PQC Migration Workbench

Explore catalog evidence and build an illustrative post-quantum migration sequence.

Explore catalog evidence and build an illustrative post-quantum migration sequence.

A curated catalogue of 890 products — not an exhaustive list of the market. 628 PQC-relevant products (464 available · 83 partial · 63 planned or on a roadmap · 14 not yet determined · 4 none), and 252 migration-baseline products tracked because they matter to a PQC migration (19 of them already have some PQC support). 10 more are not yet assigned to either group. The groups are counted separately.

Build your migration plan

Pick a cryptographic area—TLS, VPN, SSH, certificates and more—to build an illustrative sequence and compare catalog evidence. This does not assess your estate.

What you run — pick to see replacements

HNDLRSA-2048 / X25519 → X25519 + ML-KEM-768 (example)

HNDLRSA + ECDH → RFC 9370 + a profiled PQ KEM

RSA-2048 / ECDSA → ML-DSA PKI (profile-dependent)

ECDSA / ECDH → mlkem768x25519

RSA-3072 / ECDSA → ML-DSA / hash-based signatures (policy-dependent)

RSA-wrapped → ML-DSA / ML-KEM

HNDLRSA/ECDH TLS → PQC-capable transport and key services

X25519 ratchet → PQC-enhanced agreement (protocol-specific)

HNDLRSA → PQC mail profiles (still ecosystem-dependent)

HNDLAES-256 + RSA wrap → AES-256 + PQC-aware key establishment

Foundations & infrastructure

Identity & access30

Blockchain & digital assets39

Network security & encryptors89

Cryptographic hardware76

Platforms & infrastructure108

Crypto libraries & frameworks200

Discovery & validation tooling48

National & sector PQC programs6

Viewing: TLS key exchange

TLS key exchange

Upgrade / configure

Public web servers, load balancers, API gateways

RSA-2048 / X25519X25519 + ML-KEM-768 (example)Illustrative action

A current general-purpose path is hybrid X25519 + ML-KEM-768 where both endpoints support a standardized profile. Treat this as an implementation example, not a universal setting: test clients and middleboxes, document fallback policy, and verify the profile your authority or sector requires. CNSA 2.0 uses ML-KEM-1024 for NSS, not this example parameter set.

Products that replace this · 9 in catalog

300 additional catalog entries are currently hidden pending downloadable proof.

BoringSSLVND-018AvailableVerifiedProof 4 months ago

TLS/SSL Implementation Software

BoringSSL FIPS.md lists BoringCrypto FIPS 140 validation certificate lineage (#2964, #3318, #3678, #3753, #4156, #4407, #4735, #4953, #5104, #5244). These validated modules cover classical primitives only; PQC (ML-KEM/ML-DSA/SLH-DSA) is implemented in BoringSSL outside the FIPS-validated boundary. BoringSSL has shipped ML-KEM since 2024 (used by Chrome) and ML-DSA since early 2025; it is a rolling/continuous release with no fixed version, matching catalog. Published 4 months ago.

wolfSSLVND-045AvailableVerifiedProof 7 months ago

TLS/SSL Implementation Software

wolfSSL 5.9.0 release announcement: with the addition of SLH-DSA (FIPS 205), wolfSSL now supports the full NIST PQC signature portfolio — ML-DSA (FIPS 204), FALCON, and SLH-DSA — plus stateful-hash LMS/HSS and XMSS/XMSS^MT, and ML-KEM (FIPS 203) for key establishment. New wolfCrypt FIPS 140-3 cert incorporates ML-KEM, ML-DSA and SLH-DSA. Matches catalog's 5.9.0 / full FIPS 203/204/205 + LMS/XMSS + Falcon + hybrid TLS 1.3 description. Published 7 months ago.

AWS s2n-tlsVND-001AvailableVerifiedProof 5 months ago

TLS/SSL Implementation Software

GitHub aws/s2n-tls releases: latest is v1.7.3 — 'Add pure MLKEM1024 to AWS-CRT-SDK PQ policies', plus an ML-DSA key type validation fix. Prior milestones: v1.7.1 deleted all code that references Kyber; v1.6.4 (weekly release for Jan 5, 2026). PQC support includes hybrid X25519MLKEM768 and pure ML-KEM-1024. Published 5 months ago.

GnuTLSVND-062AvailableVerifiedProof 8 months ago

TLS/SSL Implementation Software

GnuTLS official news page: latest 3.8.x release is 3.8.13 (April 29, 2026), succeeding 3.8.12 (Feb 9, 2026). PQC lineage: ML-KEM hybrid key exchange (X25519MLKEM768, SecP256r1MLKEM768) added in 3.8.8 (Nov 2024); experimental ML-DSA (FIPS 204) signatures and leancrypto PQC backend added in 3.8.9 (Feb 2025). 3.8.13 also fixes multiple CVEs. Published 8 months ago.

Google ALTSVND-018AvailableVerifiedProof 12 months ago

TLS/SSL Implementation Software

Google Cloud blog (2025-10-30) states: 'We've migrated key exchanges for internal traffic to ML-KEM. All Google and select Google Cloud-native services are safeguarded by default using Google Cloud network encryption, using ML-KEM for cryptographic key exchange.' This supersedes the 2022 ALTS blog which described hybrid NTRU-HRSS + X25519. The catalog's pqc_support field already says ML-KEM, but the capability_description still cites NTRU-HRSS, and the catalog proof_url points to the outdated 2022 NTRU-HRSS post. Published 12 months ago.

JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3VND-518AvailablePending VerificationProof 16 months ago

TLS/SSL Implementation Software

Published 16 months ago.

LibreSSLVND-063PartialVerifiedProof 5 months ago

TLS/SSL Implementation Software

LibreSSL official releases page: latest is 4.3.2 (May 25, 2026); branch history 4.3.1/4.3.0 (Apr 18, 2026), 4.2.1 (Oct 30, 2025), 4.2.0 (Oct 14, 2025). ChangeLog/coverage: 4.2.0 added public ML-KEM API and ML-KEM benchmarks; 4.3.x added MLKEM768_X25519 TLS key share support. Published 5 months ago.

rustlsVND-064PartialVerifiedProof 2 years ago

TLS/SSL Implementation Software

Rustls 0.23.22+ PQ key exchange via ML-KEM hybrid X25519+Kyber. Published 2 years ago — old enough that the product may have moved on since. Worth re-checking against the vendor before you rely on it.

Mbed TLSVND-149RoadmapVerifiedProof on file

TLS/SSL Implementation Software

Mbed TLS roadmap (mbed-tls.readthedocs.io): 2025 CQ4 'ML-DSA Investigation'; 2026 CQ1 'Mbed TLS 4.1, TF-PSA-Crypto 1.1 LTS release' and 'ML-DSA Prototype'; 2026 CQ2 'ML-DSA - Initial support'; Future 'ML-KEM Support'. Completed: 'Mbed TLS 4.0, TF-PSA-Crypto 1.0 release'. We hold the document but not its publication date, so we cannot say how current it is.

Next step

Build the roadmap

The Roadmap Builder sequences the migration the catalogue rows describe.