Post-Quantum Cryptography

2026-07-015 minTrail of Bitslow

Trail of Bits, funded by the Sovereign Tech Agency, has implemented NIST-standardized post-quantum primitives ML-KEM (FIPS 203) and ML-DSA (FIPS 204) in pyca/cryptography version 48, making them available across the Python ecosystem via pip. The release includes Rust bindings, a cross-binding API, and AWS-LC backend support. Migration to post-quantum cryptography is not a drop-in replacement due to significantly larger key, signature, and ciphertext sizes that require protocol-level changes, and integration into real-world protocols like TLS and SSH is still ongoing.

2026-06-094 minAkamaimedium

The transition to Post-Quantum Cryptography (PQC) introduces significantly larger cryptographic signatures, such as ML-DSA, which will force DNS responses to exceed standard UDP packet limits. This architectural shift will cause frequent fallbacks to TCP, introducing latency spikes and silent timeouts that pose a severe operational risk to automated, high-volume systems like agentic AI workflows. Furthermore, adversaries are already conducting 'Harvest now, decrypt later' attacks, underscoring the immediate need for organizations to map and secure their DNS and DNSSEC configurations across distributed cloud environments.

The 2026 ransomware landscape is characterized by the adoption of post-quantum cryptography to thwart decryption efforts and a significant shift toward encryptionless, data-centric extortion. Threat actors are increasingly professionalizing their operations, standardizing EDR evasion via BYOVD (Bring Your Own Vulnerable Driver), and relying on Initial Access Brokers targeting edge infrastructure like RDWeb and VPNs.

2026-05-134 minAkamaimedium

The article highlights the critical need to transition various network protocols, including SSH, IPsec, OpenPGP, and DNSSEC, to post-quantum cryptography (PQC) to mitigate the 'harvest now, decrypt later' threat. While TLS and SSH have clear upgrade paths with hybrid key exchanges, protocols like DNSSEC face complex architectural challenges due to signature sizes and UDP limitations.