PQC StatusGuides
Practical, sourced guides to test, plan and migrate to post-quantum cryptography.
Post-quantum readiness checklist for security teams
A phased PQC readiness checklist: governance, discovery, hybrid TLS quick wins, supplier questions, PKI and monitoring, with the evidence to keep.
· 7 minRSA-2048 after 2030: what the NIST IR 8547 draft proposes
NIST IR 8547 is an initial public draft. It proposes deprecating RSA-2048 after 2030 and disallowing it after 2035. Compared with BSI and the EU roadmap.
· 8 minCrypto agility: definition, and how to build it into systems
Crypto agility defined, then built: configuration over code, algorithm negotiation, inventory, abstraction layers, key automation and DORA Article 6.
· 10 minNIS2 cryptography policy template for Article 21(2)(h)
The structure of a cryptography policy that answers NIS2 Article 21(2)(h), with a copyable outline table and post-quantum transition provisions.
· 9 minThe DORA encryption policy under RTS Article 6
What DORA RTS Article 6 literally requires in an encryption policy, a section-by-section outline, crypto agility wording and an evidence table.
· 7 minPost-quantum SSH: mlkem768x25519-sha256 in OpenSSH
How to check the SSH key exchange your sessions negotiate, enable mlkem768x25519-sha256 in OpenSSH, and read the 10.1 WarnWeakCrypto notice.
· 7 minML-KEM vs Kyber: what changed between the draft and FIPS 203
CRYSTALS-Kyber became ML-KEM in FIPS 203. What changed, why X25519Kyber768Draft00 is obsolete, and which TLS groups and library versions to check.
· 7 minHow to check if your website supports post-quantum TLS
Three ways to test if a server negotiates hybrid post-quantum key exchange (X25519MLKEM768): an online scan, one OpenSSL command or browser tools.
· 8 minEnable post-quantum TLS on nginx, Apache, HAProxy and Caddy
Exact configuration to enable hybrid X25519MLKEM768 key exchange on nginx, Apache, HAProxy and Caddy, with prerequisites, a safe fallback and how to verify it.
· 9 minHarvest now, decrypt later: the threat model, and what it changes today
Harvest now, decrypt later explained for CISOs: the threat model, which data has a long confidentiality lifetime, and how to rank systems by shelf life.
· 8 minPCI DSS 12.3.3: building the cryptographic inventory
PCI DSS requirement 12.3.3 is mandatory since 31 March 2025. What it requires, how to inventory cipher suites and protocols, and a ready-to-use template.
· 9 minPost-quantum migration deadlines: what to do and when
Post-quantum deadlines from NIST, the EU, ANSSI, BSI, the UK NCSC and the US: what is binding, what is guidance, and what to do by each date.