26days remaining
FIPS 140-2 transitions to Historical status on September 21, 2026. After this date, new implementations and procurements must target FIPS 140-3. Existing FIPS 140-2 validated deployments do not immediately become non-compliant, but organizations should not initiate new FIPS 140-2 validations and should document their transition path to FIPS 140-3. For most organizations this deadline is administrative rather than operational — but it is a forcing function for cryptographic inventory updates and vendor conversations.
Block 1
NIST PQC Standards & Mandate Tracker
RFC 10024 PublishedFIPS 140-2: 26 Days
▲
// This Week's Headline — RFC 10024 Published (August 2026)
The IETF has formally published RFC 10024, "Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3," as a Standards Track document. This RFC defines three hybrid key agreement mechanisms:
X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 — each combining ML-KEM (FIPS 203) with an ECDHE exchange. RFC 10024 formalizes what major implementors (Cloudflare, AWS, Chrome, Apple) have been deploying experimentally. Organizations running hybrid TLS deployments can now document Standards Track compliance. Implementation teams building on draft-ietf-tls-hybrid-design should migrate references to RFC 10024. Authors: Kwiatkowski (PQShield), Kampanakis (AWS), Westerbaan (Cloudflare), Stebila (University of Waterloo).FIPS 203 (ML-KEM)Finalized August 13, 2024 — Implements. Key encapsulation for TLS, VPN, and data-at-rest. Three parameter sets: ML-KEM-512 / ML-KEM-768 / ML-KEM-1024.
FIPS 204 (ML-DSA)Finalized August 13, 2024 — Implements. Digital signatures. Replacing RSA and ECDSA for code signing, certificate chains, and firmware signing.
FIPS 205 (SLH-DSA)Finalized August 13, 2024 — Implements. Hash-based signature backup scheme. 12 parameter sets. Lower performance than ML-DSA but different mathematical foundation for defense-in-depth.
FIPS 206 (FN-DSA)Draft as of Q2 2026 — Pending. Compact lattice-based signature scheme (derived from FALCON). Finalization expected 2026-2027. Smaller signatures than ML-DSA, but more complex to implement safely.
HQC (Code-based KEM)Selected March 2025 — FIPS Pending (~2027). Backup KEM to ML-KEM. Different mathematical foundation (code-based). Selected to reduce dependence on lattice problems.
RFC 10024Published August 2026 — Standards Track. Hybrid PQ/T key agreement for TLS 1.3. Defines X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024.
FIPS 140-2 → HistoricalSeptember 21, 2026 — 26 days. FIPS 140-3 is the active standard. New modules should not pursue FIPS 140-2 validation after this date. Existing validated modules remain valid.
CNSA 2.0 (NSS)Software/firmware signing: ML-DSA (or LMS/XMSS) by 2025 — current deadline. Network encryption: ML-KEM by 2026-2030. Classical algorithms retired by 2030-2033. All National Security System operators are subject.
HAWK AlgorithmWithdrawn from NIST Round 3 additional signatures evaluation — July 28-29, 2026. Anthropic Claude Mythos Preview identified a nontrivial automorphism halving effective key strength. FIPS 203/204/205 are unaffected.
Block 2
Vendor Crypto-Agility Moves
Cloudflare Origin Auth
▼
CloudflareML-KEM hybrid TLS default across edge — over 50% of all human traffic now uses post-quantum key agreement. Post-quantum origin authentication (CDN-to-origin leg) targeted for mid-2026 — now entering the current window. Merkle Tree Certificates: mid-2027. Full SASE-suite PQC coverage by early 2028. 2029 deadline for full post-quantum across portfolio. Cloudflare Radar PQC dashboard tracks real-world adoption rates publicly.
Google / ChromeML-KEM hybrid TLS default in Chrome. 2029 full PQC migration deadline across Google infrastructure matching Cloudflare commitment. Google Cloud has published PQC migration tooling for enterprise customers. Primary IETF post-quantum TLS standardization contributor.
AWSHybrid post-quantum TLS deployed at AWS KMS since 2024. Kampanakis (AWS) co-author of RFC 10024 — direct line from AWS contributions to formal standardization. Enterprise PQC migration guidance available for enterprise customers.
ApplePQ3 in iMessage since iOS 17.4 (2024) — ML-KEM used not just at session init but inside the ongoing protocol. iOS 26 completed remaining PQC integration. Certificate authorities (DigiCert, Entrust) now issuing hybrid and PQC certificates compatible with Apple's PKI validation.
OpenSSLOpenSSL 3.5 (April 2025): native ML-KEM and ML-DSA without provider plug-ins. Prior versions required OQS (Open Quantum Safe) provider — fine for experimentation, not suitable for FIPS 140-3 bound workloads. Teams still on OpenSSL 3.4 or earlier should plan upgrade.
PKI / Certificate AuthoritiesDigiCert and Entrust now issuing hybrid and PQC X.509 certificates. Key planning consideration: ML-DSA certificates are larger than RSA certificates — verify that all TLS intermediaries and CDN edges support the larger certificate sizes before migrating certificate chains.
Intel / ARMIntel has announced plans for CPU instructions accelerating lattice operations (future processor generations). ARM updating CryptoCell IP for mobile and IoT devices. Hardware acceleration for ML-KEM operations will reduce the performance gap vs. classical algorithms in constrained environments.
Block 3
"Harvest Now, Decrypt Later" (HNDL) Risk Watch
50.7% Still Vulnerable
▼
A 2026 Internet measurement study analyzing PQC adoption across the public Internet quantified the transition: 50.7% of analyzed domains remain fully vulnerable to quantum attacks through continued reliance on classical cryptography alone. 49.3% demonstrate partial post-quantum readiness through hybrid key exchange deployment. The primary driver of the 49.3% partial-readiness figure is ML-KEM-768 integration in TLS — largely delivered automatically through cloud and CDN infrastructure without action by individual website operators. Sectors with the slowest adoption are highly regulated ones (banking, financial, government, defence, telecoms) due to strict compliance, certification, and infrastructure life cycle constraints. These are also the sectors with the highest data sensitivity windows — making HNDL risk most acute where migration is slowest.
HNDL priority sectorsHigh-sensitivity long-retention data: M&A details, IP, classified government communications, medical records, legal discovery. Any data that must remain confidential for 10+ years is at HNDL risk today if encrypted with classical algorithms.
TLS 1.2 legacy exposureTLS 1.2 does not support hybrid PQC key exchange as defined in RFC 10024. Organizations that still operate TLS 1.2-only endpoints are fully exposed to HNDL attacks on those connections regardless of other PQC progress. TLS 1.3 migration is a prerequisite for RFC 10024 compliance.
CDN-to-origin gapA common partial-readiness gap: CDN edges deploy ML-KEM hybrid TLS for client-facing connections (protecting the browser-to-CDN leg), but the CDN-to-origin leg uses classical TLS. Cloudflare is working on post-quantum origin authentication — but until it's deployed, the origin leg remains classically encrypted and HNDL-exposed. Inventorying and closing the origin gap is a specific action item this week.
Block 4
Quantum Computing Progress, Contextualized
▼
Q-Day estimateCryptographically relevant quantum computers (CRQCs) remain 5–15+ years away in most mainstream expert assessments. No new significant quantum hardware announcements this week. The threat is not imminent computational attack — it is the harvest-now-decrypt-later attack vector, which is present today.
Why migrate now?HNDL attacks do not require a quantum computer today — only that encrypted data is captured today and decrypted when quantum capability becomes available. Sensitive data encrypted now with classical algorithms and captured by a capable adversary is vulnerable to future quantum decryption. The migration window closes as quantum hardware matures.
Algorithm securityML-KEM, ML-DSA, and SLH-DSA security is based on mathematical problems (MLWE, lattice problems, hash functions) that are not vulnerable to known quantum algorithms including Shor's algorithm. No quantum attack on FIPS 203/204/205 is currently known. The HAWK withdrawal (Edition #3) demonstrates NIST's ongoing vigilance — the core three standards remain sound.
IBM / Google progressQuantum hardware qubit counts continue increasing but error rates and fault tolerance remain the primary barrier to cryptographically relevant capability. Current generation quantum computers cannot execute Shor's algorithm against meaningful key sizes. This is expected to remain true for several years — but the planning window for PQC migration is now, not when Q-Day arrives.
Block 5
Practical Readiness Checklist — This Week's Focus: Hybrid TLS Hardening (RFC 10024)
Standards Track RFC Published
▼
This week's focus: RFC 10024 formalizes the hybrid TLS 1.3 mechanism. If your organization has been using draft-based configurations, update references and documentation. If you haven't begun hybrid TLS deployment, RFC 10024 provides the stable baseline to start now.
Update draft references to RFC 10024
Any TLS library, documentation, or compliance reference citing "draft-ietf-tls-hybrid-design" should be updated to reference RFC 10024. The mechanisms defined in the RFC are the same as the draft — this is a documentation and compliance update, not a functional change.
Verify TLS 1.3 is enabled on all external endpoints
RFC 10024 hybrid mechanisms require TLS 1.3. TLS 1.2-only endpoints cannot support hybrid PQC key exchange. Audit all HTTPS services, VPN gateways, and API endpoints for TLS version support. TLS 1.2 deprecation planning is a prerequisite for RFC 10024 compliance.
Enable X25519MLKEM768 on internet-facing TLS services
X25519MLKEM768 is the primary hybrid mechanism from RFC 10024 — combining the classical X25519 key exchange with ML-KEM-768. OpenSSL 3.5, BoringSSL (Chrome/Android), and most major TLS libraries support it. Enable it as a preferred or additional cipher group on HTTPS services, VPN gateways, and API endpoints. If either component is compromised, the other provides full protection.
Audit CDN-to-origin TLS configuration
Your CDN edge may already serve hybrid ML-KEM TLS to end users — but the CDN-to-origin connection is a separate, often overlooked gap. Check whether your origin server supports TLS 1.3 + RFC 10024 hybrid mechanisms. Cloudflare post-quantum origin authentication is expected mid-2026 — contact your CDN vendor for timeline and configuration steps.
Plan ML-DSA certificate chain migration
ML-DSA (FIPS 204) certificates are larger than RSA certificates — a practical constraint when migrating certificate infrastructure. Before issuing ML-DSA certificates or hybrid certificates from DigiCert/Entrust, verify that all TLS intermediaries (load balancers, WAFs, CDN edge nodes, API gateways) support the larger certificate sizes. Identify which components need upgrades before beginning PKI migration.
Upgrade OpenSSL to 3.5+ for native PQC support
OpenSSL 3.5 (April 2025) provides native ML-KEM and ML-DSA support without OQS provider plug-ins. Teams on OpenSSL 3.4 or earlier relying on OQS-provider for experimentation should plan the OpenSSL 3.5 upgrade path — particularly for any FIPS 140-3 bound workloads, where OQS-provider is not validated.
Block 6
This Week's Log — Edition #4
▼
Aug 26, 2026RFC 10024 published. IETF formally standardizes Post-Quantum Traditional hybrid key agreement for TLS 1.3. Defines X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024 as Standards Track. Edition #4 Block 5 focus. (Source: IETF datatracker)
Aug 2026Internet PQC measurement study published. 50.7% of analyzed domains remain fully vulnerable to quantum attacks. 49.3% have partial readiness via hybrid key exchange. Primary driver: ML-KEM-768 in TLS via cloud/CDN infrastructure. (Source: arxiv 2026)
Aug 26, 2026FIPS 140-2 Historical deadline: 26 days remaining. September 21, 2026. New implementations and procurements should target FIPS 140-3. Existing validated modules continue to be valid.
Aug 2026Cloudflare post-quantum origin authentication entering the mid-2026 targeted deployment window. CDN-to-origin PQC gap expected to close for Cloudflare customers imminently.
Aug 2026FIPS 206 (FN-DSA) remains in draft as of Q2 2026. Compact lattice-based signature scheme; smaller than ML-DSA. Finalization expected 2026-2027.
Aug 19, 2026[Edition #3] HAWK algorithm withdrawn from NIST Round 3 additional signatures. Anthropic Claude Mythos Preview identified nontrivial automorphism reducing effective key strength. FIPS 203/204/205 unaffected.
Aug 12, 2026[Edition #2] EO 14412 PQC contractor implications reviewed. Apple iOS 26 PQC completion documented. CNSA 2.0 software/firmware signing deadline (2025) passed.
Aug 6, 2026[Edition #1] Baseline established. FIPS 203/204/205, CNSA 2.0, PQC inventory framework, HNDL risk model documented.
Block 7
Momentum Indicators
▼
Momentum indicators track PQC migration maturity signals across the public internet, the vendor ecosystem, and this publication's own archive. The self-referential indicator (frequency of ML-KEM references in our own reports) measures how often quantum-relevant threat intelligence surfaces in daily security operations — a real-world signal of the domain's growing operational relevance.
49.3%
Internet domains with partial PQC readiness (hybrid key exchange deployed) — 2026 measurement study. Up from effectively 0% at FIPS 203 publication date (August 2024).
>50%
Cloudflare human web traffic using post-quantum key agreement. The clearest single indicator of real-world deployment at scale.
RFC 10024
IETF hybrid PQ/T TLS 1.3 standardization complete — August 2026. Draft-based deployments can now claim Standards Track compliance. A qualitative milestone: experimental → production.
3 → 4
ML-KEM references in the DeepFalcon1313 threat intelligence archive this week — up from 2 in Edition #3 (both FudModule v3.1 context). RFC 10024 coverage adds a fourth reference from this edition itself, including two new contextual references in the hybrid TLS adoption thread.
Self-referential indicator methodology: This edition scanned all deepFalcon1313 threat intelligence archives (Editions #1–#4, all daily vulnerability and threat intel reports through August 26, 2026). ML-KEM references appear in: (1) FudModule v3.1 kernel-mode rootkit C2 channel using ML-KEM (August 12 PT report), (2) CNSA 2.0 compliance thread (August 6 and August 12 editions), (3) RFC 10024 hybrid TLS (this edition, Block 1 and Block 5). The trend — from zero operational references in the threat intel stream in July to four by late August — reflects the growing intersection of PQC standards work with operational security practice. The FudModule ML-KEM C2 reference is the most significant: it shows a nation-state actor (Lazarus Group) integrating post-quantum algorithm-adjacent techniques into attack infrastructure, not just defense.