Bilingual

Shipping post-quantum cryptography to Python – The Trail of Bits Blog
21 days ago
- pyca/cryptography version 48 now supports post-quantum algorithms ML-KEM and ML-DSA, funded by the Sovereign Tech Agency.
- Post-quantum cryptography addresses threats from quantum computers, with U.S. government migration deadlines set for 2030-2031.
- ML-DSA signatures and ML-KEM key exchange have larger data sizes than classical algorithms (e.g., Ed25519, X25519).
- SLH-DSA, a hash-based signature standard, is not yet supported but is under development for future updates.
- Protocol integration and application adoption are needed for a complete migration to post-quantum cryptography in Python.
Show HN: Grade your code's post-quantum crypto exposure A–F, free, in-browser
21 days ago
- A Cryptographic Bill of Materials (CBOM) is crucial for identifying quantum-vulnerable cryptography in your stack as part of PQC migration.
- An open-source scanner provides a full scan in CI/CD workflows, generating a CycloneDX 1.6 CBOM, SARIF report, and an A–F grade badge without uploading data.
- The scan can be run locally via npm or integrated into GitHub Actions, with options to fail builds on broken classical cryptography.
- For audit readiness, an Evidence Pack Express offers a cryptographically signed deliverable including an executive summary, findings, CBOM, and migration plan.
- Note: The scanner is lexical, findings are leads to verify, not a complete inventory, and it does not guarantee quantum safety or certification.
Bugs happen: The easy way to compare solo PQ to ECC+PQ
21 days ago
- ECC+PQ (hybrid) is recommended over solo PQ because solo PQ will lead to many exploitable software vulnerabilities, causing immediate security disasters.
- ML-KEM and ML-DSA implementations have already had numerous bugs and timing leaks (e.g., KyberSlash1, KyberSlash2), and more vulnerabilities are expected as they are newer and less tested than ECC software.
- Even if PQ specifications remain unbroken, software flaws in PQ libraries will expose keys, whereas an ECC layer can rescue users by delaying attacks and limiting damage.
- Quantum attacks will be expensive and limited in scale initially, so ECC provides additional protection by delaying attacks until quantum computers are available and affordable.
- The cost of adding ECC to PQ is negligible compared to PQ's own costs (e.g., X25519 adds only 32 bytes to ML-KEM's 800+ bytes), and deployment examples (like Cloudflare) show ECC+PQ is already working without delays.
- Proponents of solo PQ use flawed arguments, such as overstating complexity or costs, and ignore the value of ECC in mitigating software vulnerabilities and delaying quantum attacks.
We cannot wait for better post-quantum signature algorithms
16 days ago
- RSA and ECC are vulnerable to quantum attacks, but ML-KEM encryption and ML-DSA signatures are quantum-resistant and were standardized by NIST in 2024.
- Cloudflare aims for full post-quantum security by 2029, with most traffic already using ML-KEM, but signatures still need migration to protect authentication.
- ML-DSA has downsides like larger sizes compared to classical algorithms, and alternative post-quantum signature schemes are being developed, such as FN-DSA and others from NIST's third round.
- New signature schemes like SQIsign offer small signatures but slow signing, UOV has tiny signatures but huge public keys, and stateful hash-based signatures require careful state management.
- FN-DSA (Falcon) offers better performance than ML-DSA but has implementation challenges, especially for secure signing, and is not yet widely available.
- Proof-of-knowledge schemes like FAEST, MQOM, and SDitH provide conservative security and flexibility for applications like anonymous credentials, but may not outperform ML-DSA dramatically.
- Structured multivariate schemes like MAYO and SNOVA aim to reduce key sizes, with MAYO being more conservative and SNOVA more aggressive but less stable.
- Timelines for new signature algorithms suggest they won't be ready in time for initial migrations (e.g., FN-DSA by 2033, multivariate by 2034), so ML-DSA is necessary for now.
- The ongoing competition is crucial for advancing post-quantum cryptography beyond basic primitives, enabling future improvements and applications like anonymous credentials.
France's Anssi Will Block PQC-Free Products from Certification Starting 2027
4 days ago
- France's ANSSI will stop certifying security products lacking quantum-resistant encryption starting in 2027.
- Businesses are advised to purchase only quantum-safe products by 2030, as per ANSSI's chief of staff.
- ANSSI certification is mandatory for access to French government and critical infrastructure markets.
- The policy addresses 'Harvest Now, Decrypt Later' attacks, where encrypted data is stored for future quantum decryption.
- Industry demand for post-quantum cryptography (PQC) products is accelerating, with banks and public services assessing exposure.
- ANSSI's 2027 deadline parallels the NSA's CNSA 2.0 procurement gate, creating pressure on vendors across jurisdictions.
- ANSSI recommends hybrid PQC (combining classical and quantum algorithms), a stricter requirement than the NSA's approach.
- France's 2027 cutoff runs ahead of the EU's 2030 target for high-risk systems, positioning France as a leader in enforcement.
- Multinational vendors face compliance challenges from differing PQC standards in the U.S., France, and Germany.
- A 2025 study found that most organizations lack post-quantum transition plans, highlighting a significant preparedness gap.
Classical Acceptance Is Not Hybrid Authentication: Measuring X.509 Verifier
20 hours ago
- Hybrid X.509 certificates with separable designs risk relying solely on classical authentication, ignoring post-quantum evidence.
- Experiments across eight validation stacks show most accept hybrid certificates based only on classical paths, not evaluating post-quantum credentials.
- When post-quantum credentials are revoked but classical certificates remain valid, default paths still accept due to credential exclusion from decision scope.
- The gap is structural, not due to missing primitive capabilities, and stems from standards not requiring verifiers to make post-quantum evidence outcome-bearing.
- A verifier model and policy-parametric contract are proposed to enforce proper hybrid authentication checks.

post-quantum cryptography

Shipping post-quantum cryptography to Python – The Trail of Bits Blog

Show HN: Grade your code's post-quantum crypto exposure A–F, free, in-browser

Bugs happen: The easy way to compare solo PQ to ECC+PQ

We cannot wait for better post-quantum signature algorithms

France's Anssi Will Block PQC-Free Products from Certification Starting 2027

Classical Acceptance Is Not Hybrid Authentication: Measuring X.509 Verifier