Frequently Asked Questions about Post-Quantum Cryptography
Note
This page is supplementary material for the NIST Migration to Post-Quantum Cryptography Project
The NIST National Cybersecurity Center of Excellence, NIST’s Applied Cybersecurity Lab, has established a Migration to Post-Quantum Cryptography (PQC) project that is focused on supporting the use of NIST PQC standards. We’re working with industry and government stakeholders on two workstreams, and will develop demonstrations in each:
Cryptographic Visibility and Risk Management, focused on discovering and inventorying cryptography use and providing examples of risk based decisions that can be made to prioritize migration to PQC, quantum resistant cryptography. The goal of the workstream is to provide insights that will help organizations to manage their cryptography by gain visibility, apply risk based decisioning, and implement cryptographic policies to support cryptographic agility.
Interoperability and Benchmarking, supporting the technology and public-key cryptography subject matter experts as they work to who use PQC algorithms in protocols, products and services.
We’ve grouped the most common questions into six key phases of the PQC migration journey, guiding you through the transition needed to protect against the threat of a cryptanalytically relevant quantum computer (CRQC).
Who should use this? Anyone who uses public key cryptography has been asked to take steps to become CRQC-ready by adopting technologies that use PQC algorithms.
This FAQ is not an exhaustive list and will be updated periodically.
Please contribute to the FAQ by using this form to submit additional questions, answers, and suggestions.
If you have anything to further discuss, please contact us at mailto:applied-crypto-pqc@nist.gov.
Last Updated: November 05, 2026
Awareness and Preparation
What is Post-Quantum Cryptography (PQC)?
Post-Quantum Cryptography (PQC) refers to cryptographic methods designed to resist attacks from both classical and quantum computers. As quantum computers advance, they could potentially break current encryption methods like RSA and elliptic curve cryptography (ECC), which rely on mathematical problems that are difficult for classical computers to solve. The aim of PQC is to develop encryption algorithms that remain secure against these emerging threats while still being compatible with existing systems and networks.
The National Institute of Standards and Technology (NIST) is leading global efforts to standardize these quantum-resistant algorithms to ensure the security of digital communications in the quantum era.
Post-quantum cryptography (PQC) does not require quantum machines; it runs directly on standard, classical silicon architectures such as semiconductor platforms, Von Neumann architectures, CPU and GPU architectures, binary computing systems, general-purpose instruction set architectures, deterministic, binary microarchitectures, binary computer fabrics, mainstream commercial compute platformsm, etc.
Additional Resource: NIST’s What Is Post-Quantum Cryptography? webpage
What has the National Cybersecurity Center of Excellence (NCCoE) published to support migration to PQC?
The following preliminary draft were published before 2024 and frame the challenges that the project could accomplish: Preparation for Considering the Implementation and Adoption of Quantum Safe Cryptography Quantum Readiness: Cryptographic Discovery Quantum Readiness: Testing Draft Standards
The are no current plans to issue second drafts or final versions of these publications.
The project team is using NIST Cybersecurity White Papers to share progress.
The following are two NIST Cybersecurity White Papers published: NIST CSWP 48, Mappings of Migration to PQC Project Capabilities to Risk Framework NIST CSWP 39, Considerations for Achieving Crypto Agility Strategies and Practices
With regard to CSWP 48, what else can the project map to support your quantum readiness needs?
What are some other ways to describe the migration to post-quantum cryptography?
With the growing attention on quantum computing as an emerging technology, compounding the term “quantum” with “readiness”, “resistant”. “safe”, or “secure” has become another way to convey what is being achieved in this cryptographic migration.
“Quantum-Readiness”
Canadian Forum for Digital Infrastructure Resilience (CFDIR), Canadian National Quantum-Readiness Best Practices and Guidelines
Cloud Security Alliance, Quantum Readiness Importance: A Comprehensive Guide
Deloitte, Quantum Cyber Readiness
U.S. Cybersecurity and Infrastructure Security Agency (CISA), Quantum-Readiness: Migration to Post-Quantum Cryptography
World Economic Forum, Quantum Readiness Toolkit: Building a Quantum-Secure Economy
“Quantum-Resistant”
Quantum-Resistant appears 15 times in NIST Information Report 8105 Report on Post-Quantum Cryptography
The National Cryptologic Foundation, Convening to Act: Quantum Resistant Cryptography (QRC) in Software
Microsoft, Microsoft’s quantum-resistant cryptography is here
Technology Review, What are quantum-resistant algorithms—and why do we need them?
SafeLogic, Why Post-Quantum Cryptography (PQC) is Now a Competitive Advantage for Tech Vendors
“Quantum-Safe”
European Telecommunications Standards Institute (ESTI), Quantum-Safe Cryptography (QSC)
Germany’s Federal Office for Information Security (BSI), Quantum Technologies and Quantum-Safe Cryptography
SafeLogic, Comparing PQC and Classical Algorithms
When will a cryptanalytically relevant quantum computer exist?
Estimates for the development of a cryptanalytically relevant quantum computer (CRQC) vary widely:
Near-term: Some believe that CRQCs may emerge by 2030, driven by rapid advancements.
Mid-term: Many anticipate they could become feasible within 15 to 20 years, requiring significant progress in scaling and error correction.
Long-term: Others believe it may take 30+ years due to the challenges of achieving fault-tolerant quantum systems.
Despite uncertainty in when a CRQC will come into existence, experts agree on the importance of preparing for quantum threats now to secure cryptographic systems for the future.
The following resources provide assessments of the state of development a CRQC:
Germany’s Federal Office for Information Security (BSI), The status of quantum computer development
Global Risk Institute, Quantum Briefing: Recent Quantum-Computing Progress and its Implications for Cybersecurity
EvolutionQ, The Quantum Threat Timeline: Why Organizations Must Act
Cloud Security Alliance, Quantum-safe Security
What U.S. government policies, memorandums, and standards discuss migration to PQC?
The U.S. government’s approach to migrating to PQC is designed to safeguard national security and critical infrastructure against future quantum threats.
The following bullets offer a timeline that illustrates the directives and resources which were established for use by federal agencies:
January 2022, National Security Memorandum-8 (NSM-8)
May 2022, National Security Memorandum-10 (NSM-10)
September 2022, Announcing the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)
November 2022, Office of Management and Budget Memorandum M-23-02
December 2022, Quantum Computing Cybersecurity Preparedness Act 6 U.S.C. § 1526
March 2025, NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption
January 2026, CISA publishes Product Categories for Technologies That Use Post-Quantum Cryptography Standards
April 2026, Department of War - Post Quantum Cryptography Strategy
June 2026, Executive Order 14412 Securing the Nation Against Advanced Cryptographic Attacks
June 2026, Office of Management and Budget Memorandum M-26-15
October 2026, Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) FAQ Updated
October 2026, NIST IR 8547 - Transition to Post-Quantum Cryptography Standards
October 2026, Department of War - Memorandum Execute Post Quantum Migration
October 2026, Department of War - Post Quantum Cryptography (PQC) Implementation Plan
What are some Sector-Specific PQC Resources?
Financial Services Sector
Europol, Prioritising Post-Quantum Cryptography Migration Activities in Financial Services
Financial Services Information Sharing and Analysis Center (FS-ISAC), Post Quantum Cryptography Resources
X9, Effort to Create Post-Quantum Cryptography Assessment Guidelines
Bank for International Settlements (BIS), Quantum-readiness for the financial system: a roadmap
Mastercard, Migration to post-quantum cryptography white paper
QuSecure, Banco Sabadell case study
Information Technology Sector
Microsoft, Microsoft’s Quantum-resistant cryptography is here
Google, Announcing quantum-safe digital signatures in Cloud KMS
Cloudflare, Cloudflare Advances Industry’s First Cloud-Native Quantum-Safe Zero Trust Solution
Bouncy Castle, A PQC Almanac
IBM and InfoSec Global, IBM Consulting and InfoSec Global collaborate on visibility and control of cryptographic assets
Telecom
Global Systems for Mobile communications Association (GSMA), Post-Quantum Cryptography Use Case Library
Global Systems for Mobile communications Association (GSMA), Post-Quantum Cryptography Documents
Alliance for Telecommunications Industry Solutions (ATIS), Preparing 5G for the Quantum Era: An Analysis of 3GPP Architecture and the Transition to Quantum-Resistant Cryptography
Communications Sector Coordinating Council (CSCC), Post-Quantum Cryptography for Legacy and Migration-Constrained Systems in the Communications Sector
What is the harvest now, decrypt later cybersecurity threat?
Palo Alto Networks Harvest Now, Decrypt Later (HNDL)
Keyfactor, What is Harvest Now, Decrypt Later (HNDL)?
Research Paper, Departamento de Ingeniería Telemática, Universidad Carlos III de Madrid, Madrid, Spain On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks
eu agenda, Harvest now, decrypt later
What is cryptographic agility?
Cryptographic (crypto) agility refers to the capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware, and infrastructures while preserving security and ongoing operations. This white paper provides an in-depth survey of current approaches to achieving crypto agility. It discusses challenges and trade-offs and identifies approaches for providing operational mechanisms to achieve crypto agility. It also highlights critical working areas that require additional consideration.
Many IETF protocols use cryptographic algorithms to provide confidentiality, integrity, authentication, or digital signature. Communicating peers must support a common set of cryptographic algorithms for these mechanisms to work properly. This memo provides guidelines to ensure that protocols have the ability to migrate from one mandatory-to-implement algorithm suite to another over time.
What is cryptographic agility readiness?
The following are some crypto agility readiness papers for organizations or sectors :
Financial Services Information Sharing and Analysis Center (FS-ISAC), Post Quantum Cryptography (PQC) Building Cryptographic Agility in the Financial Sector
ISACA, Post-Quantum Readiness Starts with Crypto-Agility,Not Panic
Keyfactor, How to Assess Your Organization’s Cryptographic Agility Readiness
PostQuantum, Introduction to Crypto-Agility
Alliance for Telecommunications Industry Solutions (ATIS), Strategic Framework for Crypto Agility and Quantum Risk Assessment
Fortinet, How To Build A Crypto-Agility Roadmap For Quantum Readiness
InfoSec Global, Cryptographic Agility in Practice
PostQuantum, Introduction to Crypto-Agility
Are there mappings for aspects of Migration to PQC?
If your organization describes its maturity and mitigations to cybersecurity and privacy risk via frameworks like the NIST CSF or Security and Privacy Controls, a mapping to aspects of Migration to PQC could help support commitments to address the threat of a cryptographically relelvant quantum computer.
Where can I learn more?
Access to an internet search engine or a conversational AI will serve you well with queries such as “Where can I learn more about the threat of a cryptographically quantum computer?”, “How should an enterprise approach migration to post-quantum cryptography?”, “Where can i learn more about PQC?, etc. One should cross-check and verify sources, be mindful of AI Overview and Errors, and refine how you search as you seek answers that fit your research goals and role.
Is there a free online platform that can help anyone learn about aspects of the ?
Is there general guidance to engineers working on cryptographic libraries, network security, and infrastructure development?
The IETF Datatracker’s Post-Quantum Cryptography for Engineers draft. The document covers topics such as selecting appropriate PQC algorithms and understanding the differences between PQC Key Encapsulation Mechanisms (KEMs) and traditional Diffie-Hellman (DH) and RSA-style key exchanges, and it provides insights into expected differences in keys, ciphertext, signature sizes, and processing times between PQC and traditional algorithms.
Are there examples of table top exercises?
July 2023, Quantum-Safe Tabletop Exercise for Executives/Senior Decision Makers
What is “cryptographic debt” and why does it matter?
Cryptographic debt is the accumulated risk that builds up when cryptography is deployed without a centralized strategy, scattered across dozens of applications and never inventoried. The result is that deprecated or insecure algorithms can lurk in systems for years undetected.
See QuSecure’s Tackling Today’s Unrealized Cryptographic Debt Challenge
Has anyone defined what a cryptographic inventory is, and outlined a practical customer-led operating model for managing cryptographic posture?
Yes. Microsoft has defined cryptographic inventory concepts and outlined a practical customer-led operating model for managing cryptographic posture.
See Microsoft’s Building Your Cryptographic Inventory: A Customer Strategy for Cryptographic Posture Management blog post.
Who has framed the migration to PQC challenge for executive leaders?
Deloitte has framed cryptographic resilience, including the multi-year upgrade to post-quantum cryptography, in the context of regular cybersecurity operations, executive reviews, and prioritization discussions. Meta has also published a framework, lessons, and takeaways for managing post-quantum cryptography (PQC) migration across complex organizational use cases.
See Deloitte’s Cryptographic Resilience Community Profile and Meta Engineering’s Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways article.
What is the real threat?
Michael Osborne’s Denial of PQC Migration Attacks article (February 25, 2026) offers one perspective.
Are there lists of software applications, libraries, and hardware that include support for post-quantum cryptography?
Yes. There are several resources that list or categorize software applications, libraries, hardware, and product areas that include or may include support for post-quantum cryptography (PQC).
The PKI Consortium maintains a Post-Quantum Cryptography Capable Components Matrix.
The enterprise infrastructure stack shown on PQC Today’s Migration Path webpage lists products for each level in the stack.
CISA’s Product Categories and Technologies That Use Post-Quantum Cryptography Standards resource identifies categories where PQC products can be found.
Discovery and Inventory
What is a cryptographic inventory?
A cryptographic inventory is a descriptive record of the cryptography used across an organization’s systems, applications, services, devices, and data flows. It helps an organization identify where and how cryptography is being used so that cryptographic risks can be managed, policies can be applied consistently, and systems can be prepared for migration to post-quantum cryptography (PQC).
A cryptographic inventory may include information about:
Cryptographic algorithms in use, such as RSA, elliptic curve cryptography (ECC), AES, SHA-2, or post-quantum algorithms
Cryptographic protocols and services, such as TLS, SSH, VPNs, code signing, email encryption, and certificate-based authentication
Cryptographic keys, including key type, owner, associated algorithm, application, expiration date, and lifecycle status, without including the key material itself
Certificates and certificate chains
Systems, applications, or components that depend on cryptography
Data protected by cryptography, especially sensitive or long-lived data that may be vulnerable to “harvest now, decrypt later” threats
Implementation and software details: Specific cryptographic libraries and versions (e.g., OpenSSL 3.0), module validation statuses (e.g., FIPS 140-3), and Cryptographic Bills of Materials (CBOM) for third-party software dependencies.
Cryptographic parameters: Key lengths, operational modes (e.g., CBC vs. GCM), elliptic curves, and classical/quantum security bit strengths.
Hardware roots of trust: Hardware security modules (HSMs), TPMs, smart cards, and secure enclaves hosting keys or offloading operations.
Cryptographic agility assessment: Degree of algorithmic hardcoding, configurability, and ability to accommodate larger PQC key, ciphertext, and signature sizes.
Hosting and vendor boundaries: Cloud KMS services, SaaS dependencies, and third-party data exchange channels.
Related terms include cryptographic algorithm inventory, which focuses specifically on the algorithms in use, and cryptographic assets, which may include algorithms, keys, certificates, protocols, libraries, hardware security modules (HSMs), and other components that provide or depend on cryptographic protection.
Maintaining a cryptographic inventory is an important step in quantum readiness because organizations cannot effectively prioritize or migrate cryptography that they have not identified .
What are some existing open source tools that can be used for cryptographic inventorying?
Open source tools
pqcscan for scanning SSH and TLS servers
sslscan2 to test SSL/TLS enabled services to discover supported cipher suites
crt.sh to find SSL/TLS certificates issued for specific domains or organizations
cyberzero PQC Edge Scanner to scan for PQC transition signals at the public edge of any domain
SonarQube Plugin that detects cryptographic assets in source code and generates CBOM
A toolset for dealing with Cryptography Bill of Materials (CBOM)
Cryptographic asset discovery and PQC readiness scanner with CycloneDX CBOM output
Commercial products are often described as Automated Discovery and Inventory tools. If you are aleady operating continuous diagnostics and monitoring tools in your enterprise, consider asking your current tool providers if their tool can be leveraged for disocvery and inventory of crytography algorithms in use, communication protocols and services that use cryptography, cryptographic keys, certificates and certificate chains, systems, applications, or components that depend on cryptography, data protected by cryptography, cryptographic libraries, cryptographic parameters such as key lengths and operational modes, hardware roots of trust such as hardware security modules (HSMs), TPMs, smart cards, and secure enclaves hosting keys or offloading operations, etc.
Are there tools for cryptographic migration efforts at the system or asset level?
The PQC Coalition provides a PQC Inventory Workbook that can serve as a starting point for building a centralized inventory to track cryptographic migration efforts at the system or asset level.
What is a Cryptography Bill of Materials (CBOM) and how do I use it for Post-Quantum Systems and Applications?
A CBOM is a list of all the cryptographic algorithms, libraries, and protocols used in a system or application. It provides transparency into the cryptographic components and their configurations, which is essential for assessing security risks and planning migrations to post-quantum cryptography (PQC).
Here are a few resources that can help you understand and utilize CBOMs:
CycloneDX, Authoritative Guide to CBOM.
Post-Quantum Cryptography Alliance, CBOMKit
PKIC, CBOM Profile
GitHub’s Leveraging CodeQL for CBOM generations blog post.
Are there any free utilities to scan SSH and TLS servers?
See Anvil Secure’s pqcscan utility.
What can I use for free to test SSL/TLS enabled services to discover supported cipher suites?
See rbsec’s sslscan utility.
Risk Assessment and Planning
Is there guidance on where to start your migration to PQC?
Canadian Forum for Digital Infrastructure Resilience (CFDIR), Chapter Three of Canadian National Quantum-Readiness: Best Practices and Guidelines, version 04, July 2024
MITRE’s Post-Quantum Cryptography Coalition (PQCC), Post-Quantum Cryptography (PQC) Migration Roadmap
Public Key Infrastructure Consortium (PKIC), PQC Maturity Model
The Netherland’s General Intelligence and Security Service (AIVD), Centrum Wiskunde & Informatica (CWI), and TNO, an independent not-for-profit research organisation, The PQC Migration Handbook: Guidelines for Migrating to Post-Quantum Cryptography, Revised and Extended Second Edition, December 2024
European Telecommunications Standards Institute (ETSI), TR 104 016 V1.1.1 – CYBER; Quantum-Safe Cryptography (QSC); A Repeatable Framework for Quantum-Safe Migrations
QRAMM | Post-Quantum Cryptography Migration Checklist A Step-by-Step Guide for Your PQC Transition
What are some responses or key takeaways from industry to EO 14412?
QuSecure, New Executive Orders Set Federal Dealines for Post-Quantum Crytography Migration
AppViewX Infographic, Requirements, deadlines, and a practical path to quantum resilience
Cloudflare Blog, It’s time to get to work
Zscaler Blog, Accelerating Post-Quantum Readiness Timelines: A New Executive Order on Securing Against Advanced Cryptographic Attacks
Entrust Blog, What the New U.S. Executive Order Signals for Post-Quantum Security
F5 Blog, Why the recent U.S. Executive Order 14412 demands PQC readiness
Keyfactor Blog, Explaining Executive Order: Securing the Nation Against Advanced Cryptographic Attacks & What This Means for Your Organization
Are there methodologies to manage the complexity of PQC migration for various use cases?
Yes. A few different organizations have developed various frameworks and methodologies for tackling PQC Migration.
Meta Engineering Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways article.
Who has published timelines for milestones and deadlines for migration to post-quantum cryptography?
The following resources give information related to timelines and milestones for migrating to PQC:
NIST, IR 8547 (Initial Public Draft) Transition to Post-Quantum Cryptography Standards
NSA, The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ
The United Kingdom’s National Cyber Security Center, Timelines for migration to post-quantum cryptography
Canadian Centre for Cyber Security, Roadmap for the migration to post-quantum cryptography for the Govenrment of Canda (ITSM.40.001)
What does your public edge reveal about your post-quantum readiness?
CyberZero’s PQC Public Scanner.
What should I ask vendors about their product’s CRCQ readiness?
Australian Government, Post-quantum questions to ask your vendors. Assess vendor readiness for post-quantum cryptography (PQC) to identify and manage risks, support transition planning and strengthen long-term cyber security
QSecuring Technolgies, PQC Vendor Assessment Guide: How to Evaluate Vendors for Post-Quantum Readiness
Which vendors have changed their target for becoming fully post-quantum secure?
In 2026 Cloudflare, Google, and Micorosoft have changed their timelines or targets for becoming fully post-quantum secure.
git See Cloudflare’s Post-Quantum Roadmap blog post, Google’s Cryptography Migration Timeline blog post, and Microsoft;s Accelerating the quantum-safe timeline blog post .
Migration Execution
Has NIST published strategy to manage and guide the transition to post-quantum cryptography?
NIST IR 8547 (FINAL) Transition to Post-Quantum Cryptography Standards This report identifies existing quantum-vulnerable cryptographic standards and the quantum-resistant standards to which information technology products and services will need to transition.
This report serves as the initial step in a broader strategy to manage and guide the transition to post-quantum cryptography. It provides the technical framework necessary to meet the accelerated migration timelines for federal high value assets and high impact systems while serving as a blueprint for critical infrastructure owners and operators and other organizations undergoing the same shift. This transition will involve the adoption of new PQC algorithms as well as the careful deprecation and eventual removal of quantum-vulnerable algorithms that are currently widespread in technological infrastructures. Public-private engagement will be crucial on the path toward PQC.
What has the National Cybersecurity Center of Excellence (NCCoE) published to support migration to PQC?
The following preliminary draft were published before 2024 and frame the challenges that the project could accomplish: Preparation for Considering the Implementation and Adoption of Quantum Safe Cryptography Quantum Readiness: Cryptographic Discovery Quantum Readiness: Testing Draft Standards
The are no current plans to issue second drafts or final versions of these publications.
The project team is using NIST Cybersecurity White Papers to share progress.
The following are two NIST Cybersecurity White Papers published: NIST CSWP 48, Mappings of Migration to PQC Project Capabilities to Risk Framework NIST CSWP 39, Considerations for Achieving Crypto Agility Strategies and Practices
With regard to CSWP 48, what else can the project map to support your quantum readiness needs?
Can I contribute feedback on drafts to Personal Identity Verification (PIV) specifications, including NIST SP 800-73, Parts 1 and 2, and NIST SP 800-78, to PQC standards?
NIST, PIV Standards and Guidelines - Working drafts for post-quantum cryptography working drafts.
IS there guidance on using TLS to protect data, to include recommended configurations for post-quantum cryptography (PQC)?
UK National Cyber Securuity Center Blog Post, Post-quantum updates to our TLS guidance
Digicert Article, Recommendations for post-quantum TLS migration
Michael Osborne, CTO IBM Quantum Safe PQC Migration: Start with TLS and ignore almost everything else for now
What is post-quantum authentication?
Where can I find embedded Post-Quantum-Cryptography (PQC) in security architectures as a foundational element?
NXP, Securing Tomorrow: NXP’s Post-Quantum Cryptography Strategy
CISCO, Securing campus and branch networks from boot to transport with full-stack PQC
Do Hardware Security Module (HSM) products incorporate PQC quantum resistant cryptographic algorithms?
A Hardware Security Module (HSM) is a purpose-built physical security device designed to generate cryptographic keys securely, protect those keys throughout their entire lifecycle, and perform sensitive cryptographic operations inside secure hardware
How can one check to see if one’s browser is offering post-quantum encryption support?
See Cloudflare Radar’s Post-Quantum Encryption webpage.
What does it mean in OpenSSH 10.1 if you receive a warning users when connections use cryptography that is not safe against quantum computers?
If you received such a warning, it means that the server you connected to did not offer one of the two post-quantum key agreement algorithms that are being standardised for the SSH protocol: mlkem768x25519-sha256 and sntrup761x25519-sha512 . Visit OpenSSH’s Post-Quantum Cryptography webpage to learn more.
Are there Linux distros that can run NGINX with PQC support?
This December 3, 2025 NGINX Blog lists lists all Linux distros that can run NGINX with PQC support.
Are there examples of CRQC-ready cryptographic libraries?
AWS, AWS-LC FIPS 3.0: First cryptographic library to include ML-KEM in FIPS 140-3 validation
OpenQuantumSafe, liboqs is an open source C library for quantum-safe cryptographic algorithms and `OpenSSL 3+ is a repository which contains code to enable quantum-safe cryptography (QSC) in a standard OpenSSL (>v1.1) distribution by way of implementing a single shared library <https://github.com/open-quantum-safe/oqs-provider>>`_, `the OQS provider <https://docs.openssl.org/master/man7/provider/>>`_
Bouncy Castle, New Release: Bouncy Castle Java 1.86
wolfSSL, Embedded SSL/TLS Library
Microsoft, Core cryptographic library for Windows, Azure Linux and other products
Is there an open-source tool on applicability of various PQC algorithms for use cases?
TNO’s PQChoiceAssistant
CNSP QRAMM `Algorithm selection guide https://qramm.org/learn/algorithm-selection-guide.html>`_
How are operating system designers addressing the CRQC threat?
Operating system designers are addressing the cryptanalytically relevant quantum computer (CRQC) threat by implementing post-quantum cryptography (PQC) in operating systems and related security protocols.
See Google’s Security for the Quantum Era: Implementing Post-Quantum Cryptography in Android blog post.
What are some examples of rolling out support for post-quantum cryptography (PQC)?
See Akamai’s Post-Quantum Cryptography Implementation Considerations for TLS article, Cloudflare’s Post-Quantum 2025 blog post, Google Cloud’s How We’re Helping Customers Prepare for a Quantum-Safe Future blog post, Microsoft’s Post-Quantum Cryptography APIs Now Generally Available on Microsoft Platforms blog post, and OpenSSL’s OpenSSL 3.5 Final Release announcement.
Migration Testing
Are there performance results posted for PQC algorithms?
Each submitted algorithm such as Crystals Kyber includes a “Performance Overview Section”
Papers have been submitted to the NIST PQC Standardization Conferences such as (Yet another) Analysis of MLWE’s performance impact on specific TLS Use-cases .
Open Quantum Safe, OQS algorithm performance visualizations
Are there IETF projects that provide repositories for work completed on PQC algorithms?
Was there a 2026 workshop on Secure Protocol Implementations in the Quantum Era?
The Secure Protocol Implementations in the Quantum Era (SPIQE) workshop took place on Friday, July 10, 2026, as a post-conference workshop at Euro S&P 2026 in Lisbon, Portugal.
How are browser developers making HTTPS certificates secure against a cryptanalytically relevant quantum computer (CRQC)?
Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs). This work is currently in development in the PLANTS working group.
See Google’s Cultivating Robust and Efficient Post-Quantum TLS Certificates blog post.
What are some benchmarks that inform migrating the Internet to post-quantum key agreement?
See Cloudflare’s Post-Quantum 2024 blog post.
What is an example of early experimentation with post-quantum cryptography?
Google’s 2016 experiment with post-quantum cryptography is an example of early experimentation with post-quantum cryptography.
See Google’s Experimenting with Post-Quantum Cryptography blog post.
Is there a benchmarking suite designed to automate the evaluation of PQC computational and networking performance across x86 and ARM architectures?
Yes. See the IEEE article A Benchmarking Framework for Post-Quantum Cryptography.
Are there examples of US Government testing PQC algorithm to meet 2031 authentication deadlines?
The Federal Identity, Credential, and Access Management (FICAM) program is helping to lead federal efforts to prepare for post-quantum cryptography (PQC) to protect identities, credentials, and access at enterprise scale. See FICAM’s Post-Quantum Cryptography (PQC) webpage.
Validation and Monitoring
Which Federal Information Processing Standards (FIPS) are the ones for PQC?
There are three Federal Information Processing Standards (FIPS) for Post-Quantum Cryptography:
These standards specify key establishment and digital signature schemes that are designed to resist future attacks by quantum computers, which threaten the security of current standards. The three algorithms specified in these standards are each derived from different submissions to the NIST Post-Quantum Cryptography Standardization Project. This page offers opportunities to learn about quantum-resistent Key Encapsulation Mechanism algorithms and Digital Signature algorithms
Does NIST have validation testing of approved cryptographic algorithms and their individual components?
NIST’s Cryptographic Algorithm Validation Program (CAVP) offers two Automated Cryptographic Validation Test Systems (ACVTS) for interested users to test cryptographic algorithm implementations. A Demo ACVTS server is available at no cost to interested parties. More information on accessing the ACVTS can be found the CAVP page on Accessing the ACVTS.
The Production ACVTS server is only available to National Voluntary Laboratory Accreditation Program (NVLAP) accredited testing laboratories, and is the only way to create algorithm validation certificates listed on the Algorithm Validation Search Page. The CAVP, through ACVTS, will generate test vectors to match the capabilities of a given implementation under test. The CAVP is not responsible for running those test vectors through the implementation.
Does NIST have a security metric to use in procuring equipment containing validated cryptographic modules?
NIST’s Cryptographic Module Validation Program (CMVP) promotes the use of validated cryptographic modules and provide Federal agencies with a security metric to use in procuring equipment containing validated cryptographic modules.