The State of Post-Quantum Cryptography | Feisty Duck

Error: JavaScript appears to be disabled

This web site will not operate correctly without JavaScript. Apologies for the inconvenience.

Cryptography & Security Newsletter

139

The State of Post-Quantum Cryptography

30 July 2026

Feisty Duck’s Cryptography & Security Newsletter is a periodic dispatch bringing you commentary and news<br>surrounding cryptography, security, privacy, SSL/TLS, and PKI. It's designed to keep you informed about the latest<br>developments in this space. Enjoyed every month by more than 50,000 subscribers.<br>Written by Ivan Ristić.

For people who deal with network security, the last couple of years have been busier than usual, largely because of the impending threat of quantum computers that are going to annihilate all cryptography we use and love today. If you’re feeling fatigue from the firehose of events, you’re not alone. For me, personally, there is a sense that we’re seeing fewer and fewer technical announcements, which is perhaps pointing to the fact that most of the technical decisions have been made. At the same time, the deadlines have been shortened on account of the fears that cryptographically-relevant quantum computers (CRQC) are arriving sooner than anticipated. What lies ahead of us is definitely going to be hard, but we’ll need to only execute on the plans?

Yes and no. In one sentence: The transition to post-quantum encryption is well underway; the transition to post-quantum authentication has only just begun.

The Story So Far

If there is an official starting date for the PQC transition, it’s going to be NIST’s announcement of its new standardisation efforts in 2016. That work took a while, and the competitions took place, with the key new cryptographic algorithms officially announced in 2024. The two algorithms that led the way are ML-KEM for key establishment and ML-DSA for authentication.

In parallel with the competitions, there was a lot of conversation in the technical community about the threat model. The threat of “harvest now, decrypt later” (HNDL) presented itself as the most pressing, because attackers can capture encrypted communication today, when they can’t break it, only to attack it later, when they can. The technical communities responded with new hybrid key exchange methods, combining the currently dominant elliptic curve cryptography with the new ML-KEM standard. Browsers and big infrastructure providers moved quickly, securing most of the web traffic.

At some point, Google decided to embark on an effort to reimagine Web PKI with new certificates that mitigate the quantum threat, while at the same time largely preserving the performance characteristics. They deemed the size of the ML-DSA signatures to be too big to accept. The new Merkle Tree Certificates (MTC) combine the old (X.509 and Certificate Transparency) and new (ML-DSA, but just as little as possible) to produce a nominally better, but more complex authentication ecosystem.

Google won’t accept ML-DSA in public certificates, but they (and other vendors, for example Microsoft) already support it for use in private certificate hierarchies. Thus, the world of PKI, already fragmented, is being fractured further into MTC and X.509 with ML-DSA.

By now, the new cryptographic algorithms have made their way into the key libraries, Linux distributions, and Windows Server. MTC certificates are expected in 2027. The feeling is that the bulk of the technical work has been accomplished.

The technical work—difficult as it is—is the easier part of the migration. The other part, which requires that we examine and understand every part of our networks and systems, is complex and tedious, and it’s going to take forever. The deadlines were initially set at around 2035, but later, several big vendors settled on 2029 as their target, citing faster than anticipated technological advances. The vendors are being squeezed, because they have to complete their transition before anyone else can start.

Post-Quantum Authentication

Post-quantum authentication is where things get really messy. First, the new (MTC) certificates add a lot of complexity and machinery to achieve post-quantum security while preserving the network performance we’re used to today. To deploy them, we’ll need to create a new ecosystem of CAs working with the new technology. Then, we’ll need to rebuild ACME for it. Then, we’ll need to touch every server to replace the issuance stack. In the following years, servers serving public websites will have to switch from 1-2 certificates they use today (two if using dual RSA and ECDSA authentication), to maybe 4-5. MTC introduce two new certificate types: one is slow, but can be used immediately after issuance; the other is fast, but can’t be provided immediately. Certificate rotation, today a single event, becomes a multi-step process in the future.

But that’s not the messiest part. The downgrade attacks against authentication are.

Here’s the...