 reconfigurable neutral atom qubits — an order of magnitude fewer than prior estimates. Substantially narrows the timeline for practical quantum attacks on current public-key infrastructure.

Web page · 44 KB · a short read

SLH-DSA in Merkle Tree Ladder Mode for DNSSEC

Specifies SLH-DSA in Merkle Tree Ladder mode for DNSSEC to mitigate the signature-size problem.

Web page · 68 KB · a short read

Understanding Cryptographic Posture Management and Asset Visibility

EJBCA/Keyfactor primer framing CPM as continuous visibility + automated policy enforcement across certs, keys, and libraries.

Web page · 85 KB · a short read

25 Companies Building the Quantum Cryptography and Communications Markets

Quantum Insider survey of 25 companies shaping the quantum cryptography and communications market in 2026. Covers PQC software vendors, QKD hardware providers, crypto-agility platform companies, and quantum networking startups. Useful vendor landscape reference for procurement and market analysis.

Web page · 236 KB · a long read

ML-DSA for Web Authentication (revision -04)

Defines ML-DSA (FIPS 204) as a new algorithm for WebAuthn/FIDO2 authentication. Specifies COSE algorithm identifiers for ML-DSA variants for use in W3C Web Authentication credentials.

Web page · 44 KB · a short read

TLS Key Share Prediction

Mechanism for TLS 1.3 servers to predict which key share a client will offer, enabling zero-RTT PQC key exchange by avoiding HelloRetryRequest. Critical for ML-KEM deployment performance given large key sizes.

Web page · 15 KB · a quick skim

NIST CSWP 37A — Automation of the NIST Cryptographic Module Validation Program: September 2024 Status Report

NIST CSWP 37A, published 16 March 2026: the September 2024 status report of the NCCoE project on automating the Cryptographic Module Validation Program.

PDF · 834 KB · a long read

FN-DSA for JOSE and COSE

Defines FN-DSA (FALCON) algorithm identifiers and serialization for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE).

Web page · 93 KB · a short read

TCG TPM 2.0 Library Specification V185 — Part 0: Introduction

Overview and change summary for the TCG TPM 2.0 Library V1.85 RC4 specification. Introduces PQC algorithm IDs (TPM_ALG_MLKEM=0x00A0; TPM_ALG_MLDSA=0x00A1) and explains the rationale for enlarging TPM_BUFFER_MAX from 4096 to 8192 bytes to accommodate ML-DSA-87 signatures.

PDF · 300 KB · a short read

TCG TPM 2.0 Library Specification V185 — Part 1: Architecture

Defines the TPM 2.0 architecture including the four-hierarchy model (Platform/Endorsement/Storage/Owner) and their handle values (TPM_RH_ENDORSEMENT=0x4000000B; TPM_RH_OWNER=0x40000001; TPM_RH_PLATFORM=0x4000000C). Specifies PQC key roles (EK; SRK; AIK; IDevID) and the impact of ML-KEM-768 and ML-DSA-65 adoption on attestation flows and TPM_BUFFER_MAX.

PDF · 3.3 MB · a reference document — dip in, don’t read it through

TCG TPM 2.0 Library Specification V185 — Part 2: Structures

Normative structure definitions for TPM 2.0 V1.85. Assigns TPM_ALG_MLKEM=0x00A0 and TPM_ALG_MLDSA=0x00A1. Defines TPMT_ASYM_SCHEME for ML-KEM encapsulation and ML-DSA signing. Specifies key-size constants: ML-KEM-768 pk=1184B/ct=1088B; ML-DSA-65 pk=1952B/sig=3309B. Sets TPM_BUFFER_MAX=8192 and TPM2B_MAX_BUFFER size.

PDF · 875 KB · a long read

TCG TPM 2.0 Library Specification v1.85, Part 3: Commands (Published)

PUBLISHED TPM 2.0 Library v1.85 Part 3: Commands. Supersedes the December 2025 RC4. Defines ML-DSA, ML-KEM, Labeled KEM, EdDSA TPM commands.

NIST ESV Certificate E321

Web page · 41 KB · a short read

2025 Quantum Threat Timeline Report

Annual expert survey of 26 global quantum computing experts on CRQC probability and timeline. Published March 2026. 2025 survey shows significant acceleration: 28-49% probability within 10 years (up from 19-34% in 2024), 51-70% within 15 years. Majority now consider a CRQC likely by 2035. Authored by Dr. Michele Mosca and Dr. Marco Piani (evolutionQ Inc.), published by the Global Risk Institute.

PDF · 9.1 MB · a reference document — dip in, don’t read it through

Internet X.509 PKI — Algorithm Identifiers for ML-KEM

Defines algorithm identifiers (OIDs) for ML-KEM-512, ML-KEM-768, and ML-KEM-1024 for use in X.509 certificates and CRLs. Direct complement to RFC 9881 (ML-DSA identifiers). Required for post-quantum PKI certificate issuance.

Web page · 694 KB · a long read

Use of ML-KEM in the Cryptographic Message Syntax (CMS)

Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) is a quantum-resistant Key Encapsulation Mechanism (KEM). Three parameter sets for the ML-KEM algorithm are specified by the US National Institute of Standards and Technology (NIST) in FIPS 203. In order of increasing security strength (and decreasing performance), these parameter sets are ML-KEM-512, ML-KEM-768, and ML-KEM-1024. This do

Web page · 405 KB · a long read

KEM based Authentication for IKEv2 with Post-quantum Security

Specifies KEM-based authentication for IKEv2 as more efficient alternative to ML-DSA.

Web page · 97 KB · a short read

X-Wing: general-purpose hybrid post-quantum KEM

Specifies X-Wing, a general-purpose hybrid KEM combining X25519 with ML-KEM-768. Unlike the TLS named groups it is not bound to a single protocol, which is why it appears in file/secrets encryption (age, SOPS) as well as on the wire. Fixes encapsulation key at 1216 bytes, ciphertext at 1120 and shared secret at 32.

Web page · 145 KB · a short read

Protecting Subscriber Identifiers with Subscription Concealed Identifier (SUCI): Applying 5G Cybersecurity and Privacy Capabilities

NIST Cybersecurity White Paper (Initial Public Draft) covering the 5G Subscription Concealed Identifier (SUCI) mechanism per 3GPP TS 33.501. Describes how SUCI protects permanent subscriber identifiers (SUPIs/IMSIs) using public-key encryption (X25519 Profile A, P-256 Profile B) to prevent IMSI-catching attacks. Authored by NIST ITL, Scarfone Cybersecurity, and The MITRE Corporation.

PDF · 2.3 MB · a reference document — dip in, don’t read it through

Quantifying Harvest-Now-Decrypt-Later Threats: An Empirical Analysis of Rekeying Defences

Empirical analysis of HNDL attack economics across TLS 1.2, TLS 1.3, QUIC, and SSH. Quantifies adversarial storage cost feasibility; proposes aggressive rekeying and hybrid PQC as defences. References production deployments by Cloudflare, Apple PQ3, AWS, and Google Chrome. Companion paper to the open-source hndl-dev simulator.

Web page · 322 KB · a long read

Quantum Technology Primer - Communications

Australian Cyber Security Centre primer on quantum technology for the communications sector. Covers quantum threats, PQC migration priorities, and guidance for Australian telecom operators.

Web page · 320 KB · a long read

PQ/Traditional Hybrid Authentication in IKEv2

Proposes using both a classical (ECDSA) and PQC (ML-DSA) signature in IKEv2 AUTH payload for defense-in-depth during the transition period.

Web page · 29 KB · a quick skim

Cultivating a robust and efficient quantum-safe HTTPS (Chrome Root Program)

Google/Chrome Root Program statement of the Web PKI post-quantum plan. Chrome has NO immediate plan to add PQC X.509 certificates to its root store; instead it is pursuing Merkle Tree Certificates in three phases — Phase 1 feasibility study with Cloudflare (underway), Phase 2 CT-log bootstrapping (Q1 2027), Phase 3 the Chrome Quantum-resistant Root Store alongside the existing one (Q3 2027).

Web page · 259 KB · a long read

X.509 Extensions for PQC Continuity

Defines X.509 certificate extensions that allow a certificate authority or subscriber to embed a PQC Continuity commitment directly in a certificate. A relying party that encounters this extension knows the server is committed to PQC and can refuse future classical-only connections, extending the TLS-layer draft-sheffer-tls-pqc-continuity concept into the PKI certificate layer.

Web page · 66 KB · a short read

Post-Quantum Cryptography Recommendations for TLS-based Applications

Best practices for implementing quantum-ready usage profiles in TLS-based applications.

Web page · 97 KB · a short read

Reducing the Number of Qubits in Quantum Discrete Logarithms on Elliptic Curves

Applies the same Residue Number System compression to the elliptic-curve discrete logarithm problem, reaching 3.12n + o(n) qubits — the most space-efficient polynomial-time ECDLP algorithm published. Estimates 1,193 logical qubits for a 256-bit curve at 2^38.98 Toffoli gates across 22 runs, against 2,043 for RSA-3072 at comparable classical security.

PDF · 503 KB · a long read

Post-Quantum and Hybrid KEMs for HPKE with JOSE and COSE

Specification of Post-Quantum and Hybrid KEMs for HPKE within JOSE and COSE, including algorithm identifiers and key formats.

Web page · 155 KB · a long read

India DST Task Force Report — Phased Roadmap for Migration to Post-Quantum Cryptography under NQM

India DST Task Force under National Quantum Mission publishes phased roadmap for PQC migration. CII foundations by 2027, high-priority systems by 2028, full CII by 2029, nationwide by 2033.

PDF · 2.0 MB · a reference document — dip in, don’t read it through

HKMA Fintech Promotion Blueprint (From Adoption to Advancement) — Quantum Preparedness Index

HKMA Fintech Promotion Blueprint launched February 2026. Includes Quantum Preparedness Index as flagship initiative for Hong Kong banking sector PQC readiness assessment and migration planning.

Web page · 82 KB · a short read

HKMA Fintech Promotion Blueprint (Fintech 2030) — Feb 2026

Hong Kong Monetary Authority Fintech 2030 blueprint — commits to PQC transition for the HK banking sector, launches Quantum Preparedness Index.

PDF · 4.5 MB · a reference document — dip in, don’t read it through

Post-Quantum Transition of SSHv2 (ANSSI-FT-116)

ANSSI technical fact sheet (ANSSI-FT-116, 16 pp) on the post-quantum transition of SSHv2. Recommends hybrid key exchange combining a classical scheme (X25519 / sntrup761) with ML-KEM to protect SSH sessions against Harvest-Now-Decrypt-Later, with concrete OpenSSH configuration guidance for developers, administrators, and CISOs. Translated from French.

PDF · 1.4 MB · a long read

Post-Quantum Transition of TLS 1.3 (ANSSI-FT-115)

ANSSI technical fact sheet (ANSSI-FT-115, 16 pp) on the post-quantum transition of TLS 1.3. Recommends hybrid key exchange (classical + ML-KEM) and addresses ML-DSA-based authentication, giving practical migration and configuration guidance for TLS 1.3 deployments. Translated from French.

PDF · 1.9 MB · a reference document — dip in, don’t read it through

Post-Quantum Transition of IPsec / IKEv2 (ANSSI-FT-117)

ANSSI technical fact sheet (ANSSI-FT-117, 22 pp) on the post-quantum transition of IPsec. Recommends hybrid key exchange (classical + ML-KEM) within IKEv2 to protect VPN tunnels against the quantum threat, with configuration guidance for administrators. Translated from French.

PDF · 1.5 MB · a long read

Lattigo v6.2.0

Go library for BGV/BFV and CKKS with multiparty protocols: t-of-N threshold, refresh and key switching.

Web page · 213 KB · a long read

The pinnacle architecture: Reducing the cost of breaking rsa-2048 to 100,000 physical qubits

Introduction of the Pinnacle Architecture using quantum LDPC codes to reduce the physical qubit overhead for fault-tolerant quantum computation, demonstrating RSA-2048 factoring with fewer than 100,000 physical qubits.

PDF · 1.2 MB · a long read

Security architecture and procedures for 5G System (TS 33.501)

5G security architecture updates incorporating PQC algorithms.

PDF · 4.3 MB · a reference document — dip in, don’t read it through

Quantum-Safe Hybrid Key Exchanges — V1.2.2

Updated framework incorporating NIST finalized ML-KEM standards and additional hybrid patterns.

PDF · 199 KB · a short read

DoD Control Systems / OT Security Requirements Guide V2

DoD Security Requirements Guide for control systems and operational technology (OT), DISA-published.

PDF · 3.0 MB · a reference document — dip in, don’t read it through

SIMD-0461 — Enabling Falcon Signature Verification as a Syscall (PR #461, withdrawn)

Solana Improvement Document PR proposing a Falcon-512 (FN-DSA) signature verification syscall — verification only, does not replace Ed25519, framed by its own author as exploratory ('gauging interest before committing to a PQC strategy'). Retitled mid-review from a precompile to a syscall design. The author closed the PR on 2026-06-17 ('we are going to pause this effort ... closed for now, will reopen when there is more demand'), citing a separate SBF-native Falcon implementation (PR #563) as the more promising path. As of 2026-08-16 the PR remains closed/unmerged.

Web page · 585 KB · a long read

RFC 9925 — Unsigned X.509 Certificates

Defines id-alg-unsigned (1.3.6.1.5.5.7.6.36) for X.509 certificates that carry no signature: a zero-length signature BIT STRING and a placeholder issuer name (id-rdna-unsigned). Updates RFC 5280. Validators must never accept id-alg-unsigned as a signature in a certification path; the format serves trust anchors and keys that need no issuer signature. Published from draft-ietf-lamps-x509-alg-none.

Web page · 70 KB · a short read

Cryptographic Mechanisms: Recommendations for TLS

TLS-specific PQC recommendations including hybrid key exchange. Version 2026-01.

PDF · 759 KB · a long read

Cryptographic Mechanisms: Recommendations for IPsec

IPsec/IKEv2-specific PQC recommendations. Version 2026-01.

PDF · 724 KB · a long read

Cryptographic Mechanisms: Recommendations for SSH

SSH-specific PQC recommendations for secure remote access. Version 2026-01.

PDF · 639 KB · a long read

Cryptographic Mechanisms: Recommendations and Key Lengths

German federal recommendations including ML-KEM ML-DSA SLH-DSA XMSS LMS FrodoKEM Classic McEliece. Version 2026-01. Expanded PQC KEM and signature recommendations.

PDF · 568 KB · a long read

Guidance for migration to Post-Quantum Cryptography

Migration guidance covering challenges, anti-patterns, and best practices for PQC transition.

Web page · 70 KB · a short read

G7 Cyber Expert Group Financial Sector PQC Roadmap

G7 Cyber Expert Group publishes roadmap for financial sector PQC migration covering inventory, risk prioritization, algorithm selection (ML-KEM, ML-DSA), testing, and transition milestones for G7 financial institutions.

PDF · 385 KB · a short read

3GPP TR 33.938 V19.2.0 — 3GPP Cryptographic Inventory (Release 19)

3GPP Technical Report 33.938 v19.2.0 (2026-01), the cryptographic inventory of 3GPP specifications: enumerates where RSA, ECDSA, ECDH and ECIES are used across the 3GPP protocol suite as the basis for transition planning. Note it names neither SUCI nor ML-KEM — the ML-KEM SUCI "Profile C" is one research paper's own proposal, not a 3GPP profile (3GPP defines Profiles A and B only).

PDF · 153 KB · a short read

PQ/T Composite Schemes for OpenPGP using NIST and Brainpool Elliptic Curves

Adds NIST P-384/P-521 and Brainpool384/512 hybrid combinations to the OpenPGP-PQC scheme.

Web page · 348 KB · a long read

Samsung/Thales Post-Quantum Embedded Secure Element (S3SSE2A)

Samsung System LSI and Thales bring ML-KEM quantum-resistant capabilities to embedded Secure Element (eSE). Two dedicated PQC hardware accelerators 18x faster than software. CES Best Cybersecurity Innovation Award winner. EAL6+ certification target. Crypto-agile architecture.

Web page · 418 KB · a long read

Crypto-Agility Hype: InfoSec Global Featured in Three Gartner Hype Cycles

InfoSec Global positioning of CPM/crypto-agility as Gartner-recognized categories; useful market-landscape reference.

Web page · 94 KB · a short read

Prioritising Post-Quantum Cryptography Migration Activities in Financial Services

Europol, FS-ISAC, and QSFF joint guidance for financial institutions on prioritising PQC migration. Introduces a Quantum Risk Score framework covering shelf life of data, exposure, and severity. Provides migration complexity assessment and cryptographic antipattern identification for financial sector risk management.

Web page · 428 KB · a long read

Quantum Key Distribution Vocabulary

Establishes the vocabulary and terminology for QKD standards ensuring consistency across all ETSI QKD specifications. Defines over 100 terms related to quantum key distribution systems.

PDF · 174 KB · a short read

Testing, Measuring and Managing PQC Migration: The Hidden Cost of Quantum-Safe Security and How to Plan PQC Migration

Real-world scale performance benchmarking of PQC migration using VIAVI TeraVM Security Test on Dell R6625 hardware. Tests ML-KEM-768 hybrid (X25519Kyber768) against classical X25519 on HAProxy TLS and Strongswan IKEv2 VPN. Finds 32% throughput drop, 3500%+ latency increase (web pages 48x slower), and 75% reduction in VPN tunnel setup rate. Covers NGFWs enterprise impact and mitigation via hardware acceleration and TLS session resumption.

Web page · 66 KB · a short read

The Timeline for Post Quantum Cryptographic Migration: A Position Paper on the Financial Sector's Global Transition

FS-ISAC PQC Working Group, QSFF, and CFDIR QRWG position paper on financial sector PQC migration timelines. Introduces Augmented Mosca's Theorem risk framework, 4-phase transition model, and cross-jurisdictional comparison of Australia, Canada, EU, US, UK NCSC, Bank of Israel, and MAS Singapore timelines.

Web page · 20 KB · a quick skim

New quantum circuits for ECDLP: Breaking prime elliptic curve cryptography in minutes

Presents optimized quantum circuits for Shor’s algorithm to break prime elliptic curve cryptography, estimating the physical resources and time required for such attacks.

PDF · 1.3 MB · a long read

Reuse of public keys across utxo and account-based cryptocurrencies

Analysis of cross-chain public key reuse between UTXO and account-based cryptocurrencies to improve entity clustering and privacy assessment.

PDF · 905 KB · a long read

Microchip Expands Family of Post-Quantum-Ready Root of Trust Controllers

Microchip Technology announces TS1800 and TS50x post-quantum-ready root-of-trust controller family. Hardware-embedded PQC at silicon level for IoT, automotive, and embedded systems. Supports ML-KEM and ML-DSA, enabling true crypto-agility in constrained devices.

Web page · 34 KB · a quick skim

Quantum Threat: The Trillion-Dollar Security Race Is On

Citi GPS research report quantifying the financial system quantum threat. Estimates 19-34% probability of cryptographically relevant quantum computer by 2034 (60-82% by 2044) and $2-3.3T GDP-at-risk from a single-day quantum attack on a top-5 US bank. Covers harvest-now/decrypt-later attacks, blockchain/Bitcoin quantum exposure (~25% of bitcoin), PQC migration urgency, regulatory landscape, and recommended migration sequencing for financial institutions.

Web page · 1.6 MB · a long read

ETSI TS 103 765-1 — Rail Telecommunications (RT); FRMCS Transport Stratum

The FRMCS transport stratum specification.

PDF · 657 KB · a long read

ETSI TS 103 765-2 — Rail Telecommunications (RT); FRMCS Service Stratum

The FRMCS service stratum specification.

PDF · 419 KB · a long read

ETSI TS 103 765-4 — Rail Telecommunications (RT); FRMCS On-Network Interworking

The FRMCS on-network interworking specification.

PDF · 203 KB · a short read

A Gentle Introduction to Lattice-Based Cryptography

PDF · 5.7 MB · a reference document — dip in, don’t read it through

Quantum computers are speeding towards cryptographic relevancy: The time to prepare is now. | IBM

Web page · 168 KB · a long read

Why Mythos Finding a Flaw in HAWK is Good for PQC | Entrust

Web page · 104 KB · a short read

Efficient Threshold ML-DSA | Brave

Web page · 60 KB · a short read

Root Causes 626: TLS 1.3 Roadblock | Sectigo® Official

Web page · 562 KB · a long read

The Era of Mathematical Zero Days: Why Post-Quantum Security Requires an Architectural Shift, Not Just Better Algorithms - Qrypt

Web page · 262 KB · a long read

2025 in Numbers

PDF · 2.7 MB · a reference document — dip in, don’t read it through

Frame Transaction

Web page · 231 KB · a long read

Trends in PKI Security: A Global Study of Trends, Challenges & Business Impact

Web page · 43 KB · a short read

F5 BIG-IP v21.1 is now generally available, bringing PQC and AI security enhancements

Web page · 424 KB · a long read

The Applied Quantum PQC Migration Framework – Universal, Version 3.0

PDF · 1.9 MB · a reference document — dip in, don’t read it through

ETSI TR 104 239-1 V1.2.1

PDF · 252 KB · a short read

TSA Security Directive Pipeline-2021-02G

TSA Security Directive Pipeline-2021-02G (effective May 3, 2026 to May 2, 2027) renews, without substantive change, mandatory cybersecurity measures for TSA-designated critical hazardous liquid, natural gas and LNG pipeline owner/operators: an approved Cybersecurity Implementation Plan, incident response plan, assessment program, network segmentation, access control/MFA and encryption of data in transit. Not PQC-specific; relevant to PQC migration as a binding US OT encryption and authentication mandate whose cryptography will need quantum-safe replacement.

PDF · 372 KB · a short read

Enterprise Migration to Post-Quantum Cryptography: Timeline Analysis and Strategic Frameworks

Peer-reviewed analysis estimating enterprise PQC migration timelines by organization size - 5-7 years (small), 8-12 (medium), 12-15+ (large) - against a fault-tolerant quantum window of 2028-2033. Frames the cost and effort drivers: cryptographic inventory discovery, HSM and hardware refresh, hybrid-crypto operations, personnel scarcity, and inter-enterprise synchronization.

PDF · 435 KB · a long read

Considerations for Achieving Cryptographic Agility

Strategies and practices for cryptographic agility — the ability to replace and adapt cryptographic algorithms in protocols, applications, and infrastructure without disruption. Essential companion to the PQC transition.

PDF · 1.1 MB · a long read

X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework

The certificate policy governing the US Federal PKI Common Policy Framework — the rules every federal CA operates under.

PDF · 958 KB · a long read

Protection Profile BSI-CC-PP-0084-V2-2026 — Security IC Platform Protection Profile including Functional Packages, Version 2.0

Security IC Platform Protection Profile including Functional Packages, Version 2.0 (16 December 2025), certified by BSI as BSI-CC-PP-0084-V2-2026.

PDF · 1.7 MB · a reference document — dip in, don’t read it through

Commission Implementing Regulation (EU) 2025/2462 — amending Implementing Regulation (EU) 2024/482 as regards definitions, ICT product series certification, assurance continuity and state-of-the-art documents

Commission Implementing Regulation (EU) 2025/2462 of 8 December 2025, amending the EUCC scheme regulation (EU) 2024/482 on definitions, ICT product series certification, assurance continuity and state-of-the-art documents.

Web page · 259 KB · a long read

Recommendation for Key Management: Part 1 – General (Revision 6)

Major revision of NIST key management guidelines. Adds PQC security categories and quantum-resistant algorithms (FIPS 203/204/205), Ascon (SP 800-232), separates key establishment and key storage discussion, and replaces time-based algorithm approval status. Comment period closed Feb 2026.

PDF · 2.6 MB · a reference document — dip in, don’t read it through

CISA PQC Product Category List (Updated per EO 14306)

Updated product category list per Executive Order 14306. Identifies cloud services web software networking hardware endpoint security as PQC-ready categories. Developed with NSA. Products must support PQC for key establishment and digital signatures.

Web page · 73 KB · a short read

Profile for Use of SLH-DSA in the Internet X.509 PKI

Defines X.509 algorithm identifiers and parameter conventions for all 12 SLH-DSA parameter sets (FIPS 205 / SPHINCS+). Specifies absent-parameters rule and self-signed certificate requirements for hash-based PQC PKI. Companion to RFC 9881 (ML-DSA in X.509).

Web page · 156 KB · a long read

IANA Registry Updates for TLS and DTLS

Adds a Discouraged designation to TLS/DTLS IANA registries to flag weak or deprecated cryptographic mechanisms while maintaining backward compatibility.

Web page · 100 KB · a short read

UK DSIT — Perspectives on the Plan for PQC Transition from CNI Sectors

UK DSIT publishes perspectives report from critical national infrastructure (CNI) sector leads on PQC transition planning. Identifies sector-specific challenges across energy, transport, finance, and telecoms.

PDF · 2.3 MB · a reference document — dip in, don’t read it through

Why Quantum Matters Now for Blockchain

Cambridge Judge Business School / CCAF analysis by Philippa Coney on quantum computing threats to blockchain. Covers quantum-resilient cryptography for distributed ledgers, blockchain upgrade pathways, digital asset security, and the role of regulators in the quantum transition.

Web page · 211 KB · a long read

fhe.rs v0.1.1

Experimental Rust library for Ring-LWE-based homomorphic encryption, implementing an RNS variant of the BFV scheme.

Web page · 34 KB · a quick skim

DoD CIO Memorandum — Preparing for Migration to Post Quantum Cryptography

DoD CIO directive requiring all Pentagon components to inventory cryptography across all information systems. Establishes two-gate PQC approval process (intake + deployment). Sets Dec 2030 deadline for PSK replacement. Bans QKD on DoD networks.

PDF · 823 KB · a long read

RFC 9901 — Selective Disclosure for JWTs (SD-JWT)

IETF RFC defining SD-JWT (Selective Disclosure for JWTs) — the base selective-disclosure mechanism for JWTs using salted hashes. SD-JWT VC (verifiable credentials) is a SEPARATE IETF draft (draft-ietf-oauth-sd-jwt-vc) built on this spec and adopted by the EUDI Wallet ARF for online attestations. Text-based JSON encoding optimised for remote online services.

Web page · 2.0 MB · a long read

Open Quantum Safe liboqs Library v0.15.0

Latest liboqs release with updated PQC algorithm implementations including NIST-standardized ML-KEM ML-DSA and SLH-DSA. Part of Linux Foundation PQCA.

Web page · 21 KB · a quick skim

A Practitioner's Guide to Post-Quantum Cryptography

Practical roadmap for organizations to assess plan and mitigate quantum computing risks. Covers NIST FIPS 203/204/205 standards and hybrid key exchange protocols.

Web page · 98 KB · a short read

Helios: A 98-qubit trapped-ion quantum computer

Report on the Helios 98-qubit trapped-ion quantum computer architecture, performance metrics, and operational advances by Quantinuum.

PDF · 4.0 MB · a reference document — dip in, don’t read it through

PKI Consortium PQC Conference 2025 — Conclusions and Call to Action

World's largest PQC conference (2500+ delegates, 30+ countries) concluded in Kuala Lumpur. Issued urgent call for global migration. Includes Malaysia national PQC plan announcement.

Web page · 80 KB · a short read

Malaysia NACSA MyKriptografi Action Plan 2026-2030

NACSA's action plan operationalising Malaysia's National Cryptography Policy (MyKriptografi) into an implementation roadmap. Built on four core pillars comprising 12 strategies, 32 programmes and 80 activities across Government, National Critical Information Infrastructure (NCII), industry, academia and the wider digital economy, and named as preparing Malaysia for "the quantum computing era". The page does not publish algorithm-level requirements or a dated PQC migration timetable.

Web page · 10 KB · a quick skim

Compact, Efficient and Non-Separable Hybrid Signatures (Silithium)

Introduces Silithium — a fused hybrid signature combining EC-Schnorr (secp256k1) and ML-DSA-65 via an adapted Fiat-Shamir transform. Achieves Strong Non-Separability (SNS) with smaller signatures than concatenation. Defines Hybrid EU-CMA security notion covering separability, recombination, and cross-protocol attacks.

Web page · 16 KB · a quick skim

New Zealand Information Security Manual (NZISM) v3.9 — November 2025

New Zealand GCSB NZISM v3.9 mandatory and recommended security controls for NZ government information systems. Cryptography chapter specifies approved algorithms, key management, PKI, and TLS requirements with PQC transition guidance.

PDF · 5.8 MB · a reference document — dip in, don’t read it through

Mixing Preshared Keys in IKE_INTERMEDIATE and CREATE_CHILD_SA of IKEv2 for Post-Quantum Security

Extends RFC 8784 PSK mixing into IKE_INTERMEDIATE and CREATE_CHILD_SA so rekeying preserves PQ protection.

Web page · 108 KB · a short read

Cabinet Secretariat (Japan) - PQC Migration Interim Report for Government Institutions (2025-11)

Japan’s interim government position on PQC migration for public institutions.

PDF · 231 KB · a short read

ETSI TS 103 764 — Rail Telecommunications (RT); FRMCS System Architecture

The FRMCS system architecture replacing GSM-R for European rail — new infrastructure whose cryptography is being chosen now.

PDF · 766 KB · a long read

Automating 47-Day Certificate Lifecycles

Operational guide to ACME/EST/CMP automation under the CA/B Forum 47-day cadence landing March 2029.

Web page · 120 KB · a short read

Use of ML-DSA in CMS

Defines ML-DSA (Dilithium) usage in CMS for document and message signing.

Web page · 121 KB · a short read

Keeping the Internet fast and secure: introducing Merkle Tree Certificates

Cloudflare blog post explaining the Merkle Tree Certificate proposal, its motivation (PQC certificate bloat), architecture (MTCA, transparency service, subscribers), and experimental deployment results. Includes size comparison data.

Web page · 538 KB · a long read

State of the Post-Quantum Internet in 2025

Cloudflare's annual review of PQC adoption across the Internet, covering ML-KEM deployment in TLS 1.3, browser support (Chrome, Firefox), certificate transparency challenges, and the MTC proposal as a solution to PQ certificate bloat.

Web page · 604 KB · a long read

Mathematical Foundations for Post-Quantum Cryptography

Open-access Springer volume (Mathematics for Industry 40) from the Crypto-Math CREST project. Covers mathematical foundations underlying NIST PQC standards: lattice theory (LWE, MLWE, NTRU, Module-LWE), code-based cryptography, hash-based signatures, isogeny-based cryptography, and multivariate schemes. Edited by leading Japanese cryptographers (Takagi, Wakayama, Kunihiro, Tanaka, Kimoto, Kudo). ISBN eBook 978-981-96-1218-5. CC BY 4.0.

Web page · 312 KB · a long read

CycloneDX Cryptography Registry (v1.7)

Standalone, machine-readable naming registry introduced in CycloneDX v1.7: 96 cryptographic algorithm families (RSA, ECDSA, EdDSA, AES, ChaCha20, SHA-2/3, HKDF, ML-KEM, ML-DSA, SLH-DSA, XMSS, LMS, and more) across 14 primitive types, plus 246 elliptic curves across 15 standardization categories (NIST, Brainpool, SECG, BLS, GOST, etc). Published as versioned JSON + JSON Schema, usable independently of CycloneDX/CBOM tooling for any framework needing consistent crypto-mechanism naming.

Web page · 202 KB · a long read

CycloneDX Specification Overview (ECMA-424)

OWASP CycloneDX general Bill of Materials specification, standardized as ECMA-424 — covers SBOM, SaaSBOM, HBOM, ML-BOM, VDR/VEX and CBOM as sibling BOM types sharing one object model. This is the general-BOM spec entry point; the crypto-specific CBOM capability guide is tracked separately (see OWASP-CycloneDX-CBOM-Guide).

Web page · 37 KB · a quick skim

[2510.10436] Post-Quantum Cryptography and Quantum-Safe Security: A Comprehensive Survey

A survey paper covering post-quantum cryptography and quantum-safe security as a combined field.

Web page · 43 KB · a short read

Canada TBS SPIN 2025-01 — Migrating Government of Canada Systems to Post-Quantum Cryptography

Treasury Board of Canada Secretariat (TBS) Security Policy Implementation Notice (SPIN 2025-01) directing all federal departments to begin PQC migration planning. Establishes inventory requirements and migration timelines for Government of Canada IT systems.

Web page · 37 KB · a quick skim

Secure the post-quantum future (IBM IBV 2025)

IBM Institute for Business Value report on enterprise quantum-safe readiness; organizational maturity model and investment sequencing.

Web page · 582 KB · a long read

Additional Parameter Sets for HSS/LMS Hash-Based Signatures

Adds SHA-256/192, SHAKE256/256, and SHAKE256/192 parameter sets for LMS/HSS, reducing signature sizes by 35-40% compared to the original RFC 8554 SHA-256 parameter sets.

Web page · 117 KB · a short read

Algorithm Identifiers for ML-DSA in X.509 PKI

Defines X.509 OIDs and certificate structures for ML-DSA (Dilithium) signatures. Supersedes draft-ietf-lamps-dilithium-certificates.

Web page · 296 KB · a long read

ANSSI Post-Quantum Cryptography FAQ

ANSSI frequently asked questions on post-quantum cryptography covering algorithm selection, hybrid approaches, migration timelines, and practical guidance for French organizations. Updated October 2025.

Web page · 63 KB · a short read

ENISA Threat Landscape 2025

Annual ENISA threat landscape report analyzing 4,875 incidents from July 2024 to June 2025; identifies quantum computing as a strategic long-term threat requiring proactive PQC transition planning.

PDF · 4.5 MB · a reference document — dip in, don’t read it through

Countermeasures against Side-Channel Attacks in FrodoKEM: An Implementation Study

Implementation study on FrodoKEM side-channel countermeasures. Analyzes power-analysis and template attacks on the discrete Gaussian sampler; proposes isochronous sampling and masking. Includes fault-injection countermeasures with sampling calibration.

PDF · 1.5 MB · a reference document — dip in, don’t read it through

Defend or Depend: The Battle for Defence Sovereignty

UK Labour Tech policy report on defence sovereignty covering quantum commercialisation, PQC adoption pathways, quantum sensing/PNT, and the strategic case for UK sovereign quantum capability. Includes Steven Vaile chapter on quantum cybersecurity procurement reform (pp.22-23).

PDF · 1.5 MB · a reference document — dip in, don’t read it through

Post-Quantum Cryptography for the Internet: Challenges and Solutions (PQCrypto 2025 Invited Talk)

Invited talk slides by Bas Westerbaan (Cloudflare Research) at PQCrypto 2025. Covers the state of PQC deployment on the internet: ML-KEM adoption in TLS, maximum compatibility mode and its limits, quantum downgrade attacks (active MITM suppressing PQC negotiation), PQ Lock/PQC HSTS, PQC Continuity (draft-sheffer-tls-pqc-continuity), and Merkle Tree Certificates as a downgrade detection layer via public issuance logs.

PDF · 2.0 MB · a reference document — dip in, don’t read it through

GFMA — Quantum Migration: Mapping the Emerging Landscape (October 2025)

The Global Financial Markets Association’s survey of the quantum migration landscape for financial institutions.

PDF · 1.7 MB · a reference document — dip in, don’t read it through

Fully-Specified Algorithms for JSON Object Signing and Encryption (JOSE) and CBOR Object Signing and Encryption (COSE)

IETF Standards Track RFC that defines fully-specified JOSE and COSE algorithm identifiers (fixing curve, KDF and hash) and deprecates the polymorphic identifiers in RFCs 8037 and 9053, e.g. replacing EdDSA with Ed25519/Ed448. The document itself does not mention PQC; it matters for PQC migration because it sets the rule that new JOSE/COSE algorithm registrations name one fully-specified algorithm.

Web page · 124 KB · a short read

Harvest Now Decrypt Later: Post-Quantum Cryptography and Data Privacy Risks for Distributed Ledger Networks

Federal Reserve FEDS Working Paper (2025-093) analysing HNFL risks for blockchain networks. Examines how quantum computers could retroactively compromise immutable on-chain transaction data across Bitcoin, Ethereum, and distributed ledger systems.

PDF · 398 KB · a short read

MAS QKD Proof-of-Concept Sandbox Technical Report

MAS and industry partners (DBS, HSBC, OCBC, UOB) technical report on QKD proof-of-concept sandbox (Sept 2024-March 2025). Reports 6.75M AES-256 keys/day per bank, demonstrating feasibility of quantum-safe key distribution in financial settlement systems.

Web page · 254 KB · a long read

SP 800-90C: Recommendation for Random Bit Generator (RBG) Constructions

NIST standard specifying constructions for Random Bit Generators (RBGs) that combine entropy sources with DRBGs. Defines RBG1, RBG2, RBG3, and RBGC classes for defense-in-depth randomness.

PDF · 10.1 MB · a reference document — dip in, don’t read it through

MQOM: MQ on my Mind Algorithm Specifications and Supporting Documentation (Version 2.1)

MPC-in-the-Head signature whose security rests on solving random multivariate quadratic (MQ) systems over finite fields. Best combined public-key-plus-signature sizes across all three NIST levels among MPCitH candidates, with competitive signing and verification speeds. NIST IR 8528 explicitly flagged that ROM and QROM security proofs still need further maturation.

PDF · 708 KB · a long read

Recommendations for Key-Encapsulation Mechanisms

Guidance for implementing KEMs securely including hybrid KEMs and FIPS 140 validation requirements.

PDF · 903 KB · a long read

Mappings of Migration to PQC Project Capabilities to Risk Framework Documents

Maps NCCoE PQC Migration project capabilities to NIST Cybersecurity Framework 2.0 (CSF 2.0) and SP 800-53 security controls, helping organizations align PQC migration efforts with established risk management frameworks and identify controls needed for successful PQC migration.

PDF · 593 KB · a long read

OpenID for Verifiable Credential Issuance (OpenID4VCI)

OpenID Foundation specification defining how credential issuers expose APIs for digital credential issuance. Specifies credential offer flow pre-authorisation code flow authorisation code flow and credential endpoint. Defines proof of possession using key binding JWTs. Mandatory protocol for all EUDI Wallet credential issuers (PID providers attestation issuers).

Web page · 504 KB · a long read

SLasH-DSA: Breaking SLH-DSA Using an Extensible End-to-End Rowhammer Framework

Demonstrates Rowhammer-based universal signature forgery on SLH-DSA. Induces DRAM bit flips during signature generation to produce valid signatures without knowledge of the private key. Emphasizes Rowhammer as a persistent remotely triggerable threat.

Web page · 44 KB · a short read

Guidelines for Media Sanitization (Rev. 2)

Guidelines for establishing a media sanitization program to ensure the confidentiality of information on storage media through clear, purge, and destroy methods.

PDF · 984 KB · a long read

NetDiligence Cyber Claims Study - 2025 Report

Analysis of 10,402 real cyber-insurance claims from incidents in 2020-2024, split into SMEs (under $2B revenue) and large companies. Figures 9 and 10 give the five-year average total incident cost per tier ($264K and $10.3M), the source of the organization-size cost anchors in roiBaselines.ts.

PDF · 9.5 MB · a reference document — dip in, don’t read it through

PCI SSC Releases New Guidance on Authentication and Cryptography (PCI Perspectives blog)

PCI Perspectives blog post of 26 August 2025 announcing new PCI SSC guidance on authentication and cryptography.

Web page · 87 KB · a short read

Hamming Quasi-Cyclic (HQC) Algorithm Specification

Code-based KEM selected March 2025 as backup to ML-KEM. Draft FIPS expected 2026, final 2027.

PDF · 876 KB · a long read

2025 State of Crypto Agility Report: Preparing for Post-Quantum

Sectigo annual benchmark of crypto-agility and CLM automation maturity across 500+ enterprises.

Web page · 588 KB · a long read

Ascon-Based Lightweight Cryptography Standards for Constrained Devices

NIST lightweight cryptography standard based on the Ascon algorithm family. Specifies Ascon-AEAD128 (authenticated encryption), Ascon-Hash256 (hash), and Ascon-XOF128/CXOF128 (extendable output functions) for constrained IoT and embedded devices.

PDF · 1.2 MB · a long read

Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators

CISA/NSA joint guidance on building an OT asset inventory and taxonomy for critical infrastructure operators.

PDF · 1.0 MB · a long read

ASC X9 Report — Post-Quantum Cryptography Financial Readiness Needs Assessment (2025)

ASC X9 report providing guidance on safely and cost-effectively migrating the financial services industry to post-quantum cryptography. Covers readiness needs assessment, migration priorities, risk frameworks, and practical implementation recommendations for financial institutions transitioning to NIST PQC standards.

PDF · 119 KB · a short read

Introducing the Cryptographic Bill of Materials (CBOM)

Keyfactor framing of CBOM as a foundation for modern cryptographic management.

Web page · 140 KB · a short read

Common Policy X.509 Certificate and CRL Profile

The current (pre-PQC) profile for US Federal PKI certificates and CRLs.

PDF · 573 KB · a long read

Performance and Storage Analysis of CRYSTALS-Kyber as a Post-Quantum Replacement for RSA and ECC

Empirical performance benchmarks comparing CRYSTALS-Kyber (ML-KEM) against RSA and ECC for key generation, encapsulation, and storage. Provides quantitative evidence that Kyber achieves faster operations and smaller key sizes than RSA while being quantum-resistant.

Web page · 43 KB · a short read

Commission Implementing Regulation (EU) 2025/1567 — management of remote qualified electronic signature and seal creation devices as qualified trust services

Commission Implementing Regulation (EU) 2025/1567 of 29 July 2025, under eIDAS (Regulation (EU) No 910/2014), on managing remote qualified signature and seal creation devices as qualified trust services.

Web page · 31 KB · a quick skim

Commission Implementing Regulation (EU) 2025/1570 — notification of information on certified qualified electronic signature and seal creation devices

Commission Implementing Regulation (EU) 2025/1570 of 29 July 2025, under eIDAS, on notifying information about certified qualified signature and seal creation devices.

Web page · 29 KB · a quick skim

IKEv2 Support of ML-DSA

This document describes how to use the ML-DSA post-quantum signature algorithm for authentication within IKEv2 as a replacement for traditional algorithms.

Web page · 61 KB · a short read

Use of SLH-DSA in CMS

Defines SPHINCS+ (SLH-DSA), the stateless hash-based signature standard, usage in Cryptographic Message Syntax. Included for comparison with stateful LMS/XMSS schemes.

Web page · 85 KB · a short read

Post-Quantum Key Exchange and Subscriber Identity Encryption in 5G Using ML-KEM (Kyber)

Peer-reviewed proposal for a post-quantum SUCI protection scheme. Defines a "Profile C" (identifier 0x3) using ML-KEM/Kyber-512 alongside the 3GPP-defined Profiles A and B. RESEARCH PROPOSAL, not a 3GPP-standardised profile — the authors state Profiles A and B are defined by 3GPP and that Profile C is their own scheme.

PDF · 447 KB · a long read

OpenID for Verifiable Presentations (OpenID4VP)

OpenID Foundation specification defining how holders present verifiable credentials to relying parties. Specifies the authorization request presentation definition (DIF PE) and presentation submission. Enables selective disclosure presentations where holders reveal only the credential attributes required by the relying party. Mandatory for EUDI Wallet credential presentation flows.

Web page · 515 KB · a long read

CA/Browser Forum Ballot SMC013 - Enable PQC Algorithms for S/MIME

Enables ML-DSA post-quantum digital signatures in S/MIME certificates. IPR Exclusion period completed with no notices filed. Adopted August 22 2025.

Web page · 24 KB · a quick skim

Certificate Management Protocol (CMP)

Adds KEM key transport to CMP. Obsoletes RFC 4210.

Web page · 583 KB · a long read

NIST SP 800-63-4 Digital Identity Guidelines

NIST framework for digital identity management. SP 800-63A covers identity proofing and enrollment (Identity Assurance Levels IAL1/2/3). SP 800-63B covers authentication (Authenticator Assurance Levels AAL1/2/3). SP 800-63C covers federation (Federation Assurance Levels FAL1/2/3). Referenced in EUDI Wallet implementations for IAL/AAL equivalency mapping with European LoA (Low Substantial High).

PDF · 858 KB · a long read

BIS Paper 158 — Quantum-Readiness Roadmap for Financial Systems

Bank for International Settlements paper outlining quantum-readiness roadmap for global financial systems. Covers cryptographic inventory, migration timelines, and cross-border interoperability for central banks.

PDF · 2.2 MB · a reference document — dip in, don’t read it through

CMP Profile for Hardware Security Modules

CMP profile for HSM-based certificate lifecycle management; enables PQC key generation and ML-DSA certificate enrollment directly from PKCS#11-compliant HSMs.

Web page · 78 KB · a short read

Hong Kong Protection of Critical Infrastructure (Computer System) Ordinance

Hong Kong Legislative Council enacts critical infrastructure cybersecurity legislation requiring operators to protect computer systems including cryptographic controls relevant to PQC migration.

Web page · 13 KB · a quick skim

NIST ESV Certificate E266

Web page · 42 KB · a short read

Hybrid Signature Spectrums

Defines a taxonomy for hybrid digital signature schemes combining classical and PQC algorithms; informs IETF composite signature standards.

Web page · 75 KB · a short read

ASC X9 Financial PKI — Post-Quantum Cryptography Trust Framework for Financial Services

ASC X9 Financial PKI launched June 2025 (key ceremony June 13). Industry-specific PKI infrastructure for financial services built with DigiCert as managed provider. Supports both legacy algorithms for backward compatibility and post-quantum cryptography (ML-KEM, ML-DSA) for next-generation algorithm transition. Purpose-built for payment terminal interoperability, cross-enterprise authentication, and secure device communication.

Web page · 119 KB · a short read

APRA Prudential Standard CPS 234 Information Security

APRA Prudential Standard CPS 234 mandates that all APRA-regulated entities (banks, insurers, superannuation funds) maintain information security capabilities commensurate with threats. Requires board accountability, policy frameworks, and cryptographic controls for sensitive data. PQC transition is in scope as a material vulnerability in long-lived cryptographic infrastructure.

Web page · 1.0 MB · a long read

Executive Order 14306 — Sustaining Select Cybersecurity Efforts (PQC Provisions)

Trump administration EO directing DHS/CISA to publish PQC product categories. Requires TLS 1.3 adoption by 2030. Amends EO 13694 and EO 14144. Retains PQC migration provisions from Biden era.

Web page · 321 KB · a long read

Cryptographic Inventory: Deriving Value Today, Preparing for Tomorrow

Joint industry whitepaper from HSBC, InfoSec Global (Keyfactor), and Thales covering Ten Strategic Principles for cryptographic inventory. Presents the business case for proactive cryptographic discovery, CBOM generation methodology, crypto agility frameworks, and enterprise case studies for PQC migration readiness planning.

PDF · 15.4 MB · a reference document — dip in, don’t read it through

Terminology for Post-Quantum Traditional Hybrid Schemes

Defines terminology for PQ/T hybrid schemes including composite KEMs and signatures.

Web page · 98 KB · a short read

Use of HSS and XMSS Hash-Based Signature Algorithms in X.509 PKI

Defines OIDs and certificate structures for stateful hash-based signatures in X.509.

Web page · 148 KB · a short read

Related Certificates for Use in Multiple Authentications within a Protocol

Defines a CSR attribute (relatedCertRequest) and X.509 extension (RelatedCertificate) that bind two certificates to the same end entity. Enables non-composite hybrid authentication using separate traditional and PQC certificates (the catalyst approach). Published as RFC 9763.

Web page · 80 KB · a short read

GSA Post-Quantum Cryptography Buyer's Guide

GSA Federal Acquisition Service guide for federal agencies procuring PQC-capable products. Covers PQC planning and implementation use cases, Quantum Security-as-a-Service (QSaaS), Quantum SD-WAN, and PQC + Zero Trust Architecture integration.

PDF · 5.4 MB · a reference document — dip in, don’t read it through

Commercial National Security Algorithm Suite 2.0

US government adoption requirements for ML-KEM-1024, ML-DSA-87, SLH-DSA, LMS/XMSS. Level 5 recommended.

PDF · 587 KB · a long read

W3C Verifiable Credentials Data Model v2.0

The W3C data model for verifiable credentials. Its signature suites are where post-quantum algorithms have to land for digital identity.

Web page · 1.0 MB · a long read

Dubai Electronic Security Center — Post-Quantum Cryptography Guideline

Dubai Electronic Security Center (DESC) launches PQC guideline at GISEC Global 2025 to prepare Dubai digital infrastructure for quantum threats. Migration framework for Dubai government and private sector.

Web page · 235 KB · a long read

ONC Health IT Certification Criterion § 170.315(d)(7) — End-User Device Encryption

The US health-IT certification criterion for end-user device encryption.

Web page · 409 KB · a long read

ONC Health IT Certification Criterion § 170.315(d)(8) — Integrity

The US health-IT certification criterion for data integrity, which is where signature algorithms are pinned.

Web page · 393 KB · a long read

ONC Health IT Certification Criterion § 170.315(d)(9) — Trusted Connection

The US health-IT certification criterion for trusted connections — the TLS requirements certified health software must meet.

Web page · 396 KB · a long read

EU Cybersecurity Certification Agreed Cryptographic Mechanisms v2.0

Includes PQC algorithms in Agreed Cryptographic Mechanisms for EUCC certification.

PDF · 407 KB · a long read

Post-Quantum Cryptography Coalition (PQCC) PQC Migration Roadmap

PQCC publishes PQC Migration Roadmap with four-category framework: Preparation, Prioritization, Migration, and Sustainment. Practical guidance for organizations at any stage of PQC transition.

PDF · 750 KB · a long read

How to factor 2048 bit RSA integers with less than a million noisy qubits

Estimation of the physical qubit and time costs required to factor 2048-bit RSA integers using noisy quantum computers.

PDF · 4.2 MB · a reference document — dip in, don’t read it through

https://arxiv.org/pdf/2505.08791

PDF · 187 KB · a short read

OpenSSL 3.5 Series Release Notes (latest 3.5.6)

OpenSSL 3.5.0 (April 29, 2025) is the first version to include ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and X25519MLKEM768 hybrid TLS natively, without the OQS provider. This is the foundational library release enabling mainstream PQC adoption across TLS stacks, VPNs, and cryptographic applications worldwide.

Web page · 49 KB · a short read

PKCS #11 Cryptographic Token Interface Usage Guide Version 3.2

Companion guidance to PKCS#11 v3.2 and a normative reference of it. v3.2 moved the session-state model, the user/login model and the object-access matrix out of the base specification and into this document — the spec says only that CK_STATE holds the session state 'as described in [PKCS11-UG]'. Auditing session, login or private-object access behaviour against the base specification alone will therefore find no governing text. Note the process asymmetry: this is a non-standards-track Committee Note that the Standard nevertheless cites normatively. Edited by Dieter Bong (Utimaco); supersedes the v2.40 Usage Guide.

PDF · 468 KB · a long read

CA/Browser Forum Ballot SC-081v3 — Introduce Schedule of Reducing Validity and Data Reuse Periods

CA/Browser Forum Ballot SC-081v3 establishing requirements for post-quantum key exchange in TLS certificates issued by publicly trusted CAs. Affects all Web PKI certificate issuers.

Web page · 35 KB · a quick skim

Post-Quantum Cryptography Coalition (PQCC) PQC Inventory Workbook

PQCC publishes structured workbook to assist organizations in creating centralized cryptographic inventories for PQC migration planning. Covers asset identification, risk prioritization, and migration scheduling.

Web page · 88 KB · a short read

ETSI EN 319 411-1 V1.5.1 (2025-04)

ETSI standard defining policy and security requirements for Qualified Trust Service Providers (QTSPs) issuing qualified certificates under eIDAS. Forms the basis for European CA auditing under WebTrust/ETSI audit schemes and the EUDI Trust Framework for credential issuer accreditation. Part 1 covers general requirements; Part 2 covers NCP/NCP+/QCP/eIDAS policies.

PDF · 362 KB · a short read

CMORG Guidance for Post-Quantum Cryptography (UK Financial Sector)

UK Cross Market Operational Resilience Group (CMORG) publishes PQC guidance for UK financial sector. Covers threat landscape, algorithm selection, migration planning, and prioritization for UK banks and financial market infrastructures.

PDF · 277 KB · a short read

ETSI launches new standard for Quantum-Safe Hybrid Key Exchanges to secure future post-quantum encryption - ETSI

ETSI announcement of its quantum-safe hybrid key-exchange standard — useful as a dated marker of when the specification became citable.

Web page · 137 KB · a short read

Forrester (Sandy Carielli) on Cryptoagility: Shared Intel Q&A

Forrester Principal Analyst Sandy Carielli on why crypto-agility and posture management investments are justified on operational merit alone.

Web page · 654 KB · a long read

NCSC PQC Migration Timelines Guidance

UK NCSC three-phase PQC migration timeline guidance. Phase 1 (by 2028): discovery and planning; Phase 2 (2028-2031): active migration of priority systems; Phase 3 (by 2035): complete PQC migration. Includes sector-specific guidance for UK government and CNI.

PDF · 202 KB · a short read

Abridging Certificate Chains in TLS

Proposed TLS Certificate Compression scheme using a shared dictionary of root and intermediate WebPKI certificates. Streamlines transition toward post-quantum cryptography by removing root and intermediate certificates from the TLS certificate chain while preserving trust verification. Reportedly provides superior compression vs competing approaches. Cited by PQCC April 2026 transport-issues panel as mitigation for TCP Initial Congestion Window and QUIC amplification protection.

Web page · 50 KB · a short read

NIST ESV Certificate E232

Web page · 41 KB · a short read

NIST ESV Certificate E233

Web page · 41 KB · a short read

Status Report on the Fourth Round of the NIST PQC Standardization Process

Documents HQC selection as fourth PQC standard providing code-based cryptographic diversity.

Web page · 50 KB · a short read

GSMA Post-Quantum Government Initiatives by Country and Region (March 2025)

GSMA survey of post-quantum cryptography government initiatives across countries and regions as of March 2025. Covers national PQC programs, regulatory developments, and migration timelines for 30+ countries.

PDF · 207 KB · a short read

Quantum-Safe Hybrid Key Exchanges

Framework for hybrid ECDH + ML-KEM with standard key combiners (concatenation, HKDF).

PDF · 252 KB · a short read

Post-Quantum Cryptography Evaluation Report

Japanese government evaluation of PQC algorithms covering ML-KEM/DSA/SLH-DSA/FN-DSA/HQC with security analysis and migration guidance based on Mosca's inequality framework.

PDF · 1.3 MB · a long read

SDitH: Syndrome Decoding in the Head (Round 2 Specification)

MPC-in-the-Head signature built on the syndrome decoding problem for random linear codes over finite fields — one of the most-studied hard problems in code-based cryptography, dating to McEliece (1978). Among the MPCitH candidates, only FAEST (AES-based) shares a comparably well-analysed security foundation. Tradeoff: typically slower than its MPCitH peers, though sizes are competitive when tuned.

PDF · 576 KB · a long read

UOV: Unbalanced Oil and Vinegar (Round 2 Specification)

Original UOV construction by Kipnis-Patarin-Goubin (1999). Public key is a system of multivariate quadratic polynomials with the secret oil/vinegar partition hidden inside. Tiny 96 B signatures at NIST L1; large public key (~66 KB raw, ~1.2 KB compressed) and private key (~237 KB). 2025 Ran wedge attack pushed three of four parameter sets (uov-Ip, uov-III, uov-V) below their security targets; reparameterisation in odd-characteristic fields restores security.

PDF · 742 KB · a long read

HAWK: Module Lattice Isomorphism Signature (Round 2 Specification)

Lattice signature that eliminates FN-DSA's floating-point Gaussian-sampling pain — pure integer arithmetic on a rank-2 module lattice with a Gram matrix as the public key. Compact 555 B signatures at NIST L1 — smaller than both ML-DSA and FN-DSA — and dramatically easier to implement in constant time on constrained hardware. Security rests on newer assumptions: the Search Module Lattice Isomorphism Problem (smLIP) and the One-More-Shortest-Vector Problem (omSVP). NIST flagged these for further community analysis; Round 2 included a refined omSVP definition addressing a discrepancy found during evaluation.

PDF · 1.1 MB · a long read

EUDI Wallet ARF v3.0.0

Technical architecture and reference framework for the European Digital Identity Wallet. Defines credential formats (mso_mdoc per ISO 18013-5 and SD-JWT VC (draft-ietf-oauth-sd-jwt-vc)) trust framework protocol requirements (OpenID4VCI OpenID4VP) and cryptographic security requirements. Specifies no PQC migration roadmap — the Dec 2026/2030/2035 transition dates come from the NIS Cooperation Group Coordinated Implementation Roadmap (June 2025), not from the ARF.

Web page · 417 KB · a long read

Efficient Quantum-Safe Hybrid Key Exchanges with Hidden Access Policies (Covercrypt)

Defines KEMAC (Key Encapsulation Mechanism with Access Control) scheme called Covercrypt. Provides pre- and post-quantum security through hybridization with precise data access control. Encapsulation and decapsulation in hundreds of microseconds.

PDF · 258 KB · a short read

Use of the RSA-KEM Algorithm in the Cryptographic Message Syntax (CMS)

Defines RSA-KEM usage in CMS EnvelopedData using KEMRecipientInfo. Obsoletes RFC 5990. Supports hybrid RSA+ML-KEM migration scenarios for S/MIME.

Web page · 143 KB · a short read

NUKIB Minimum Requirements for Cryptographic Algorithms v4.0

Czech NUKIB publishes minimum requirements for cryptographic algorithms including PQC readiness guidance. Sets 2027 deadline for key establishment migration and recommends hybrid PQC approaches for Czech government systems.

PDF · 382 KB · a short read