PQC product readiness and migration navigator

In short: Choose your products to see what reviewed vendor evidence says about post-quantum support, then build a migration plan. Reference material is folded at the end. Choose your products

Choose the products and versions you run and see what reviewed vendor evidence says about post-quantum cryptography for each cryptographic function, what blocks migration, which dates are announced and which guidance may apply. Every statement links to the official page and the passage it rests on.

Not compliance advice, not a certification and not a security score. Vendor availability is not your readiness: software that supports an algorithm is not necessarily installed, enabled, tested or negotiated. Unknown is not unsupported.

Coverage and limits

Thirty-nine product families in ten categories, including four Linux distributions; not a complete market view. A product, version or function that is not listed has no verified information here, which is not the same as no support.

39 product families in 10 categories; 89 of 96 assertions approved for publication; 7 candidates awaiting verification are not shown.

Vendor documentation is the vendor’s own claim, not independent validation. Library support does not make dependent applications ready. A passed roadmap date is not a release. Dates of guidance are authority targets, not legal deadlines, unless a verified obligation says otherwise; none is listed yet.

Pilot catalogue of post-quantum readiness evidence for selected products, read on official vendor and project pages on 22 October 2026. Each assertion covers one exact release range, function and role, in the portal's own words with a locator. Vendor documentation is the vendor's own claim, not independent validation. An assertion appears publicly only after an editor approves it. Not compliance advice. Compiled 2026-10-22.

Explore products

One row per reviewed assertion: one product release range, one cryptographic function and role, its published capability as the vendor states it, the vendor date with its type, and an evidence card with the source, the locator of the passage and the review. Search and filters work in your browser; without JavaScript the whole table is shown.

Reviewed post-quantum readiness assertions by product, release and function
Vendor and product	Versions	Function and role	Published capability	Vendor date	Evidence
Windows Server Microsoft · Operating system	Windows Server 2025 and later	PKI / CA certificate issuance Certificate authority issuance	Generally available	Vendor release date 2026-05 The 2026-05 security update is named as the minimum.	Evidence card Applies to, as the main document states Windows Server 2025 with the 2026-05 security update (KB5087539) or later (AD CS servers) (Explicit scope of the main document) Algorithms ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure post-quantum Protocol X.509 certificates Enabled by default Not stated Required patch KB5087539 (the 2026-05 security update) or later on the AD CS servers. Configuration Use CNG key storage providers; AD CS does not support legacy cryptographic service providers for PQC. Limitations Phase 1 covers ML-DSA only. Clients named are Windows 11 24H2 and 25H2 with KB5067036 or later; some algorithms may need later versions. Evidence note (portal’s own words) Microsoft lists ML-DSA as available in AD CS in a first phase, for CA servers on Windows Server 2025 with the May 2026 security update or later. The page names no earlier Windows Server release. Locator Sections PQC algorithms supported in AD CS (row ML-DSA, Available, Phase 1) and Platform requirements Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Microsoft Learn: Post-Quantum Cryptography in AD CS overview (Vendor documentation; published 2026-05-12; updated 2026-05-20; retrieved 2026-10-22)
Windows Server Microsoft · Operating system	Windows Server 2025 and later	PKI / CA certificate issuance Certificate authority issuance	Announced roadmap	No published date	Evidence card Applies to, as the main document states AD CS (Phase 2), on the Windows Server 2025 platform baseline (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), Composite ML-DSA (IETF LAMPS draft), Composite ML-KEM (IETF LAMPS draft) Mode Pure and hybrid Protocol X.509 certificates Enabled by default Not stated Required patch None stated Configuration None stated Limitations Planned only, with no release or date. Microsoft also plans PQC across the CEP, CES, NDES and OCSP role services. Evidence note (portal’s own words) ML-KEM and the composite ML-DSA and ML-KEM forms are listed as planned for a second phase, with no target date. A planned item is not a release. Locator Section PQC algorithms supported in AD CS (rows marked Planned, Phase 2) Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2026-12-22 Sources Microsoft Learn: Post-Quantum Cryptography in AD CS overview (Vendor documentation; published 2026-05-12; updated 2026-05-20; retrieved 2026-10-22)
Windows Server Microsoft · Operating system	Windows Server 2022 up to, not including, Windows Server 2025	PKI / CA certificate issuance Certificate authority issuance	No verified information	No published date	Evidence card Applies to, as the main document states Windows Server 2022 (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The AD CS PQC overview gives Windows Server 2025 with KB5087539 as the starting platform and says nothing about Windows Server 2022: no support, no backport and no date are stated for it. Locator Section Platform requirements names Windows Server 2025 only; Windows Server 2022 is not mentioned Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Microsoft Learn: Post-Quantum Cryptography in AD CS overview (Vendor documentation; published 2026-05-12; updated 2026-05-20; retrieved 2026-10-22)
Windows Server Microsoft · Operating system	Windows Server 2025 and later; build 26100.33158 or later	TLS key establishment Key establishment	Generally available	Vendor release date 2026-07-14 Release date of KB5099536.	Evidence card Applies to, as the main document states Windows Server 2025, all editions (Explicit scope of the main document) Algorithms None stated Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Not stated Required patch KB5099536 (OS build 26100.33158) or a later cumulative update. Configuration None stated Limitations The update notes name no algorithm or group, no component and no default state; whether it is enabled must be checked in the TLS configuration. Evidence note (portal’s own words) The July 2026 update for Windows Server 2025 adds hybrid post-quantum key exchange to TLS 1.3. Windows Server 2022 appears on the page only in the Related topics side menu, not in the article scope. Locator Improvements, item [Cryptography]; the explicit scope is the Applies to line under the main heading Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Microsoft Support: July 14, 2026 - KB5099536 (OS Build 26100.33158) (Vendor release notes; published 2026-07-14; updated Not stated; retrieved 2026-10-22)
Windows Server Microsoft · Operating system	Windows Server 2022 up to, not including, Windows Server 2025	TLS key establishment Key establishment	No verified information	No published date	Evidence card Applies to, as the main document states Windows Server 2022 (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The hybrid TLS 1.3 key exchange update is scoped to Windows Server 2025. No reviewed Microsoft page states support, a backport or a date for Windows Server 2022. Locator KB5099536 Applies to line (Windows Server 2025, all editions); Windows Server 2022 only in the Related topics menu Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Microsoft Support: July 14, 2026 - KB5099536 (OS Build 26100.33158) (Vendor release notes; published 2026-07-14; updated Not stated; retrieved 2026-10-22) Microsoft Learn: Post-Quantum Cryptography in AD CS overview (Vendor documentation; published 2026-05-12; updated 2026-05-20; retrieved 2026-10-22)
OpenSSL OpenSSL Project · Cryptographic library	OpenSSL 3.5 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2025-04-08 Release date of OpenSSL 3.5.0.	Evidence card Applies to, as the main document states OpenSSL 3.5.0 and later (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204), SLH-DSA (NIST FIPS 205) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration Available in the default and FIPS providers. Limitations None stated Evidence note (portal’s own words) OpenSSL 3.5.0 adds ML-KEM, ML-DSA and SLH-DSA to its default and FIPS providers. Library support alone does not mean an application is configured to use them. Locator CHANGES.md, Changes between 3.4 and 3.5.0 [8 Apr 2025]; release announcement, list of new features Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenSSL Project: CHANGES.md of the openssl-3.5 branch (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) OpenSSL Library: OpenSSL 3.5 Final Release - Live (Vendor announcement; published 2025-04-08; updated Not stated; retrieved 2026-10-22) Published interoperability tests naming this release Keyfactor interoperability page: ML-KEM key exchange in TLS 1.3 sessions (OpenSSL 3.5.0, minimum version stated (equal or higher))
OpenSSL OpenSSL Project · Cryptographic library	OpenSSL 3.5 and later	TLS key establishment Client and server	Generally available	Vendor release date 2025-04-08 Release date of OpenSSL 3.5.0.	Evidence card Applies to, as the main document states OpenSSL 3.5.0 and later (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP256r1MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP384r1MLKEM1024 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration X25519MLKEM768 is first in the default TLS groups; the client sends X25519MLKEM768 and X25519 key shares by default. Limitations Only X25519MLKEM768 is in the default list; the other hybrid groups need configuration. Applications that set their own group list override the default. Evidence note (portal’s own words) From 3.5.0, OpenSSL offers the hybrid X25519MLKEM768 group by default in TLS 1.3. Locator CHANGES.md, Changes between 3.4 and 3.5.0 [8 Apr 2025], entry on the default TLS groups Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenSSL Project: CHANGES.md of the openssl-3.5 branch (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Published interoperability tests naming this release Keyfactor interoperability page: ML-KEM key exchange in TLS 1.3 sessions (OpenSSL 3.5.0, minimum version stated (equal or higher))
OpenSSL OpenSSL Project · Cryptographic library	OpenSSL 3.0 up to, not including, OpenSSL 3.5	Algorithms in the cryptographic API Library API	Explicitly unsupported for this scope	No published date	Evidence card Applies to, as the main document states OpenSSL 3.0 to 3.4 (built-in providers) (Explicit scope of the main document) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations Covers the algorithms built into OpenSSL; third-party providers are outside this scope. Evidence note (portal’s own words) The 3.5.0 changelog adds the three NIST algorithms, so the built-in providers of 3.0 to 3.4 do not have them. Locator CHANGES.md, Changes between 3.4 and 3.5.0, entries adding ML-KEM, ML-DSA and SLH-DSA Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenSSL Project: CHANGES.md of the openssl-3.5 branch (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) OpenSSL Library: OpenSSL 3.5 Final Release - Live (Vendor announcement; published 2025-04-08; updated Not stated; retrieved 2026-10-22)
OpenSSL OpenSSL Project · Cryptographic library	OpenSSL 3.0 up to, not including, OpenSSL 3.5	TLS key establishment Client and server	Explicitly unsupported for this scope	No published date	Evidence card Applies to, as the main document states OpenSSL 3.0 to 3.4 (built-in TLS groups) (Explicit scope of the main document) Algorithms None stated Mode Not applicable Protocol TLS 1.3 Enabled by default Not stated Required patch None stated Configuration None stated Limitations Covers the built-in TLS groups; third-party providers are outside this scope. Evidence note (portal’s own words) The hybrid ML-KEM TLS groups arrive with 3.5.0; earlier 3.x releases have no built-in post-quantum key exchange group. Locator CHANGES.md, Changes between 3.4 and 3.5.0, entry on the default TLS groups Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenSSL Project: CHANGES.md of the openssl-3.5 branch (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
OpenSSH OpenSSH (OpenBSD project) · SSH implementation	OpenSSH 9.0 up to, not including, OpenSSH 10.0	SSH key exchange Client and server	Generally available	Vendor release date 2022-04-08 Release date of OpenSSH 9.0.	Evidence card Applies to, as the main document states OpenSSH 9.0 and later (Explicit scope of the main document) Algorithms sntrup761x25519-sha512 (SSH hybrid of Streamlined NTRU Prime and X25519) Mode Hybrid (classical and post-quantum) Protocol SSH Enabled by default Yes Required patch None stated Configuration None stated Limitations Streamlined NTRU Prime is not the NIST ML-KEM standard. From 10.0 the default changes to ML-KEM. Evidence note (portal’s own words) OpenSSH 9.0 makes the hybrid Streamlined NTRU Prime and X25519 key exchange the default, citing store-now-decrypt-later attacks. Locator Release 9.0, section New features Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenSSH: OpenSSH 9.0 release notes (Vendor release notes; published 2022-04-08; updated Not stated; retrieved 2026-10-22)
OpenSSH OpenSSH (OpenBSD project) · SSH implementation	OpenSSH 9.9 up to, not including, OpenSSH 10.0	SSH key exchange Client and server	Generally available	Vendor release date 2024-09-19 Release date of OpenSSH 9.9.	Evidence card Applies to, as the main document states OpenSSH 9.9 (Explicit scope of the main document) Algorithms mlkem768x25519-sha256 (SSH hybrid of ML-KEM-768 and X25519) Mode Hybrid (classical and post-quantum) Protocol SSH Enabled by default Yes Required patch None stated Configuration None stated Limitations Available and enabled, but not yet the preferred key exchange in 9.9. Evidence note (portal’s own words) OpenSSH 9.9 adds the hybrid ML-KEM-768 and X25519 key exchange and enables it by default. Locator OpenSSH 9.9, Changes since OpenSSH 9.8, New features Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenSSH: OpenSSH Release Notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
OpenSSH OpenSSH (OpenBSD project) · SSH implementation	OpenSSH 10.0 and later	SSH key exchange Client and server	Generally available	Vendor release date 2025-04-09 Release date of OpenSSH 10.0.	Evidence card Applies to, as the main document states OpenSSH 10.0 and later (Explicit scope of the main document) Algorithms mlkem768x25519-sha256 (SSH hybrid of ML-KEM-768 and X25519) Mode Hybrid (classical and post-quantum) Protocol SSH Enabled by default Yes Required patch None stated Configuration None stated Limitations The peer must offer the same method; otherwise an older key exchange is negotiated. Evidence note (portal’s own words) OpenSSH 10.0 makes the hybrid ML-KEM key exchange the default. Locator OpenSSH 10.0, Changes since OpenSSH 9.9, New features Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenSSH: OpenSSH Release Notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Google Chrome Google · Web browser	Chrome 124 up to, not including, Chrome 131	TLS key establishment Client	Generally available	No published date	Evidence card Applies to, as the main document states Chrome 124 on all desktop platforms (Explicit scope of the main document) Algorithms X25519Kyber768Draft00 (Pre-standard Kyber draft, now obsolete) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration An enterprise policy offers a temporary opt-out for middlebox problems. Limitations Desktop platforms only at the time; a pre-standard Kyber draft replaced in Chrome 131. Evidence note (portal’s own words) Chrome enabled the hybrid Kyber draft key agreement by default on desktop from version 124. The post gives no ship date for the release. Locator Opening paragraphs of the post Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Google (Chromium blog): Advancing Our Amazing Bet on Asymmetric Cryptography (Vendor announcement; published 2024-05-23; updated Not stated; retrieved 2026-10-22)
Google Chrome Google · Web browser	Chrome 131 and later	TLS key establishment Client	Generally available	No published date	Evidence card Applies to, as the main document states Chrome 131 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration None stated Limitations Kyber support is removed; a server that offers only the Kyber draft falls back to classical key exchange. Platform coverage beyond desktop is not stated by Google. Evidence note (portal’s own words) Google announced that Chrome 131 switches from Kyber to the final ML-KEM hybrid. Cloudflare documents it as enabled by default from Chrome 131; that is a third-party statement about Chrome. Locator Google post, list of Chrome 131 changes; Cloudflare support page, section Browsers (Chromium-based) Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Google Security Blog: A new path for Kyber on the web (Vendor announcement; published 2024-09-13; updated Not stated; retrieved 2026-10-22) Cloudflare: Post-quantum cryptography support (clients, libraries and servers) (Vendor documentation; published Not stated; updated 2026-06-24; retrieved 2026-10-22)
Mozilla Firefox Mozilla · Web browser	Firefox 132 and later	TLS key establishment Client	Generally available	Vendor release date 2024-10-29 Release date of Firefox 132.	Evidence card Applies to, as the main document states Firefox 132 desktop (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration None stated Limitations Desktop edition; HTTP/3 support came later and Android from version 145, according to Cloudflare. Evidence note (portal’s own words) Mozilla added a post-quantum key exchange for TLS 1.3 in Firefox 132. Its notes do not say it is on by default; Cloudflare documents it as default on desktop from 132. Locator Firefox 132 notes, section Web Platform; Cloudflare support page, section Browsers (Gecko-based) Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Mozilla: Firefox 132.0 release notes (Vendor release notes; published 2024-10-29; updated Not stated; retrieved 2026-10-22) Cloudflare: Post-quantum cryptography support (clients, libraries and servers) (Vendor documentation; published Not stated; updated 2026-06-24; retrieved 2026-10-22)
Cloudflare network Cloudflare · CDN and edge network	Current service (no versions)	TLS key establishment Edge to visitor	Generally available	No published date	Evidence card Applies to, as the main document states Cloudflare: all sites and APIs over TLS 1.3 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration None stated Limitations Post-quantum only when the visitor client supports the hybrid group; TLS 1.3 only. Evidence note (portal’s own words) Every TLS 1.3 zone offers hybrid ML-KEM key agreement to visitors; the Kyber draft codepoint is marked obsolete. Locator Three connections in the life of a request, 1. Visitor to Cloudflare Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Cloudflare: Post-quantum cryptography (PQC) (Vendor documentation; published Not stated; updated 2026-07-03; retrieved 2026-10-22)
Cloudflare network Cloudflare · CDN and edge network	Current service (no versions)	TLS key establishment Edge to origin	Generally available	No published date	Evidence card Applies to, as the main document states Cloudflare origin connections (origin pulls) (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration Cloudflare sends the hybrid key share first; an origin without it answers with a retry at the cost of one round trip. Limitations Post-quantum only when the origin server supports the hybrid group. Evidence note (portal’s own words) Automatic post-quantum key agreement to origins is on for existing and new zones and is preferred when the origin supports it. Locator Post-quantum key agreement, ClientHello from Cloudflare Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Cloudflare: Post-quantum between Cloudflare and origin servers (Vendor documentation; published Not stated; updated 2026-08-03; retrieved 2026-10-22)
Cloudflare network Cloudflare · CDN and edge network	Current service (no versions)	Certificate signatures Edge to visitor	Announced roadmap	No published date	Evidence card Applies to, as the main document states Cloudflare visitor-facing edge certificates (Explicit scope of the main document) Algorithms ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations Post-quantum authentication towards visitors is still under development, with no date. Evidence note (portal’s own words) Visitor-facing post-quantum certificates are not yet available; ML-DSA is used only between Cloudflare and origins. Locator Three building blocks of TLS, Post-quantum signatures Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2026-12-22 Sources Cloudflare: Post-quantum cryptography (PQC) (Vendor documentation; published Not stated; updated 2026-07-03; retrieved 2026-10-22)
Cloudflare network Cloudflare · CDN and edge network	Current service (no versions)	Certificate signatures Edge to origin	Generally available	Vendor release date 2026 Stated as mid-2026, without a day.	Evidence card Applies to, as the main document states Cloudflare origin connections, available since mid-2026 (Explicit scope of the main document) Algorithms ML-DSA (parameter set not stated) (NIST FIPS 204), ML-DSA-44 (NIST FIPS 204) Mode Pure post-quantum Protocol TLS 1.3 Enabled by default No Required patch None stated Configuration Authenticated Origin Pulls with an ML-DSA client certificate, or a custom origin trust store with an ML-DSA CA under Full (strict). Limitations Needs OpenSSL 3.5.0 or later and TLS 1.3 at the origin; a custom trust store replaces the public CAs. Cloudflare Tunnel does not yet use post-quantum signatures. Evidence note (portal’s own words) ML-DSA can authenticate both directions between Cloudflare and an origin through mutual TLS and custom trust stores. Locator Post-quantum signatures, Requirements Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Cloudflare: Post-quantum between Cloudflare and origin servers (Vendor documentation; published Not stated; updated 2026-08-03; retrieved 2026-10-22)
AWS Key Management Service Amazon Web Services · Cloud key management	Current service (no versions)	Cloud-managed keys Signing and verification	Generally available	No published date	Evidence card Applies to, as the main document states AWS KMS key specs ML_DSA_44, ML_DSA_65 and ML_DSA_87 (Explicit scope of the main document) Algorithms ML-DSA-44 (NIST FIPS 204), ML-DSA-65 (NIST FIPS 204), ML-DSA-87 (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration Create keys with the ML_DSA_44, ML_DSA_65 or ML_DSA_87 key spec and use Sign and Verify. Limitations Signing keys only; no ML-KEM key spec is listed. Regional availability must be checked. Evidence note (portal’s own words) AWS KMS offers three ML-DSA asymmetric signing key specs. The reviewed page gives no launch date. Locator Section ML-DSA key specs Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources AWS: Key spec reference - AWS Key Management Service (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
AWS Key Management Service Amazon Web Services · Cloud key management	Current service (no versions)	TLS key establishment Server	Generally available	Vendor release date 2025-04-07 Date of the AWS announcement.	Evidence card Applies to, as the main document states AWS KMS, ACM and Secrets Manager non-FIPS endpoints (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch On the client: an SDK and HTTP client that offer the hybrid group, for example the Java SDK v2 with the AWS CRT HTTP client and post-quantum TLS switched on. Configuration None stated Limitations Non-FIPS endpoints of KMS, ACM and Secrets Manager; FIPS endpoints are excluded. Clients must opt in or upgrade. Evidence note (portal’s own words) The service endpoints choose hybrid ML-KEM when the client offers it; the server side is on, the client side needs configuration. Locator Sections How to use hybrid post-quantum key agreement, and Removing support for draft post-quantum standards Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources AWS Security Blog: ML-KEM post-quantum TLS now supported in AWS KMS, ACM, and Secrets Manager (Vendor announcement; published 2025-04-07; updated Not stated; retrieved 2026-10-22)
Azure Key Vault Microsoft · Cloud key management	Current service (no versions)	Cloud-managed keys Signing and verification	No verified information	No published date	Evidence card Applies to, as the main document states Azure Key Vault (vaults) (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The key types listed are RSA, EC and symmetric keys; no ML-DSA or ML-KEM key type is documented. The page discusses quantum resistance only for 256-bit AES keys. Locator Sections Key types and protection methods, and Quantum-resistant, quantum-safe, or post-quantum cryptography Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Microsoft Learn: About keys - Azure Key Vault (Vendor documentation; published Not stated; updated 2026-10-06; retrieved 2026-10-22)
strongSwan strongSwan project · VPN	strongSwan 6.0.0 and later	VPN / IPsec key exchange Key establishment	Generally available	Vendor release date 2024-12-03 Release date of strongSwan 6.0.0.	Evidence card Applies to, as the main document states strongSwan 6.0.0 (Explicit scope of the main document) Algorithms ML-KEM-512 (NIST FIPS 203), ML-KEM-768 (NIST FIPS 203), ML-KEM-1024 (NIST FIPS 203) Mode Pure and hybrid Protocol IKEv2 (RFC 9370 multiple key exchanges) Enabled by default No Required patch None stated Configuration Add the additional key exchanges to the proposals with keX_ prefixes, for example x25519-ke1_mlkem768. Limitations Needs a plugin that provides ML-KEM: the ml plugin, botan, wolfssl, or openssl built against a library with ML-KEM. Evidence note (portal’s own words) strongSwan 6.0.0 can use ML-KEM in IKEv2, alone or after a classical exchange, once configured in the proposals. Locator Sections Support for Multiple Key Exchanges (RFC 9370 and RFC 9242) and Support for ML-KEM (FIPS 203) Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources strongSwan: strongSwan 6.0.0 Released (Vendor release notes; published 2024-12-03; updated Not stated; retrieved 2026-10-22)
strongSwan strongSwan project · VPN	strongSwan 6.0.2 and later	VPN / IPsec key exchange Key establishment	Generally available	Vendor release date 2025-07-14 Release date of strongSwan 6.0.2.	Evidence card Applies to, as the main document states strongSwan 6.0.2 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203) Mode Pure and hybrid Protocol IKEv2 Enabled by default No Required patch OpenSSL 3.5 or later underneath the openssl plugin. Configuration None stated Limitations None stated Evidence note (portal’s own words) From 6.0.2, mainline OpenSSL 3.5 or later can provide ML-KEM to the openssl plugin. Locator Section Other Notable Features and Fixes Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources strongSwan: strongSwan 6.0.2 Released (Vendor release notes; published 2025-07-14; updated Not stated; retrieved 2026-10-22)
WireGuard protocol WireGuard project · VPN	Current service (no versions)	VPN / IPsec key exchange Key establishment	Explicitly unsupported for this scope	No published date	Evidence card Applies to, as the main document states WireGuard protocol (Explicit scope of the main document) Algorithms None stated Mode Not applicable Protocol WireGuard (Noise IKpsk2) Enabled by default No Required patch None stated Configuration An optional pre-shared symmetric key can be mixed into the handshake. Limitations The protocol has no ML-KEM or other post-quantum key encapsulation; the optional pre-shared key adds a symmetric layer only. Evidence note (portal’s own words) WireGuard names post-quantum resistance as one reason to use its optional pre-shared key; the protocol itself has no post-quantum key exchange. Locator Protocol page, Key Exchange and Data Packets; whitepaper section 5.2 Optional Pre-shared Symmetric Key Mode Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources WireGuard: Protocol and Cryptography (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22) WireGuard (Jason A. Donenfeld): WireGuard: Next Generation Kernel Network Tunnel (Project specification; published 2020-06-01; updated Not stated; retrieved 2026-10-22)
Thales Luna Network HSM 7 Thales · Hardware security module	Luna HSM Firmware 7.9.0 and later	HSM key storage and operations Key storage and operations	Generally available	Vendor release date 2025-07 Month stated on the release notes.	Evidence card Applies to, as the main document states Luna HSM Firmware 7.9.0 (Luna Network HSM 7) (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure and hybrid Protocol PKCS#11 Enabled by default Not stated Required patch Luna HSM Client 10.9.0 or newer and Appliance Software 7.9.0. Configuration None stated Limitations In 7.9.0, ML-DSA and ML-KEM keys cannot be wrapped off the HSM (added in 7.9.1). The page does not state FIPS validation for this firmware. Evidence note (portal’s own words) Firmware 7.9.0 adds PKCS#11 ML-KEM and ML-DSA mechanisms and hybrid ciphers for cloning. Locator New Features and Enhancements, ML-KEM and ML-DSA Mechanisms; Advisory Notes, keys not wrappable Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Thales: Luna HSM Firmware 7.9.0 (Vendor release notes; published 2025-07; updated Not stated; retrieved 2026-10-22)
Thales Luna Network HSM 7 Thales · Hardware security module	Luna HSM Firmware 7.9.2 and later	HSM key storage and operations Key storage and operations	Generally available	Vendor release date 2026-02 Month stated on the release notes.	Evidence card Applies to, as the main document states Luna HSM Firmware 7.9.2 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204), HSS/LMS (NIST SP 800-208) Mode Pure post-quantum Protocol PKCS#11 Enabled by default Not stated Required patch None stated Configuration None stated Limitations HSS/LMS private keys cannot be cloned or backed up. Thales calls 7.9.2 a candidate for FIPS 140 certification, so it was not certified when published. Evidence note (portal’s own words) Firmware 7.9.2 adds HSS/LMS stateful signatures alongside ML-KEM and ML-DSA. Locator Introduction; Advisory Notes Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Thales: Luna HSM Firmware 7.9.2 (Vendor release notes; published 2026-02; updated Not stated; retrieved 2026-10-22)
OpenJDK (Java SE) OpenJDK project · Language runtime and standard library	JDK 24 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2025-03-18 General availability of JDK 24 (project page schedule).	Evidence card Applies to, as the main document states JDK 24 (Explicit scope of the main document) Algorithms ML-KEM-512 (NIST FIPS 203), ML-KEM-768 (NIST FIPS 203), ML-KEM-1024 (NIST FIPS 203) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration KeyPairGenerator, KEM and KeyFactory APIs and keytool; ML-KEM-768 is the default parameter set. Limitations Not integrated into TLS in JDK 24. Evidence note (portal’s own words) JEP 496 delivers ML-KEM as a Java API in JDK 24, without TLS integration. Locator JEP 496, Status and Release header; Non-Goals Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenJDK: JEP 496: Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism (Project specification; published 2024-08-26; updated 2025-03-13; retrieved 2026-10-22) OpenJDK: JDK 24 project page (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
OpenJDK (Java SE) OpenJDK project · Language runtime and standard library	JDK 24 and later	Algorithms in the cryptographic API Signing and verification	Generally available	Vendor release date 2025-03-18 General availability of JDK 24 (project page schedule).	Evidence card Applies to, as the main document states JDK 24 (Explicit scope of the main document) Algorithms ML-DSA-44 (NIST FIPS 204), ML-DSA-65 (NIST FIPS 204), ML-DSA-87 (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration KeyPairGenerator, Signature and KeyFactory APIs and keytool; ML-DSA-65 is the default. Limitations Not used in TLS or JAR signing in JDK 24. Evidence note (portal’s own words) JEP 497 delivers ML-DSA signatures as a Java API in JDK 24. Locator JEP 497, Status and Release header; Non-Goals Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenJDK: JEP 497: Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm (Project specification; published 2024-08-26; updated 2025-11-03; retrieved 2026-10-22) OpenJDK: JDK 24 project page (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
OpenJDK (Java SE) OpenJDK project · Language runtime and standard library	JDK 24 up to, not including, JDK 27	TLS key establishment Client and server	Explicitly unsupported for this scope	No published date	Evidence card Applies to, as the main document states JDK 24 (JEP 496 non-goal) (Explicit scope of the main document) Algorithms None stated Mode Not applicable Protocol TLS 1.3 Enabled by default Not stated Required patch None stated Configuration None stated Limitations Applies to the JDK TLS implementation; third-party providers are outside this scope. Evidence note (portal’s own words) JEP 496 states that integrating ML-KEM into the JDK TLS implementation is not a goal of that release. Locator JEP 496, Non-Goals Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenJDK: JEP 496: Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism (Project specification; published 2024-08-26; updated 2025-03-13; retrieved 2026-10-22)
OpenJDK (Java SE) OpenJDK project · Language runtime and standard library	JDK 27 and later	TLS key establishment Client and server	Generally available	Vendor release date 2026-09-15 General availability of JDK 27 (project page schedule).	Evidence card Applies to, as the main document states JDK 27 (JEP 527) (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP256r1MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP384r1MLKEM1024 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration X25519MLKEM768 is first in the default named groups; change them with jdk.tls.namedGroups or SSLParameters. Limitations Only X25519MLKEM768 is on by default; the two SecP hybrids must be enabled. Evidence note (portal’s own words) JEP 527 delivers hybrid ML-KEM key exchange for TLS 1.3 in JDK 27; clients offer X25519MLKEM768 by default. Locator JEP 527, Description, and Using hybrid key exchange schemes Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources OpenJDK: JEP 527: Post-Quantum Hybrid Key Exchange for TLS 1.3 (Project specification; published 2025-06-03; updated 2026-08-17; retrieved 2026-10-22) OpenJDK: JDK 27 project page (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
.NET Microsoft · Language runtime and standard library	.NET 10 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2025-11-11 Release date of .NET 10 (support policy page).	Evidence card Applies to, as the main document states .NET 10 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration Check the IsSupported property at run time. Limitations Needs OpenSSL 3.5 or newer on Linux, or Windows CNG with PQC support; some methods remain experimental. Evidence note (portal’s own words) .NET 10 adds an MLKem type whose core API is not marked experimental; it uses the platform cryptography underneath. Locator Section Cryptography, Post-quantum cryptography (PQC) Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Microsoft Learn: What's new in .NET libraries for .NET 10 (Vendor documentation; published 2025-11-07; updated 2026-03-30; retrieved 2026-10-22) Microsoft (.NET): .NET and .NET Core Support Policy (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
.NET Microsoft · Language runtime and standard library	.NET 10 and later	Code and document signing Signing and verification	Preview	No published date	Evidence card Applies to, as the main document states .NET 10 (Explicit scope of the main document) Algorithms ML-DSA (parameter set not stated) (NIST FIPS 204), SLH-DSA (NIST FIPS 205), HashML-DSA (NIST FIPS 204), Composite ML-DSA (IETF LAMPS draft) Mode Pure and hybrid Protocol None stated Enabled by default Not stated Required patch None stated Configuration The types are marked experimental (diagnostic SYSLIB5006) and must be opted into. Limitations Experimental APIs inside a supported release; composite ML-DSA tracks an IETF draft and only RSA variants are implemented. Evidence note (portal’s own words) .NET 10 ships ML-DSA, SLH-DSA and composite ML-DSA types as experimental APIs. Locator Section Cryptography, subsections ML-DSA and Composite ML-DSA Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Microsoft Learn: What's new in .NET libraries for .NET 10 (Vendor documentation; published 2025-11-07; updated 2026-03-30; retrieved 2026-10-22)
.NET Microsoft · Language runtime and standard library	.NET 9 up to, not including, .NET 10	Algorithms in the cryptographic API Library API	No verified information	No published date	Evidence card Applies to, as the main document states .NET 9 (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The .NET 9 library release notes say nothing about post-quantum algorithms. Locator Whole page; no mention of ML-KEM, ML-DSA, SLH-DSA or post-quantum cryptography Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Microsoft Learn: What's new in .NET libraries for .NET 9 (Vendor documentation; published 2024-11-11; updated 2026-06-18; retrieved 2026-10-22)
Go (crypto/tls and crypto packages) The Go project · Language runtime and standard library	Go 1.23 up to, not including, Go 1.24	TLS key establishment Client and server	Generally available	Vendor release date 2024-08-13 Release date of Go 1.23 (release history).	Evidence card Applies to, as the main document states Go 1.23 (Explicit scope of the main document) Algorithms X25519Kyber768Draft00 (Pre-standard Kyber draft, now obsolete) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration Default when Config.CurvePreferences is not set; GODEBUG tlskyber=0 reverts it. Limitations A pre-standard Kyber draft, removed in Go 1.24. Evidence note (portal’s own words) Go 1.23 enables the hybrid Kyber draft by default in crypto/tls. Locator Minor changes to the library, crypto/tls Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources The Go Project: Go 1.23 Release Notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) The Go Project: Release History (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
Go (crypto/tls and crypto packages) The Go project · Language runtime and standard library	Go 1.24 and later	TLS key establishment Client and server	Generally available	Vendor release date 2025-02-11 Release date of Go 1.24 (release history).	Evidence card Applies to, as the main document states Go 1.24 and later (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration Default when Config.CurvePreferences is not set; GODEBUG tlsmlkem=0 reverts it. Limitations X25519Kyber768Draft00 is removed. Evidence note (portal’s own words) Go 1.24 makes the hybrid X25519MLKEM768 key exchange the default in crypto/tls. Locator Minor changes to the library, crypto/tls Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources The Go Project: Go 1.24 Release Notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) The Go Project: Release History (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
Go (crypto/tls and crypto packages) The Go project · Language runtime and standard library	Go 1.24 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2025-02-11 Release date of Go 1.24 (release history).	Evidence card Applies to, as the main document states Go 1.24 and later (Explicit scope of the main document) Algorithms ML-KEM-768 (NIST FIPS 203), ML-KEM-1024 (NIST FIPS 203) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) Go 1.24 adds a crypto/mlkem package with ML-KEM-768 and ML-KEM-1024. Locator New crypto/mlkem package Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources The Go Project: Go 1.24 Release Notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Go (crypto/tls and crypto packages) The Go project · Language runtime and standard library	Go 1.26 and later	TLS key establishment Client and server	Generally available	Vendor release date 2026-02-10 Release date of Go 1.26.	Evidence card Applies to, as the main document states Go 1.26 and later (Explicit scope of the main document) Algorithms SecP256r1MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP384r1MLKEM1024 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration Disable with Config.CurvePreferences or GODEBUG tlssecpmlkem=0. Limitations None stated Evidence note (portal’s own words) Go 1.26 adds the NIST-curve hybrid ML-KEM groups to the TLS defaults. Locator Section crypto/tls Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources The Go Project: Go 1.26 Release Notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Go (crypto/tls and crypto packages) The Go project · Language runtime and standard library	Go 1.27 and later	Algorithms in the cryptographic API Signing and verification	Generally available	Vendor release date 2026-08-19 Release date of Go 1.27.	Evidence card Applies to, as the main document states Go 1.27 and later (Explicit scope of the main document) Algorithms ML-DSA-44 (NIST FIPS 204), ML-DSA-65 (NIST FIPS 204), ML-DSA-87 (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations No SLH-DSA. Whether the new ML-DSA TLS signature schemes are on by default is not stated. Evidence note (portal’s own words) Go 1.27 adds a crypto/mldsa package, ML-DSA in crypto/x509 and TLS 1.3 ML-DSA signature schemes. Locator New crypto/mldsa package; crypto/tls Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources The Go Project: Go 1.27 Release Notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Let's Encrypt certificate authority Internet Security Research Group (Let's Encrypt) · Public PKI and certificate authorities	Current service (no versions)	PKI / CA certificate issuance Certificate authority issuance	Announced roadmap	Vendor roadmap target (not a release) 2027 Production targeted for 2027, as stated; a target, not a release.	Evidence card Applies to, as the main document states Let's Encrypt (roadmap) (Explicit scope of the main document) Algorithms None stated Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations The plan is Merkle Tree Certificates rather than plain ML-DSA certificates; it depends on IETF work, root programs and client support. Nothing changes for current issuance. Evidence note (portal’s own words) Let's Encrypt plans post-quantum certificates through Merkle Tree Certificates, with a staging environment targeted for late 2026 and production for 2027. Locator Article body, timeline paragraph Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2026-12-22 Sources Let's Encrypt: A Post-Quantum Future for Let's Encrypt (Vendor announcement; published 2026-06-03; updated Not stated; retrieved 2026-10-22)
Let's Encrypt certificate authority Internet Security Research Group (Let's Encrypt) · Public PKI and certificate authorities	Current service (no versions)	Certificate signatures Certificate authority issuance	Explicitly unsupported for this scope	No published date	Evidence card Applies to, as the main document states Publicly trusted TLS server certificates, including those of Let's Encrypt (Explicit scope of the main document) Algorithms None stated Mode Not applicable Protocol X.509 publicly trusted TLS server certificates Enabled by default Not stated Required patch None stated Configuration None stated Limitations Applies to publicly trusted TLS server certificates under the Baseline Requirements; internal PKI and S/MIME certificates follow other rules. Evidence note (portal’s own words) The current TLS Baseline Requirements allow only RSA and ECDSA keys and signatures, so publicly trusted TLS certificates with ML-DSA cannot be issued today; Let's Encrypt says current issuance is unchanged. Locator Baseline Requirements v2.3.1, sections 6.1.5 Key sizes, 7.1.3.1 and 7.1.3.2 Review Reviewed against the source; Claude builder and helper agents (AI), pilot research; not an independent human review, 2026-10-22; next review 2026-12-22 Sources CA/Browser Forum: Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates (Standard; published Not stated; updated Not stated; retrieved 2026-10-22) Let's Encrypt: A Post-Quantum Future for Let's Encrypt (Vendor announcement; published 2026-06-03; updated Not stated; retrieved 2026-10-22)
Botan Botan project · Cryptographic library	Botan 3.6.0 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2024-10-21 Release date of Botan 3.6.0 on the release notes.	Evidence card Applies to, as the main document states Botan 3.6.0 and later (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204), SLH-DSA (NIST FIPS 205) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations The entry names the standards, not the parameter sets. Evidence note (portal’s own words) Botan 3.6.0 adds the final FIPS 203, FIPS 204 and FIPS 205 algorithms ML-KEM, ML-DSA and SLH-DSA. Locator Version 3.6.0, 2024-10-21, first three entries Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Botan: Release Notes - Botan (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Botan Botan project · Cryptographic library	Botan 3.7.0 and later	TLS key establishment Client and server	Generally available	Vendor release date 2025-02-04 Release date of Botan 3.7.0 on the release notes.	Evidence card Applies to, as the main document states Botan 3.7.0 and later (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), ML-KEM (parameter set not stated) (NIST FIPS 203) Mode Pure and hybrid Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration None stated Limitations Pre-standard Kyber round 3 TLS suites are removed in this release, so peers that offer only the Kyber draft fall back to classical key exchange. Evidence note (portal’s own words) Botan 3.7.0 turns on hybrid X25519 with ML-KEM-768 by default for TLS clients and servers and adds pure ML-KEM key exchange. Locator Version 3.7.0, 2025-02-04, TLS entries Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Botan: Release Notes - Botan (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Apple iOS and iPadOS Apple · Operating system	iOS 26 and later	TLS key establishment Client	Generally available	No published date	Evidence card Applies to, as the main document states iOS 26, iPadOS 26, macOS Tahoe 26 and visionOS 26 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration None stated Limitations Only for connections made through the system TLS stack. Some legacy servers that cannot read a large ClientHello may fail to connect. Evidence note (portal’s own words) Devices on iOS 26 and iPadOS 26 offer the X25519MLKEM768 hybrid group in the TLS 1.3 ClientHello automatically; the server decides whether to use it. Locator Introduction (first two paragraphs) and section Troubleshoot connection issues Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Apple Support: Prepare your network for quantum-secure encryption in TLS (Vendor documentation; published 2026-06-18; updated Not stated; retrieved 2026-10-22)
Apple macOS Apple · Operating system	macOS Tahoe 26 and later	TLS key establishment Client	Generally available	No published date	Evidence card Applies to, as the main document states iOS 26, iPadOS 26, macOS Tahoe 26 and visionOS 26 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration nscurl with the TLS diagnostics option, available from macOS Tahoe 26, shows whether a server negotiates the group. Limitations Only for connections made through the system TLS stack. Some legacy servers that cannot read a large ClientHello may fail to connect. Evidence note (portal’s own words) macOS Tahoe 26 offers the X25519MLKEM768 hybrid group in the TLS 1.3 ClientHello automatically and provides a command to test servers. Locator Introduction (first two paragraphs) and section Check if a web server supports quantum-secure encryption Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Apple Support: Prepare your network for quantum-secure encryption in TLS (Vendor documentation; published 2026-06-18; updated Not stated; retrieved 2026-10-22)
Rosenpass Rosenpass project · VPN	Current service (no versions)	VPN / IPsec key exchange Key establishment	Generally available	No published date	Evidence card Applies to, as the main document states Rosenpass (project home page) (Explicit scope of the main document) Algorithms Classic McEliece (NIST round 4 candidate, not a NIST standard), Kyber (round 3, pre-standard) (Pre-standard Kyber submission, superseded by ML-KEM) Mode Hybrid (classical and post-quantum) Protocol Rosenpass key exchange feeding the WireGuard pre-shared key Enabled by default Not stated Required patch None stated Configuration Run Rosenpass next to WireGuard on both peers so that it supplies the WireGuard pre-shared key. Limitations The page names Kyber, not ML-KEM, and no parameter sets. Classic McEliece is not a NIST standard. The page ties the capability to no release. Evidence note (portal’s own words) Rosenpass adds a post-quantum key exchange based on Classic McEliece and Kyber on top of WireGuard, which keeps its classical handshake. Locator Sections Post-Quantum Secure, Works with WireGuard and What is Rosenpass? Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Rosenpass: Rosenpass (Project specification; published Not stated; updated Not stated; retrieved 2026-10-22)
wolfSSL wolfSSL · Cryptographic library	wolfSSL 5.7.4 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2024-10-24 Release date of wolfSSL 5.7.4 in the change log.	Evidence card Applies to, as the main document states wolfSSL 5.7.4 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration Build wolfSSL with its post-quantum options; in this release the code still uses the Kyber and Dilithium names. Limitations The entry names the final specifications, not the parameter sets. Evidence note (portal’s own words) wolfSSL 5.7.4 updates its Kyber and Dilithium code to the final ML-KEM and ML-DSA specifications. Locator wolfSSL Release 5.7.4 (Oct 24, 2024), entries Dilithium, Kyber: Update to final specification Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources wolfSSL (GitHub): wolfSSL ChangeLog.md (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
wolfSSL wolfSSL · Cryptographic library	wolfSSL 5.9.1 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2026-04-08 Release date of wolfSSL 5.9.1 in the change log.	Evidence card Applies to, as the main document states wolfSSL 5.9.1 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203) Mode Pure post-quantum Protocol None stated Enabled by default Yes Required patch None stated Configuration None stated Limitations Default of the build configuration; a product that embeds wolfSSL may build it differently. Evidence note (portal’s own words) From wolfSSL 5.9.1, ML-KEM (FIPS 203) is built in by default. Locator wolfSSL Release 5.9.1 (Apr. 8, 2026), New Features, first entry Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources wolfSSL (GitHub): wolfSSL ChangeLog.md (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
liboqs (Open Quantum Safe) Open Quantum Safe project · Cryptographic library	liboqs 0.11.0 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2024-09-26 Release date of liboqs 0.11.0 stated in its release notes.	Evidence card Applies to, as the main document states liboqs 0.11.0 (Explicit scope of the main document) Algorithms ML-KEM-512 (NIST FIPS 203), ML-KEM-768 (NIST FIPS 203), ML-KEM-1024 (NIST FIPS 203) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations The project does not recommend the library for production use or to protect sensitive data; it is meant for research and prototyping. Evidence note (portal’s own words) liboqs 0.11.0 updates ML-KEM-512, ML-KEM-768 and ML-KEM-1024 to the final FIPS 203 version. Locator Release notes 0.11.0, introduction and KEM entries; README, Limitations and Security Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Open Quantum Safe (GitHub): Release liboqs version 0.11.0 (Vendor release notes; published 2024-09-26; updated Not stated; retrieved 2026-10-22) Open Quantum Safe (GitHub): liboqs: C library for prototyping and experimenting with quantum-resistant cryptography (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
liboqs (Open Quantum Safe) Open Quantum Safe project · Cryptographic library	liboqs 0.12.0 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2024-12-09 Release date of liboqs 0.12.0 stated in its release notes.	Evidence card Applies to, as the main document states liboqs 0.12.0 (Explicit scope of the main document) Algorithms ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations The project does not recommend the library for production use or to protect sensitive data. The ML-DSA API with a context string is new in this release. Evidence note (portal’s own words) liboqs 0.12.0 replaces the draft ML-DSA with the final FIPS 204 version; it is the last release with round 3 Kyber. Locator Release notes 0.12.0, introduction and signature entries; README, Limitations and Security Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Open Quantum Safe (GitHub): Release liboqs version 0.12.0 (Vendor release notes; published 2024-12-09; updated Not stated; retrieved 2026-10-22) Open Quantum Safe (GitHub): liboqs: C library for prototyping and experimenting with quantum-resistant cryptography (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
Bouncy Castle for Java Legion of the Bouncy Castle · Cryptographic library	Bouncy Castle Java 1.79 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2024-10-31 Date of the Bouncy Castle post announcing the 1.79 release.	Evidence card Applies to, as the main document states Bouncy Castle Java 1.79 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204), SLH-DSA (NIST FIPS 205) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations Composite signatures in this release follow drafts that are not final. Evidence note (portal’s own words) Bouncy Castle Java 1.79 supports the final ML-KEM, ML-DSA and SLH-DSA standards, including KEMs in CMS. Locator Article body, first paragraphs and the composite signatures paragraph Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Bouncy Castle: Latest NIST PQC Standards and more - Bouncy Castle Java 1.79 (Vendor announcement; published 2024-10-31; updated 2024-12-06; retrieved 2026-10-22)
GnuTLS GnuTLS project · Cryptographic library	GnuTLS 3.8.8 and later	TLS key establishment Client and server	Preview	Vendor preview date 2024-11-05 Release date of GnuTLS 3.8.8 in NEWS; the feature is experimental.	Evidence card Applies to, as the main document states GnuTLS 3.8.8 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP256r1MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Not stated Required patch None stated Configuration Build GnuTLS with a post-quantum backend (liboqs 0.11.0 or later in this release). Limitations Marked experimental by the project. Evidence note (portal’s own words) GnuTLS 3.8.8 adds experimental X25519MLKEM768 and SecP256r1MLKEM768 key exchange for TLS 1.3. Locator NEWS, Version 3.8.8 (released 2024-11-05), first entry Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources GnuTLS (GitLab): GnuTLS NEWS (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
GnuTLS GnuTLS project · Cryptographic library	GnuTLS 3.8.9 and later	Algorithms in the cryptographic API Library API	Preview	Vendor preview date 2025-02-07 Release date of GnuTLS 3.8.9 in NEWS; the feature is experimental.	Evidence card Applies to, as the main document states GnuTLS 3.8.9 (Explicit scope of the main document) Algorithms ML-DSA-44 (NIST FIPS 204), ML-DSA-65 (NIST FIPS 204), ML-DSA-87 (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration Build GnuTLS with leancrypto or liboqs. Limitations Marked experimental and based on an early draft of the ML-DSA certificate format. Evidence note (portal’s own words) GnuTLS 3.8.9 and certtool add experimental ML-DSA signatures. Locator NEWS, Version 3.8.9 (released 2025-02-07), ML-DSA entry Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources GnuTLS (GitLab): GnuTLS NEWS (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Entrust nShield HSM (Security World) Entrust · Hardware security module	Security World 13.9.0 and later	HSM key storage and operations Key storage and operations	Generally available	Vendor release date 2025-08-22 Release date of Security World 13.9.0 in the release notes.	Evidence card Applies to, as the main document states nShield Security World 13.9.0 (Security World 13.9.0 STS release) (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), SLH-DSA (NIST FIPS 205) Mode Pure post-quantum Protocol nCore API Enabled by default Not stated Required patch None stated Configuration None stated Limitations Only through the nCore API. Security World 13.9 is a Standard-Term Support release; the vendor recommends the 13.6 Long-Term Support release for certified firmware. Evidence note (portal’s own words) Security World 13.9 adds ML-KEM key generation, encapsulation and decapsulation and SLH-DSA signing in HSM firmware. Locator Features of Security World v13.9, NSE-48335 and NSE-48338; Purpose of Security World v13.9 Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Entrust nShield Docs: nShield Security World v13.9.0 Release Notes (Vendor release notes; published 2025-08-22; updated 2026-09-14; retrieved 2026-10-22)
Entrust nShield HSM (Security World) Entrust · Hardware security module	Security World 13.9.0 and later	HSM key storage and operations Key storage and operations	Generally available	Vendor release date 2025-08-22 Release date of Security World 13.9.0 in the release notes.	Evidence card Applies to, as the main document states nShield Security World 13.9.0 (Security World 13.9.0 STS release) (Explicit scope of the main document) Algorithms ML-DSA-44 (NIST FIPS 204), ML-DSA-65 (NIST FIPS 204), ML-DSA-87 (NIST FIPS 204), HashML-DSA (NIST FIPS 204) Mode Pure post-quantum Protocol PKCS#11 Enabled by default No Required patch HSM firmware v13.8 or later with the PostQuantum feature enabled. Configuration None stated Limitations Security World 13.9 is a Standard-Term Support release with a shorter support period. Evidence note (portal’s own words) Security World 13.9 adds ML-DSA key generation, signing and verification, including pre-hash ML-DSA, to the nShield PKCS#11 library. Locator Features of Security World v13.9, NSE-63240 and NSE-69041 Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Entrust nShield Docs: nShield Security World v13.9.0 Release Notes (Vendor release notes; published 2025-08-22; updated 2026-09-14; retrieved 2026-10-22)
Utimaco u.trust General Purpose HSM Se-Series Utimaco · Hardware security module	Current service (no versions)	HSM key storage and operations Key storage and operations	Generally available	Vendor release date 2025-04-02 Launch date in the press release dateline.	Evidence card Applies to, as the main document states u.trust GP HSM Se-Series with Quantum Protect (Utimaco u.trust General Purpose HSM Se-Series) (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204), HSS/LMS (NIST SP 800-208), XMSS and XMSS^MT (IETF RFC 8391 and NIST SP 800-208) Mode Pure post-quantum Protocol PKCS#11 Enabled by default No Required patch None stated Configuration Activate the Quantum Protect application package on the HSM in the field. Limitations An application package on the Se-Series; the announcement names no firmware version and no certification for these algorithms. Evidence note (portal’s own words) Utimaco offers ML-KEM, ML-DSA, LMS and XMSS with stateful key management on its Se-Series HSMs through the Quantum Protect package. Locator Press release body, list of features and paragraph on in-field activation Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Utimaco: Utimaco launches Quantum Protect solution and free PQC simulator (Vendor announcement; published 2025-04-02; updated Not stated; retrieved 2026-10-22)
Utimaco u.trust General Purpose HSM Se-Series Utimaco · Hardware security module	Current service (no versions)	HSM key storage and operations Key storage and operations	Announced roadmap	No published date	Evidence card Applies to, as the main document states u.trust GP HSM Se-Series with Quantum Protect (Utimaco u.trust General Purpose HSM Se-Series) (Explicit scope of the main document) Algorithms SLH-DSA (NIST FIPS 205) Mode Pure post-quantum Protocol PKCS#11 Enabled by default Not stated Required patch None stated Configuration None stated Limitations No date is given for the roadmap. Evidence note (portal’s own words) Utimaco names SLH-DSA among further post-quantum algorithms on the roadmap for Quantum Protect. Locator Press release body, paragraph on in-field activation and roadmap Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Utimaco: Utimaco launches Quantum Protect solution and free PQC simulator (Vendor announcement; published 2025-04-02; updated Not stated; retrieved 2026-10-22)
Google Cloud Key Management Service Google · Cloud key management	Current service (no versions)	Cloud-managed keys Signing and verification	Generally available	No published date	Evidence card Applies to, as the main document states Google Cloud KMS ASYMMETRIC_SIGN keys, software protection level (Explicit scope of the main document) Algorithms ML-DSA-44 (NIST FIPS 204), ML-DSA-65 (NIST FIPS 204), ML-DSA-87 (NIST FIPS 204), SLH-DSA (NIST FIPS 205) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration Create an ASYMMETRIC_SIGN key with a PQ_SIGN_ algorithm. Limitations Software protection level only; the HSM, single-tenant HSM and external tables list no post-quantum signing algorithm. SLH-DSA only in the SHA2-128s parameter set. Evidence note (portal’s own words) Cloud KMS offers ML-DSA-44, ML-DSA-65 and ML-DSA-87 (pure and external mu) and SLH-DSA-SHA2-128s signing keys. Locator Section Asymmetric signing algorithms, subsection PQC signing algorithms Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Google Cloud Documentation: Key purposes and algorithms - Cloud Key Management Service (Vendor documentation; published Not stated; updated 2026-10-13; retrieved 2026-10-22)
Google Cloud Key Management Service Google · Cloud key management	Current service (no versions)	Cloud-managed keys Key establishment	Generally available	No published date	Evidence card Applies to, as the main document states Google Cloud KMS KEY_ENCAPSULATION keys, software protection level (Explicit scope of the main document) Algorithms ML-KEM-768 (NIST FIPS 203), ML-KEM-1024 (NIST FIPS 203), X-Wing (ML-KEM-768 with X25519) (IETF CFRG X-Wing draft) Mode Pure and hybrid Protocol None stated Enabled by default Not stated Required patch None stated Configuration Create a KEY_ENCAPSULATION key with ML_KEM_768, ML_KEM_1024 or KEM_XWING. Limitations Software protection level only; the HSM and external tables list no key encapsulation algorithm. X-Wing is a draft. Evidence note (portal’s own words) Cloud KMS offers key encapsulation keys with ML-KEM-768, ML-KEM-1024 and the X-Wing hybrid. Locator Section Key encapsulation algorithms Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Google Cloud Documentation: Key purposes and algorithms - Cloud Key Management Service (Vendor documentation; published Not stated; updated 2026-10-13; retrieved 2026-10-22)
Fortinet FortiOS (FortiGate) Fortinet · VPN	FortiOS 7.6.5 and later	VPN / IPsec key exchange Key establishment	Generally available	No published date	Evidence card Applies to, as the main document states FortiOS 7.6.5 (administration guide) (Explicit scope of the main document) Algorithms ML-KEM-512 (NIST FIPS 203), ML-KEM-768 (NIST FIPS 203), ML-KEM-1024 (NIST FIPS 203) Mode Hybrid (classical and post-quantum) Protocol IKEv2 additional key exchanges Enabled by default Not stated Required patch None stated Configuration Set addke1 to addke7 on the phase 1 and phase 2 interfaces (or Post Quantum Cryptography Additional Key Exchanges in the GUI). Limitations Read on the FortiOS 7.6.5 guide only; earlier 7.6 releases are not assessed here. Evidence note (portal’s own words) FortiOS 7.6.5 can add ML-KEM-512, ML-KEM-768 and ML-KEM-1024 as additional key exchanges in IKEv2 IPsec tunnels. Locator Post-Quantum Cryptography for IPsec key exchange, list of FIPS 203 groups and CLI configuration Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Fortinet Document Library: Post-Quantum Cryptography for IPsec key exchange (FortiOS 7.6.5) (Vendor documentation; published Not stated; updated Not stated; retrieved 2026-10-22)
Palo Alto Networks PAN-OS Palo Alto Networks · VPN	PAN-OS 11.2 and later	VPN / IPsec key exchange Key establishment	Generally available	No published date	Evidence card Applies to, as the main document states PAN-OS 11.2 or later (Explicit scope of the main document) Algorithms None stated Mode Hybrid (classical and post-quantum) Protocol IKEv2 (RFC 9242 and RFC 9370 additional key exchanges) Enabled by default No Required patch None stated Configuration Enable Post-Quantum Key Exchange on the IKE gateway and add PQC KEMs to the additional key exchange rounds of the IKE and IPsec crypto profiles. Limitations The page names no algorithm. Both peers need the same KEMs in each round; IKEv2 fragmentation should be on. Evidence note (portal’s own words) PAN-OS 11.2 and later can add up to seven post-quantum key exchange rounds to IKEv2 and IPsec, off by default. Locator Where Can I Use This? (PAN-OS 11.2 or later) and the configuration steps Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Palo Alto Networks TechDocs: Configure Post-Quantum IKEv2 VPNs with RFC 9242 and RFC 9370 Hybrid Keys (Vendor documentation; published Not stated; updated 2026-07-20; retrieved 2026-10-22)
Keyfactor EJBCA Keyfactor (EJBCA) · Public PKI and certificate authorities	EJBCA 9.1.1 and later	PKI / CA certificate issuance Certificate authority issuance	Generally available	Vendor release date 2024-11 Month of EJBCA 9.1.1 in the release notes.	Evidence card Applies to, as the main document states EJBCA 9.1.1 (EJBCA 9.1; 9.1.0 was internal only) (Explicit scope of the main document) Algorithms ML-DSA (parameter set not stated) (NIST FIPS 204), ML-KEM (parameter set not stated) (NIST FIPS 203) Mode Pure post-quantum Protocol X.509 Enabled by default Not stated Required patch None stated Configuration None stated Limitations Replaces the earlier Dilithium and Kyber candidates; relying parties must support the new algorithms. Evidence note (portal’s own words) EJBCA 9.1 can issue certificates with ML-DSA and ML-KEM keys. Locator Introduction and section NIST Approved Quantum-Safe Algorithms ML-DSA and ML-KEM Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Keyfactor Docs: EJBCA 9.1 Release Notes (Vendor release notes; published 2024-11; updated Not stated; retrieved 2026-10-22)
Node.js Node.js project (OpenJS Foundation) · Language runtime and standard library	Node.js 24.7.0 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2025-08-27 Release date of Node.js 24.7.0 in the release notes.	Evidence card Applies to, as the main document states Node.js 24.7.0 (Current) (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration Use crypto.encapsulate and crypto.decapsulate for ML-KEM and crypto.sign and crypto.verify for ML-DSA. Limitations Tied to OpenSSL 3.5 on the 24.x line. Release named Current, not LTS, in the notes. Evidence note (portal’s own words) Node.js 24.7.0 exposes ML-KEM and ML-DSA in node:crypto and in the Web Cryptography API. Locator Notable Changes, Post-Quantum Cryptography in node:crypto Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Node.js: Node.js 24.7.0 (Current) (Vendor release notes; published 2025-08-27; updated Not stated; retrieved 2026-10-22)
Mozilla NSS (Network Security Services) Mozilla · Cryptographic library	NSS 3.105 and later	TLS key establishment Client and server	Generally available	Vendor release date 2024-09-26 Release date of NSS 3.105 in the release notes.	Evidence card Applies to, as the main document states NSS 3.105 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), ML-KEM-768 (NIST FIPS 203) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Not stated Required patch None stated Configuration None stated Limitations The entries do not say whether the group is enabled by default; that is set by the application, for example Firefox. Evidence note (portal’s own words) NSS 3.105 adds ML-KEM-768 to its software token and the mlkem768x25519 hybrid to libssl. Locator Notable Changes in NSS 3.105, bugs 1916525, 1916524 and 1866841 Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Mozilla (Firefox Source Docs): NSS 3.105 release notes (Vendor release notes; published 2024-09-26; updated Not stated; retrieved 2026-10-22)
Mozilla NSS (Network Security Services) Mozilla · Cryptographic library	NSS 3.116 and later	Algorithms in the cryptographic API Library API	Generally available	Vendor release date 2025-09-11 Release date of NSS 3.116 in the release notes.	Evidence card Applies to, as the main document states NSS 3.116 (Explicit scope of the main document) Algorithms ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure post-quantum Protocol PKCS#11 Enabled by default Not stated Required patch None stated Configuration None stated Limitations The entries name no parameter sets. Evidence note (portal’s own words) NSS 3.116 adds ML-DSA keys and mechanisms to its PKCS#11 interface and utilities. Locator Notable Changes in NSS 3.116, bug 1983320 entries Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Mozilla (Firefox Source Docs): NSS 3.116 release notes (Vendor release notes; published 2025-09-11; updated Not stated; retrieved 2026-10-22)
Securosys Primus HSM Securosys · Hardware security module	Primus HSM firmware 3.0 and later	HSM key storage and operations Key storage and operations	Generally available	No published date	Evidence card Applies to, as the main document states Primus HSM firmware 3.0 or later, with Primus PKCS#11 Provider 2.6.2, OpenSSL 3.5 and pkcs11-provider 1.1 (Explicit scope of the main document) Algorithms ML-DSA-44 (NIST FIPS 204), ML-DSA-65 (NIST FIPS 204), ML-DSA-87 (NIST FIPS 204) Mode Pure post-quantum Protocol PKCS#11 through the OpenSSL pkcs11-provider Enabled by default Not stated Required patch Primus PKCS#11 Provider 2.6.2, OpenSSL 3.5 and OpenSSL pkcs11-provider 1.1 on the client. Configuration Load the pkcs11-provider in OpenSSL and generate ML-DSA keys with the pkcs11 provider property query. Limitations The page covers ML-DSA through OpenSSL only; ML-KEM and other interfaces are not covered. Older versions are not supported. Evidence note (portal’s own words) Primus HSMs from firmware 3.0 hold ML-DSA-44, ML-DSA-65 and ML-DSA-87 keys usable from OpenSSL 3.5 through PKCS#11. Locator Supported Software Versions, Installation and Usage Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Securosys Docs: OpenSSL Tutorials: Post-Quantum Cryptography (Vendor documentation; published Not stated; updated 2026-10-09; retrieved 2026-10-22)
PQShield PQCryptoLib-Core PQShield · Cryptographic library	PQCryptoLib-Core 3.5.1 and later	Algorithms in the cryptographic API Library API	Generally available	No published date	Evidence card Applies to, as the main document states PQCryptoLib-Core 3.5.1 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations A commercial library from the vendor. CAVP covers the algorithm implementations, not a FIPS 140-3 module validation; the post names no parameter sets. Evidence note (portal’s own words) PQShield reports NIST CAVP certification of ML-KEM and ML-DSA in PQCryptoLib-Core 3.5.1. Locator Post body, first two paragraphs and the certificate reference (A8807) Review Reviewed against the source; Claude builder (AI), catalogue extension research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources PQShield: PQCryptoLib-Core 3.5.1 achieves CAVP certification (Vendor announcement; published 2026-08-11; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 10.0 up to, not including, Red Hat Enterprise Linux 10.1	TLS key establishment Client and server	Preview	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 10.0 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP256r1MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP384r1MLKEM1024 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default No Required patch None stated Configuration Install crypto-policies-pq-preview and crypto-policies-scripts and set the policy DEFAULT:TEST-PQ. Limitations Technology Preview in RHEL 10.0; package and policy names may change. SecP384r1MLKEM1024 is not in NSS on 10.0. Evidence note (portal’s own words) RHEL 10.0 offers hybrid ML-KEM TLS 1.3 groups in OpenSSL, GnuTLS and NSS as a Technology Preview, switched on with a preview crypto-policies module. Locator Sections Post-quantum key exchange in TLS (group table) and Conclusion Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Blog: Post-quantum cryptography in Red Hat Enterprise Linux 10 (Vendor announcement; published 2025-05-20; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 10.0 up to, not including, Red Hat Enterprise Linux 10.1	SSH key exchange Client and server	Preview	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 10.0 (Explicit scope of the main document) Algorithms mlkem768x25519-sha256 (SSH hybrid of ML-KEM-768 and X25519), sntrup761x25519-sha512 (SSH hybrid of Streamlined NTRU Prime and X25519) Mode Hybrid (classical and post-quantum) Protocol SSH Enabled by default No Required patch None stated Configuration Set the policy DEFAULT:TEST-PQ after installing crypto-policies-pq-preview; that module enables only the ML-KEM method, sntrup761 has to be configured by hand. Limitations Technology Preview in RHEL 10.0. libssh, used for example by Ansible, has no ML-KEM in RHEL 10.0. Evidence note (portal’s own words) OpenSSH in RHEL 10.0 supports the hybrid ML-KEM and sntrup761 SSH key exchanges as a Technology Preview. Locator Section Post-quantum key exchange in SSH Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Blog: Post-quantum cryptography in Red Hat Enterprise Linux 10 (Vendor announcement; published 2025-05-20; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 10.0 up to, not including, Red Hat Enterprise Linux 10.1	Algorithms in the cryptographic API Library API	Preview	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 10.0 (Explicit scope of the main document) Algorithms ML-DSA (parameter set not stated) (NIST FIPS 204) Mode Pure post-quantum Protocol None stated Enabled by default No Required patch None stated Configuration Install oqsprovider to use ML-DSA through OpenSSL. Limitations Technology Preview. SLH-DSA and composite ML-DSA are not available in 10.0; keys made with oqsprovider use a pre-standard format that 10.1 asks to convert. Evidence note (portal’s own words) RHEL 10.0 provides ML-DSA through OpenSSL with oqsprovider as a Technology Preview, the only post-quantum signature in that release. Locator Blog sections Signature primitives and Signatures in TLS; 10.1 notes, item on the standard key format for ML-KEM and ML-DSA Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Blog: Post-quantum cryptography in Red Hat Enterprise Linux 10 (Vendor announcement; published 2025-05-20; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 10.1 Release Notes, New features and enhancements (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 10.1 and later	TLS key establishment Client and server	Generally available	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 10.1 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP256r1MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP384r1MLKEM1024 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration The NO-PQ subpolicy turns post-quantum algorithms off; update-crypto-policies --show prints the active policy. Limitations Both ends must offer a hybrid group. In FIPS mode the classical part comes from the FIPS provider. Evidence note (portal’s own words) RHEL 10.1 system-wide policies enable hybrid ML-KEM key exchange at the highest priority by default, with OpenSSL 3.5 and NSS 3.112; it is not listed as a preview. Locator Overview 1.1.2 Security; New features 6.2 Security, crypto-policies and OpenSSL 3.5 items; Technology Preview chapter has no PQC item Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Documentation: RHEL 10.1 Release Notes, Chapter 1. Overview (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 10.1 Release Notes, New features and enhancements (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 10.1 Release Notes, Technology Preview features (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 10.1 and later	Certificate signatures Signing and verification	Generally available	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 10.1 (Explicit scope of the main document) Algorithms ML-DSA-44 (NIST FIPS 204), ML-DSA-65 (NIST FIPS 204), ML-DSA-87 (NIST FIPS 204) Mode Pure post-quantum Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration Enabled in the LEGACY, DEFAULT, FUTURE and FIPS policies; NO-PQ turns it off. Limitations Public certificate authorities do not issue ML-DSA certificates; a private CA is needed. An NSS database password change corrupted ML-DSA seeds until an advisory fixed it. Evidence note (portal’s own words) RHEL 10.1 enables pure ML-DSA signatures and ML-DSA certificates in TLS 1.3 for GnuTLS and NSS through the default policies. Locator New features 6.2 Security: crypto-policies, NSS 3.112, GnuTLS 3.8.10 and ML-DSA keys in TLS items Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Documentation: RHEL 10.1 Release Notes, New features and enhancements (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 10.1 Release Notes, Technology Preview features (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 10.1 and later	Algorithms in the cryptographic API Library API	Generally available	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 10.1 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204), SLH-DSA (NIST FIPS 205) Mode Pure and hybrid Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations Keys created with oqsprovider on 10.0 must be converted to the standard format with openssl pkcs8. Evidence note (portal’s own words) RHEL 10.1 rebases OpenSSL to 3.5, which adds ML-KEM, ML-DSA and SLH-DSA to the system cryptographic library. Locator Overview 1.1.2 Security; New features 6.2 Security, OpenSSL rebased to 3.5 Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Documentation: RHEL 10.1 Release Notes, Chapter 1. Overview (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 10.1 Release Notes, New features and enhancements (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 9.7 up to, not including, Red Hat Enterprise Linux 10.0	TLS key establishment Client and server	Generally available	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 9.7 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP256r1MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3), SecP384r1MLKEM1024 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default No Required patch None stated Configuration Apply the PQ subpolicy, for example update-crypto-policies --set DEFAULT:PQ, or FIPS:PQ in FIPS mode. Limitations Not enabled by default by the system policy. Applies to OpenSSL and NSS; the notes say nothing about OpenSSH. Evidence note (portal’s own words) RHEL 9.7 ships OpenSSL 3.5 and NSS 3.112 with hybrid ML-KEM groups, enabled through a PQ subpolicy of the system-wide policies; not listed as a preview. Locator Overview 1.1 Security; New features 4.2 Security, crypto-policies PQ subpolicy, OpenSSL 3.5 and NSS 3.112 items Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Documentation: RHEL 9.7 Release Notes, Chapter 1. Overview (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 9.7 Release Notes, Chapter 4. New features (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 9.7 Release Notes, Chapter 8. Technology previews (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 9.7 up to, not including, Red Hat Enterprise Linux 10.0	Algorithms in the cryptographic API Library API	Generally available	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 9.7 (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204), SLH-DSA (NIST FIPS 205) Mode Pure and hybrid Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) RHEL 9.7 rebases OpenSSL to 3.5, adding ML-KEM, ML-DSA and SLH-DSA to the system library. Locator Overview 1.1 Security; New features 4.2 Security, OpenSSL 3.5 item Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Documentation: RHEL 9.7 Release Notes, Chapter 1. Overview (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 9.7 Release Notes, Chapter 4. New features (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Red Hat Enterprise Linux Red Hat · Operating system	Red Hat Enterprise Linux 9.6 up to, not including, Red Hat Enterprise Linux 9.7	TLS key establishment Client and server	No verified information	No published date	Evidence card Applies to, as the main document states Red Hat Enterprise Linux 9.6 (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The RHEL 9.6 notes name OpenSSL 3.2.2 and no post-quantum TLS group or preview for the system TLS libraries. Locator Overview, Security highlights (OpenSSL 3.2.2); Technology Previews chapter has no PQC item Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Red Hat Documentation: RHEL 9.6 Release Notes, Chapter 1. Overview (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Red Hat Documentation: RHEL 9.6 Release Notes, Technology Previews (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Ubuntu Canonical (Ubuntu) · Operating system	Ubuntu 24.04 LTS up to, not including, Ubuntu 25.10	TLS key establishment Client and server	No verified information	No published date	Evidence card Applies to, as the main document states Ubuntu 24.04 LTS (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The 24.04 notes say nothing about post-quantum TLS; the 26.04 summary lists post-quantum algorithms among OpenSSL changes made since 24.04. Locator 24.04 notes, Security Improvements; 26.04 summary, Post-quantum cryptography support (added in 25.10) Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Ubuntu documentation: Ubuntu 24.04 LTS release notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Ubuntu documentation: Ubuntu 26.04 LTS summary for LTS users (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Ubuntu Canonical (Ubuntu) · Operating system	Ubuntu 24.04 LTS up to, not including, Ubuntu 25.10	SSH key exchange Client and server	No verified information	No published date	Evidence card Applies to, as the main document states Ubuntu 24.04 LTS (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) Ubuntu documents no post-quantum SSH key exchange for 24.04; the 26.04 summary gives OpenSSH 9.6p1 as the 24.04 LTS version. Locator 24.04 notes, OpenSSH entries; 26.04 summary, Server, OpenSSH (upgrade from 1:9.6p1) Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Ubuntu documentation: Ubuntu 24.04 LTS release notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Ubuntu documentation: Ubuntu 26.04 LTS summary for LTS users (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Ubuntu Canonical (Ubuntu) · Operating system	Ubuntu 25.10 up to, not including, Ubuntu 26.04 LTS	TLS key establishment Client and server	Generally available	No published date	Evidence card Applies to, as the main document states Ubuntu 25.10 (Explicit scope of the main document) Algorithms None stated Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch None stated Configuration None stated Limitations The notes speak of hybrid PQC KEM groups without naming them. Ubuntu 25.10 support ended in July 2026. Evidence note (portal’s own words) Ubuntu 25.10 ships OpenSSL 3.5.3 with ML-KEM, ML-DSA and SLH-DSA, and its default TLS group list includes and prefers hybrid post-quantum groups. Locator Ubuntu Foundations, Cryptography, Libraries: OpenSSL 3.5.3 entry Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Ubuntu documentation: Ubuntu 25.10 release notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Ubuntu Canonical (Ubuntu) · Operating system	Ubuntu 25.10 up to, not including, Ubuntu 26.04 LTS	SSH key exchange Client and server	Generally available	No published date	Evidence card Applies to, as the main document states Ubuntu 25.10 (Explicit scope of the main document) Algorithms None stated Mode Hybrid (classical and post-quantum) Protocol SSH Enabled by default Yes Required patch None stated Configuration None stated Limitations The notes do not name the method; upstream OpenSSH 10.0 makes mlkem768x25519-sha256 the default. Support ended in July 2026. Evidence note (portal’s own words) Ubuntu 25.10 updates OpenSSH to 10.0, which uses a hybrid post-quantum key agreement by default. Locator Ubuntu Server, OpenSSH: update to 10.0 Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Ubuntu documentation: Ubuntu 25.10 release notes (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Ubuntu Canonical (Ubuntu) · Operating system	Ubuntu 26.04 LTS and later	SSH key exchange Client and server	Generally available	No published date	Evidence card Applies to, as the main document states Ubuntu 26.04 LTS (Explicit scope of the main document) Algorithms mlkem768x25519-sha256 (SSH hybrid of ML-KEM-768 and X25519) Mode Hybrid (classical and post-quantum) Protocol SSH Enabled by default Yes Required patch None stated Configuration None stated Limitations The peer must offer the method; OpenSSH warns when a connection uses a key agreement that is not post-quantum. Evidence note (portal’s own words) Ubuntu 26.04 LTS ships OpenSSH 10.2p1 with the hybrid ML-KEM key exchange on by default and no migration switch needed. Locator Summary, Server, OpenSSH; blog, OpenSSH section Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Ubuntu documentation: Ubuntu 26.04 LTS summary for LTS users (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22) Ubuntu blog (Canonical): What's new in security for Ubuntu 26.04 LTS? (Vendor announcement; published 2026-04-10; updated Not stated; retrieved 2026-10-22)
Ubuntu Canonical (Ubuntu) · Operating system	Ubuntu 26.04 LTS and later	Algorithms in the cryptographic API Library API	Generally available	No published date	Evidence card Applies to, as the main document states Ubuntu 26.04 LTS (Explicit scope of the main document) Algorithms ML-KEM (parameter set not stated) (NIST FIPS 203), ML-DSA (parameter set not stated) (NIST FIPS 204), SLH-DSA (NIST FIPS 205) Mode Pure and hybrid Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations The summary does not state the OpenSSL version. Evidence note (portal’s own words) For users coming from 24.04, the 26.04 LTS summary lists OpenSSL support for ML-KEM, ML-DSA and SLH-DSA. Locator Security, Post-quantum cryptography support (added in 25.10) Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Ubuntu documentation: Ubuntu 26.04 LTS summary for LTS users (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Debian Debian Project · Operating system	Debian 13 (trixie) and later	TLS key establishment Client and server	No verified information	No published date	Evidence card Applies to, as the main document states Debian 13 (trixie) (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The Debian 13 release notes make no post-quantum statement; their package table lists OpenSSL 3.5, up from 3.0 in Debian 12. Locator Section 2.2.10 Desktops and well known packages, package version table (OpenSSL) Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Debian Project: Release notes for Debian 13 (trixie), 2. What's new in Debian 13 (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Debian Debian Project · Operating system	Debian 13 (trixie) and later	SSH key exchange Client and server	No verified information	No published date	Evidence card Applies to, as the main document states Debian 13 (trixie) (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The Debian 13 release notes make no post-quantum statement; their package table lists OpenSSH 10.0p1, up from 9.2p1 in Debian 12. Locator Section 2.2.10 Desktops and well known packages, package version table (OpenSSH) Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Debian Project: Release notes for Debian 13 (trixie), 2. What's new in Debian 13 (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
Debian Debian Project · Operating system	Debian 12 (bookworm) up to, not including, Debian 13 (trixie)	TLS key establishment Client and server	No verified information	No published date	Evidence card Applies to, as the main document states Debian 12 (bookworm) (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) No Debian post-quantum statement was found for Debian 12; the Debian 13 notes list OpenSSL 3.0 in Debian 12. Locator Section 2.2.10 Desktops and well known packages, package version table (OpenSSL, bookworm column) Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources Debian Project: Release notes for Debian 13 (trixie), 2. What's new in Debian 13 (Vendor release notes; published Not stated; updated Not stated; retrieved 2026-10-22)
SUSE Linux Enterprise Server SUSE · Operating system	SUSE Linux Enterprise Server 15 SP7 up to, not including, SUSE Linux Enterprise Server 16.0	SSH key exchange Client and server	Generally available	No published date	Evidence card Applies to, as the main document states SUSE Linux Enterprise Server 15 SP7 (Explicit scope of the main document) Algorithms sntrup761x25519-sha512 (SSH hybrid of Streamlined NTRU Prime and X25519), mlkem768x25519-sha256 (SSH hybrid of ML-KEM-768 and X25519) Mode Hybrid (classical and post-quantum) Protocol SSH Enabled by default Yes Required patch None stated Configuration None stated Limitations sntrup761 is enabled in DEFAULT, FUTURE and LEGACY; the ML-KEM method only in DEFAULT and FUTURE. Evidence note (portal’s own words) In SLES 15 SP7 the system-wide policies enable the sntrup761 and hybrid ML-KEM SSH key exchanges by default (OpenSSH 9.6p1). Locator Sections 5.10.2 PQC key exchange enabled by default and 5.10.3 Support for mlkem768x25519-sha256 Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources SUSE: Release Notes, SUSE Linux Enterprise Server 15 SP7 (Vendor release notes; published 2026-10-01; updated Not stated; retrieved 2026-10-22)
SUSE Linux Enterprise Server SUSE · Operating system	SUSE Linux Enterprise Server 15 SP7 up to, not including, SUSE Linux Enterprise Server 16.0	TLS key establishment Client and server	Generally available	Vendor release date 2026-08-27 Release date of advisory SUSE-SU-2026:3835-1.	Evidence card Applies to, as the main document states SUSE Linux Enterprise Server 15 SP7 (Explicit scope of the main document) Algorithms X25519MLKEM768 (IETF hybrid ML-KEM key agreement for TLS 1.3) Mode Hybrid (classical and post-quantum) Protocol TLS 1.3 Enabled by default Yes Required patch SUSE-SU-2026:3835-1 (openssl-3 3.5.0-150700.5.45.2 in the Basesystem Module 15-SP7) Configuration None stated Limitations Before this update SLES 15 SP7 used OpenSSL 3.2.3 by default, which has no post-quantum groups. Evidence note (portal’s own words) A SUSE security update moves SLES 15 SP7 to OpenSSL 3.5.0, enabling post-quantum TLS with X25519MLKEM768 offered by default. Locator Advisory description (jsc#PED-16072) and the 3.5.0 change list; release notes 5.10.10 OpenSSL 3.2.3 is now default Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources SUSE (sle-updates list): SUSE-SU-2026:3835-1: Security update for openssl, openssl-3 (Vendor announcement; published 2026-08-27; updated Not stated; retrieved 2026-10-22) SUSE: Release Notes, SUSE Linux Enterprise Server 15 SP7 (Vendor release notes; published 2026-10-01; updated Not stated; retrieved 2026-10-22)
SUSE Linux Enterprise Server SUSE · Operating system	SUSE Linux Enterprise Server 16.0 and later	SSH key exchange Client and server	Generally available	No published date	Evidence card Applies to, as the main document states SUSE Linux Enterprise Server 16.0 (Explicit scope of the main document) Algorithms mlkem768x25519-sha256 (SSH hybrid of ML-KEM-768 and X25519), sntrup761x25519-sha512 (SSH hybrid of Streamlined NTRU Prime and X25519) Mode Hybrid (classical and post-quantum) Protocol SSH Enabled by default Yes Required patch None stated Configuration None stated Limitations The peer must offer one of the methods. Evidence note (portal’s own words) SLES 16.0 system-wide policies enable post-quantum SSH key exchange by default, allowing the hybrid ML-KEM and sntrup761 methods. Locator Section 5.14 Post-quantum cryptography (PQC) key exchange enabled by default Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources SUSE Documentation: SUSE Linux Enterprise Server 16.0 Release Notes (Vendor release notes; published 2026-10-06; updated Not stated; retrieved 2026-10-22)
SUSE Linux Enterprise Server SUSE · Operating system	SUSE Linux Enterprise Server 16.0 and later	TLS key establishment Client and server	No verified information	No published date	Evidence card Applies to, as the main document states SUSE Linux Enterprise Server 16.0 (No statement found in the reviewed evidence) Algorithms None stated Mode Not applicable Protocol None stated Enabled by default Not stated Required patch None stated Configuration None stated Limitations None stated Evidence note (portal’s own words) The SLES 16.0 release notes state no post-quantum TLS support and no OpenSSL version for the system library. Locator Whole release notes; OpenSSL 3 is mentioned only for live patching and IBM Z items Review Reviewed against the source; Claude builder (AI), Linux distribution research; not an independent human review, 2026-10-22; next review 2027-01-22 Sources SUSE Documentation: SUSE Linux Enterprise Server 16.0 Release Notes (Vendor release notes; published 2026-10-06; updated Not stated; retrieved 2026-10-22)

Plan my migration

Choose what you run, confirm the exact product, tick the cryptographic uses and, if you wish, add context. The navigator applies fixed, transparent rules to the reviewed records above and lists actions, blockers and the origin of every date, with a dependency map, a readiness matrix and a timeline.

Private by design: your plan stays in this browser (local storage) until you reset it. Nothing you enter is sent to this site, to an AI model or to anyone else, and nothing is put into the page address. Avoid entering host names, addresses or personal data; product names and versions are enough.

Legend: what each status and evidence level means

Legend

Plan outcomes

Act now: A reviewed capability or upgrade path exists and the context you gave (long confidentiality or high criticality) makes it a priority; still test before production.
Test before rollout: Reviewed evidence shows the capability in this release, or in a later release you could evaluate; enable, test and roll out under your own change process.
Vendor dependency: The vendor has announced, previewed or excluded it for this scope; nothing in the reviewed evidence lets you act alone.
Needs investigation: No verified support or date for this exact configuration in the reviewed evidence; confirm the product and ask the vendor.

Published capability

Generally available
Preview
Announced roadmap
Explicitly unsupported for this scope
No verified information

Dates, by type and origin

Vendor release date
Vendor preview date
Vendor roadmap target (not a release)
Product end of support
Authority guidance target
Binding obligation (verified)
Organisation planned date (set by you)
No published date

Dependency map

Solid line: dependency confirmed by a reviewed assertion.
Dashed line: unconfirmed dependency or no verified information; unknown stays unknown.
Depends on
Requires version
Enables feature
Replaces
Blocked by

Post-quantum cryptography guide: what the rules say, by when · Post-quantum cryptography migration timeline · Standards these algorithms come from, with their status and dates · Download the reviewed catalogue as JSON