Post-quantum cryptography: where things stand in October 2026

A sufficiently powerful quantum computer could break the public-key algorithms that protect almost all of our exchanges today: RSA and elliptic-curve cryptography. No one knows when such a machine will exist. But data encrypted today can be collected now and decrypted later, and a cryptographic migration takes years. That is why post-quantum cryptography (PQC), designed to withstand quantum attacks, is now a concrete undertaking. Here is where it stands.

Standards: the essentials are ready

NIST, the U.S. standards institute, published its first three post-quantum standards on August 13, 2024:

• FIPS 203 (ML-KEM), derived from CRYSTALS-Kyber: the main standard for establishing encryption keys;
• FIPS 204 (ML-DSA), derived from CRYSTALS-Dilithium: the main digital signature standard;
• FIPS 205 (SLH-DSA), derived from SPHINCS+: a hash-based signature, a fallback in case ML-DSA is weakened.

Two additions are still in the works. FN-DSA (the future FIPS 206), derived from the Falcon algorithm, offers more compact signatures but is tricky to implement: its draft standard, announced in 2024, has still not been published. HQC, selected in March 2025 as a backup to ML-KEM, is also being standardized. NIST's message remains the same: there is no need to wait for these additions to get started.

Protocols are switching over

Key exchange is the most advanced part of the migration, because it directly protects against data being collected for future decryption:

• TLS: RFC 10024, published in 2026 by the IETF as a proposed standard, defines three hybrid key exchanges for TLS 1.3, including X25519MLKEM768, which combines a classical elliptic curve with ML-KEM.
• SSH: a post-quantum hybrid key exchange has been used by default since OpenSSH 9.0 (April 2022), and since OpenSSH 10.0 (April 9, 2025) it is the ML-KEM-based mlkem768x25519-sha256 algorithm.
• The web: according to Cloudflare, more than 60% of human-originated TLS traffic to its network was already protected by hybrid ML-KEM in February 2026.

The next frontier: certificates

Authentication is harder to migrate: post-quantum signatures are significantly larger than current ones, which makes TLS exchanges and certificate transparency logs heavier. On September 29, 2026, Cloudflare announced it wants to become a public certificate authority, using Merkle Tree Certificates, a compact format designed for post-quantum signatures. The first Merkle Tree Certificates are expected in the first quarter of 2027. In France, the ANSSI (the national cybersecurity agency) says it is working on certificate formats for key management infrastructures.

Timelines: 2026, 2027, 2030

• European Union: the coordinated roadmap published in June 2025 recommends that member states have started their transition by the end of 2026, have migrated high-risk uses by the end of 2030 at the latest, and medium-risk uses by the end of 2035.
• France: the ANSSI strongly recommends hybridization, makes it mandatory for certain regulated scopes, aims to introduce PQC requirements for product qualification starting in 2027, and considers it will be “unreasonable” to buy products without PQC after 2030.

The threat: closer than estimated, but not imminent

Estimates of the resources needed to break RSA-2048 have dropped sharply. In May 2025, Craig Gidney (Google) estimated that a machine with fewer than one million noisy physical qubits could do it in less than a week, compared with 20 million qubits, for an eight-hour computation, in the estimate he co-authored with Martin Ekerå in 2019. More recent work puts forward even lower figures, but relies on architectures whose hardware feasibility has not been demonstrated. No machine of this level exists today. According to a report published on October 6, 2026 by the GAO, the U.S. Congress's oversight body, experts consider it unlikely to be built in the next ten years, though most believe it could emerge as early as the 2030s.

The reasoning still holds, however: if your data must remain confidential beyond 2030, and if your migration will take several years, now is the time to start.

What to do right now

• Take inventory of cryptography uses and of data that must remain confidential for a long time;
• enable hybrid key exchange wherever it is already available (TLS, SSH);
• ask vendors for their PQC roadmap and include it in purchasing criteria;
• aim for crypto-agility: being able to change algorithms without rebuilding everything.