This Quantum-Safe Cryptography Quarterly Check-In cuts through the noise to show where the field stands right now, what changed this quarter, and what’s next before the threat becomes a breach.
Post-quantum cryptography (PQC) is no longer a research paper dream. NIST has advanced key standards toward finalization, and production-ready libraries are landing in popular languages. We are moving quickly from theory to mandatory adoption. The algorithms CRYSTALS-Kyber and CRYSTALS-Dilithium remain frontrunners for encryption and signatures, while Falcon and SPHINCS+ fill niche but vital roles.
Global vendors are beginning staged rollouts. The shift is hitting TLS, VPNs, firmware signing, and secure storage. Hybrid modes—combining classical and quantum-safe algorithms—are bridging the gap for systems that cannot risk downtime. This quarter saw major ecosystem upgrades in OpenSSL, BoringSSL, and LibreSSL with PQC hybrid cipher suites available in test branches. Leading cloud platforms have begun offering opt-in PQC key exchange for select services.
On the attacker side, state-level quantum R&D budgets continue to climb. The “harvest now, decrypt later” model is becoming more than theory. Any long-lived sensitive data is already in scope for future quantum decryption. Audit cycles must reflect this, and so must your key management plans.