Luca BertonTLS protects every web connection, API call, and service-to-service communication. It's also the most exposed to quantum threats — TLS key exchange uses ECDH or RSA, both broken by Shor's algorithm. Migrating TLS to post-quantum cryptography is the highest-priority PQC infrastructure project.
Hybrid Key Exchange: The Immediate Action
Hybrid key exchange combines classical and post-quantum algorithms. Both contribute to the shared secret. If either algorithm remains secure, the connection is protected.
- X25519+ML-KEM-768 — The most widely deployed hybrid. Supported in Chrome 124+, Firefox, Cloudflare, AWS
- Performance impact — ML-KEM adds ~1KB to the TLS handshake. Negligible for most workloads
- Server-side support — OpenSSL 3.2+ with oqs-provider, BoringSSL, s2n-tls (AWS)
Enabling Hybrid PQC on Your Infrastructure
Nginx / Apache
Compile OpenSSL 3.2+ with the OQS provider. Configure hybrid key exchange groups. Test with openssl s_client and browser developer tools to verify PQC negotiation.
Cloud Load Balancers
AWS ALB/NLB support hybrid PQC key exchange. Cloudflare enables it by default. Azure and GCP are rolling out support. Check your provider's current status.
Service Mesh
Istio and Linkerd use Envoy for TLS termination. Envoy with BoringSSL supports hybrid PQC. Enable for east-west traffic to protect internal communications.
Kubernetes Recipes
Practical guide for container orchestration and deployment — hands-on patterns you can use today.
View on Amazon →PQC Certificate Timeline
Post-quantum certificates (using ML-DSA signatures) are not yet widely supported in the WebPKI ecosystem. Timeline:
- 2024-2025 — NIST standards finalized, CA/Browser Forum working on integration
- 2025-2026 — Root programs begin accepting PQC root certificates
- 2026-2028 — Commercial CAs start issuing PQC or hybrid certificates
- 2028-2030 — Broad ecosystem support, migration from RSA/ECDSA certificates
Testing Infrastructure
Build PQC testing into your CI/CD: automated TLS configuration testing with PQC support verification, performance benchmarking with PQC handshakes, compatibility testing with client libraries and browsers, fallback testing — does graceful degradation work when PQC isn't supported?
Federated Learning and Privacy-preserving RAGs
Implement secure AI models using federated learning techniques.
Start on Pluralsight →