Applied PQC Book Playground Blog @AppliedPQC 中文

Applied PQC

Post-quantum cryptography, where it actually stands

Read the book Run the code

Why it matters

Shor's algorithm on a quantum computer recovers private keys from public ones. It breaks:

RSAECDSAEdDSADiffie-HellmanX25519MQV

Key exchange first. Traffic recorded now can be decrypted later: harvest now, decrypt later. Signatures can wait longer, except long-lived keys such as firmware roots.

The standards

StandardAlgorithmTypeStatus
FIPS 203ML-KEMLattice key encapsulationFinal 2024
FIPS 204ML-DSALattice signaturesFinal 2024
FIPS 205SLH-DSAStateless hash-based signaturesFinal 2024
FIPS 206FN-DSALattice signatures, compactIn development
FIPS to comeHQCCode-based key encapsulationSelected 2025
SP 800-208LMS, XMSSStateful hash-based signaturesFinal

Nine more signature schemes are in round 3 (NIST IR 8610).

In the protocols

WhereSpecificationWhat it adds
TLS 1.3RFC 10024, 9954Hybrid groups such as X25519MLKEM768
SSHRFC 10042mlkem768x25519-sha256, OpenSSH's default
X.509RFC 9881, 9935, 9909, 10073ML-DSA, ML-KEM and SLH-DSA certificates, and 18 composites
CMSRFC 9814, 9882, 9936S/MIME and code signing
JOSE, COSERFC 9964ML-DSA for tokens and attestations
OpenPGPRFC 9980ML-KEM and ML-DSA composites, and SLH-DSA

The deadlines

  1. 2024FIPS 203, 204 and 205 published
  2. 2026EU: inventories start
  3. 2027France, NSA: PQC in new products
  4. 2028UK: migration plan done
  5. 2030NIST deprecates RSA and ECC. US high-value systems: PQC key exchange
  6. 2031US high-value systems: PQC signatures
  7. 2035NIST disallows them. Migration complete

Sources: NIST IR 8547 · EO 14412 · OMB M-26-15 · EU roadmap · NCSC · ANSSI

Hybrid? BSI and ANSSI require it, NCSC prefers pure post-quantum, NIST accepts both.

What has shipped

Key exchange: on by default

  • OpenSSH 10.0+: mlkem768x25519-sha256
  • TLS: default in Apple OS 26, JDK 27, Cloudflare and rustls (tracker)
  • Signal: ML-KEM-1024 in key agreement and the ratchet

Libraries

  • OpenSSL 3.5+: ML-KEM, ML-DSA, SLH-DSA
  • Go 1.24+: crypto/mlkem; 1.27 adds crypto/mldsa
  • rustls: hybrid by default, ML-DSA certificates since 0.23.44
  • AWS-LC, BoringSSL, liboqs, Bouncy Castle

Authentication: the harder half

An ML-DSA-44 signature is 2,420 bytes. ECDSA's is 64.

  • Web PKI: Chrome and Let's Encrypt chose Merkle Tree Certificates (tracker)
  • OpenSSH 10.6: ML-DSA-44 + Ed25519 keys and CAs
  • Private PKI: ML-DSA certificates work today

TLS

Key exchange is on by default in the major stacks. For public certificates, Chrome, Let's Encrypt and Cloudflare chose Merkle Tree Certificates.

Specs: RFC 10024 hybrid groups · RFC 9954 framework · draft-ietf-tls-mlkem ML-KEM alone, in the RFC Editor queue · RFC 10073 composite certificates

WhoKey exchangeCertificates
Apple OS 26Default X25519MLKEM768—
Java JDK 27Default X25519MLKEM768—
CloudflareDefault to origins, about 45 billion connections a dayPlanned public MTC CA, free from Q1 2027
rustlsDefault since 0.23.27; ML-KEM-1024 in 0.23.37Default ML-DSA since 0.23.44, private PKI
ChromeSupported ML-KEM in BoringSSLPlanned MTC root store, phases through Q3 2027
Let's Encrypt—Planned Merkle Tree Certificates, chosen June 2026
GoSupported ML-KEM since 1.24, ML-KEM-1024 in 1.27Supported ML-DSA in 1.27
OpenSSLSupported ML-KEM since 3.5Supported ML-DSA, SLH-DSA since 3.5
wolfSSL—Supported SLH-DSA in 5.9.4, all 12 parameter sets
s2n-tlsSupported hybrid—

Blockchains

The most exposed chain has shipped the least.

ChainWhere it isWhat
BitcoinDraft BIPsBIP-360 and BIP-361 drafted. Over 34% of bitcoin sits behind an exposed public key.
EthereumResearch, Draft EIPsHash-based signatures aggregated by leanVM. ML-DSA precompile proposed (EIP-8355).
GOAT NetworkIn progressBitcoin L2. Consensus keys moving to ML-DSA-65, bridge to a hash-based STARK verifier.
CosmosReleased codeSDK v0.55: opt-in ML-DSA-65 keys.
AlgorandMainnetFalcon-1024 accounts.
NEARMainnetML-DSA-65 access keys.

What to do now

  1. Inventory. Find every use of RSA and elliptic curves. A clean scan is not proof.
  2. Hybrid key exchange. Turn it on, and check middleboxes accept the larger handshake.
  3. Test vectors. Test against NIST's ACVP vectors, not against yourself.
  4. Signatures. Private PKI: ML-DSA certificates work today. Public: Merkle Tree Certificates, free from Cloudflare from Q1 2027.

Questions

Where is FN-DSA (Falcon)?

NIST lists FIPS 206 as in development. Implementations follow the round-3 Falcon specification, as Algorand's Falcon-1024 accounts do.

Does my connection already use post-quantum cryptography?

For key exchange, probably: Apple OS 26, JDK 27, OpenSSH 10 and Cloudflare use a hybrid by default.

Should I use a hybrid or post-quantum alone?

BSI and ANSSI say hybrid, NCSC says post-quantum alone, NIST accepts both. For signatures, see RFC 9955.

Is Classic McEliece recommended?

Not for new work, says BSI (October 2026). ML-KEM and FrodoKEM are preferred.

Are hash-based signatures safe to deploy?

SLH-DSA, yes. LMS and XMSS are stateful: reusing a key allows forgeries.

When will a quantum computer break RSA?

Nobody knows. The deadlines are planning dates, not forecasts.

Further reading

What we build

The list, the book, implementations of all four standards, and research.

  • awesome-pqc

    Standards, test vectors, libraries and deployments, every link verified.

    Listlink-verified

  • The book

    From lattices to all four standards, then deployment: hybrid TLS, side channels, blockchains.

    Online & PDF285 pages

  • Runnable code

    All 108 listings and the four reference implementations, in your browser.

    Playground108 listings

  • bitcoin-stark-verifier

    A STARK verifier in Bitcoin Script with no OP_CAT: Poseidon2 over KoalaBear, with WHIR.

    Rustno soft fork

  • Disproving one step

    One verifier chunk per transaction, bound by Winternitz signatures.

    BitVM~2,000 chunks

  • WHIR on Bitcoin Script

    STIR and WHIR stated formally, and the verifier reviewed against them.

    PDF17 pages

  • ML-KEM

    21 of 21 algorithms. Key encapsulation at 512, 768 and 1024.

    FIPS 203

  • ML-DSA

    49 of 49 algorithms. Signatures at 44, 65 and 87.

    FIPS 204

  • SLH-DSA

    25 of 25 algorithms, all twelve approved parameter sets.

    FIPS 205

  • FN-DSA

    18 of 18 Falcon algorithms. Still in development at NIST, so validated against Falcon's own tests.

    FIPS 206

  • Post-quantum Privacy Pass: anonymous credentials from UOV and VOLE-in-the-head

    Privacy Pass tokens stay private after Q-day but become forgeable. Cloudflare Research's replacements build on UOV and VOLE-in-the-head: PoMFRIT, VOLE-IHAT and VOLE-ACT, at 4 to 12 KB per token and milliseconds per step.

    Writing2026-11-08

  • NIST IR 8547, from draft to final: what changed in the transition schedule

    NIST's final transition report keeps 2030 and 2035 but deprecates quantum-vulnerable public-key cryptography at every key size, builds in the federal 2030 and 2031 deadlines, and names ML-KEM-768 as the default. What changed from the 2024 draft, sentence by sentence.

    Writing2026-10-28

  • The construction of SHRINCS, a semi-stateful hash-based signature scheme

    SHRINCS demotes SLH-DSA to a fallback path and puts a 548-byte stateful signature on the primary one. What the draft reuses from FIPS 205, what it only reparameterises, what it constructs anew, and what it gives up.

    Writing2026-08-28

  • Post-quantum migration for Bitcoin layer 2s

    A Bitcoin layer 2 settles to a base layer it cannot change, borrows consensus from a third ecosystem, and runs a bridge whose trust root is cryptography of its own choosing. Where the post-quantum exposure actually sits, and who can fix each part.

    Writing2026-07-31

Contributors

Everyone who has committed to, or opened an issue in, an AppliedPQC repository.