PQC StatusGuides
Practical, sourced guides to test, plan and migrate to post-quantum cryptography.
Post-quantum VPN options: IPsec, IKEv2 and WireGuard
How to move VPN key exchange to ML-KEM: IKEv2 additional key exchanges (RFC 9370), pre-shared key mixing (RFC 8784), WireGuard limits and supplier questions.
· 7 minCNSA 2.0 timeline: algorithms and deadlines explained
CNSA 2.0 in plain terms: who it binds, the ML-KEM-1024 and ML-DSA-87 suite, the 2030 and 2033 exclusive-use deadlines, and what suppliers must ship.
· 9 minMigrating code signing to ML-DSA: a practical plan
Why firmware and software signing has early deadlines, how ML-DSA compares with LMS, XMSS and SLH-DSA, and how to dual sign and update verifiers first.
· 8 minPost-quantum cryptography for payment providers and PSPs
What payment providers can migrate now: hybrid ML-KEM on public TLS endpoints, PCI DSS 12.3.3 inventory, DORA duties, and what waits on schemes.
· 8 minGenerate a CycloneDX CBOM in CI
Where cryptographic assets live in the CycloneDX 1.6 model, what CI can detect statically or at runtime, and how to store, validate and diff a CBOM.
· 8 minQuantum risk assessment template, with a transparent scoring method
A reusable quantum risk assessment template: assets, algorithms, data shelf life, exposure, migration time, suppliers, plus a transparent scoring method.
· 8 minBSI TR-02102-1 and post-quantum cryptography: the 2026 recommendations
What version 2026-01 of BSI TR-02102-1 recommends: hybrid key agreement, classical key exchange alone until end of 2031, RSA 3000 bits.
· 7 minANSSI and hybrid post-quantum cryptography: what France expects
How ANSSI frames post-quantum hybridization: mandatory in its regulated scope, recommended elsewhere, PQC in qualification from 2027, purchasing after 2030.
· 8 minCRA encryption requirements for product makers
What Annex I Part I (2)(e) of the Cyber Resilience Act asks of product makers, the 2026-09-11 and 2027-12-11 dates, and crypto agility in firmware.
· 10 minDORA Article 7: key management and the certificate register
How to build the DORA certificate register for ICT assets supporting critical or important functions: fields, discovery commands, key lifecycle, evidence.
· 9 minPost-quantum TLS in Java: where the JDK stands and what to do now
Server-side Java behind a proxy or Java as a TLS client: what the JDK gives you for ML-KEM today, your real options, and how to inventory and test it.
· 7 minHybrid post-quantum TLS on a Kubernetes ingress
Find where TLS really terminates in your cluster, set hybrid X25519MLKEM768 with a classical X25519 fallback, and verify the handshake from outside.