ungovernable.tech
search 245 entries/ctrl k

Briefing · Post-Quantum Saturday

Post-Quantum Saturday — July 11 2026 Weekly Update

published 2026-07-11 5 min read Post-Quantum Cryptography

TL;DR — This Week

  • liboqs 0.16.0 released (July 9, 2026): Stable release with full ML-KEM/ML-DSA/SLH-DSA/HQC support, improved SLH-DSA performance, and updated oqs-provider bindings. Major milestone for open-source PQC integration.
  • FIPS 140-3 enforcement deadline: Remaining FIPS 140-2 certificates move to Historical status on September 21, 2026. Only FIPS 140-3 modules acceptable for new federal procurement — accelerates vendor timelines for PQ-capable HSMs and secure elements.
  • NIST PIV + Additional Signatures: Working drafts for PIV ML-DSA/ML-KEM integration progressing; 9 Round 3 signature candidates (FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV) entering 2-year evaluation.
  • Policy & Industry: OMB M-26-15 agency plan submissions underway; Microsoft, AWS, Cloudflare, Google continuing aggressive internal + customer tooling rollouts. EU/UK/Japan roadmaps aligning on 2030 critical-infrastructure deadlines.
  • Freedom-tech takeaway: Decentralized projects (Bitcoin wallets, Nostr identity, mesh attestation, confidential compute) must treat 2030 as the external hard stop. Use liboqs 0.16.0 + oqs-provider as the reference; prioritize hybrid designs and crypto-agility frameworks now.

The Week in Detail

1. liboqs 0.16.0 — Open Quantum Safe Milestone (July 9, 2026)

The Open Quantum Safe project released liboqs v0.16.0, the first post-0.15.0 stable branch with complete NIST-standardized algorithm coverage.

  • Full support for ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205), HQC (selected 2025), and ongoing FN-DSA work.
  • Performance improvements, especially for SLH-DSA parameter sets.
  • CVE fixes and constant-time hardening continued from prior releases.
  • Ecosystem: oqs-provider (OpenSSL 3.x), language bindings (Rust, Go, .NET, Python), and PQClean clean-room implementations updated in lockstep.
  • GitHub: https://github.com/open-quantum-safe/liboqs/releases/tag/0.16.0

Relevance to Ungovernable.tech: This is now the canonical reference implementation for any freedom-tech stack needing PQC. Integrate via oqs-provider for TLS/SSH or direct API for custom protocols (e.g., Nostr key exchange, Bitcoin PQ wallet primitives). Avoid pre-standard "Kyber/Dilithium" parameter sets still floating in old demos.

2. FIPS 140-3 Validation Sunset & Procurement Pressure (Sept 21, 2026 Deadline)

NIST CMVP will move all remaining FIPS 140-2 validated modules to Historical status on September 21, 2026. Only FIPS 140-3 modules will be acceptable for new federal system procurement thereafter.

  • Average FIPS 140-3 validation timeline now exceeds 500 days (42% longer than 140-2).
  • Direct impact on PQ-capable HSMs, secure elements, and cryptographic modules from vendors (Thales, Utimaco, AWS CloudHSM, Azure Dedicated HSM, etc.).
  • CISA guidance on product categories for PQC technologies updated January 2026; ongoing tracking of hardware/software that supports NIST standards.

Relevance: Any Ungovernable project relying on hardware roots of trust (YubiKey-style tokens, TPMs, secure enclaves for attestation or key storage) must verify FIPS 140-3 + PQC roadmaps from vendors. Long-lived sealed secrets or root keys benefit from early hybrid wrapping with ML-KEM.

3. NIST Additional Digital Signatures — Round 3 Candidates (May 2026 Announcement, Ongoing 2026)

NIST advanced nine digital signature algorithms to the third round of the Additional PQC Standardization Process (evaluation phase ~2 years):

  • Candidates: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV.
  • Goal: Diversify beyond lattice-based ML-DSA; address size, speed, or side-channel trade-offs; provide backups or specialized use cases (e.g., very short signatures, MPC-friendly).
  • FN-DSA (Falcon) and HQC continue on their own standardization tracks (draft FIPS expected 2026-2027).

Relevance: ML-DSA remains the primary recommendation for most deployments in 2026. Monitor Round 3 for future diversity; do not delay migration waiting for "better" signatures. SLH-DSA (hash-based) already provides the conservative backup.

4. Policy Momentum — EO 14412, PIV Integration, International Alignment

  • Executive Order 14412 (June 22, 2026): "Securing the Nation Against Advanced Cryptographic Attacks." Sets Dec 31, 2030 deadline for federal sensitive systems PQC transition (encryption); 2031 for authentication. Directs contractors and agencies to inventory, plan, and migrate.
  • NIST PIV Working Drafts (June 2026): Initial drafts integrating ML-DSA signatures and ML-KEM key establishment into Personal Identity Verification standards — first concrete federal hardware token path.
  • International: EU NIS2/DORA-aligned roadmaps targeting 2030 for critical infrastructure; UK NCSC PQC Industry Pilot; Japan considering 2035 horizon. G7 financial sector coordination accelerating.

Relevance to Ungovernable.tech: Government mandates are creating de-facto standards and tooling (liboqs, oqs-provider, hybrid TLS patterns) that decentralized projects can and should adopt for crypto-agility. The policy hammer has landed — inventory classical keys in Nostr relays, Bitcoin wallets, mesh identity systems, and confidential compute attestation now.

5. Industry Deployment Signals (Ongoing into July 2026)

  • Microsoft: Expanded Secure Future Initiative with explicit PQC for TLS 1.3, crypto-agility frameworks, code signing, and attestation.
  • Google: 2029 target for full PQC migration across infrastructure (Willow chip + updated quantum estimates accelerating timelines).
  • AWS/Cloudflare: Hybrid PQ TLS widely available; expanding to KMS, Secrets Manager, edge services.
  • Messaging & Protocols: Signal PQXDH, Apple PQ3, OpenSSH ML-KEM hybrids, OpenSSL 3.5+ PQC support maturing.
  • Hardware: PQ-enabled secure elements and HSMs rolling out 2025-2026; FIPS 140-3 validation queue growing.

Evidence at a Glance (July 2026)

Area Status Key Artifacts Freedom-Tech Priority
NIST Standards Mature (ML-KEM, ML-DSA, SLH-DSA) FIPS 203/204/205 (2024); HQC/FN-DSA in progress High — adopt now
Open-source Libraries Production-ready liboqs 0.16.0 (Jul 2026), oqs-provider Critical
TLS/SSH Deployment Hybrid shipping X25519MLKEM768, OpenSSH mlkem hybrids High
Signatures (Web PKI) Laggard Classical dominant; ML-DSA pilots Medium-High
Hardware Tokens (PIV) Early drafts NIST PIV ML-DSA/ML-KEM working drafts Medium
Policy/Compliance Enforceable deadlines EO 14412 (2030/31), FIPS 140-3 (Sep 2026) High (external pressure)
Additional Algorithms Research active 9 Round 3 signature candidates Monitor

Migration Planning for Decentralized Systems

  1. Inventory (immediate): Classical public keys in long-lived artifacts (blockchain addresses, Nostr pubkeys, attestation quotes, sealed backups).
  2. Hybrid by default: X25519 + ML-KEM-768 for key exchange; ML-DSA-65 or SLH-DSA for signatures where size allows.
  3. Crypto-agility: Design protocol negotiation so algorithms can be swapped without breaking compatibility (see IETF PQUIP drafts).
  4. Hardware roots: Prioritize vendors publishing explicit PQC + FIPS 140-3 roadmaps.
  5. Testing: Use liboqs test vectors and PQClean for reference implementations.

Related Files

Next update: July 18, 2026. Focus expected on FIPS 140-3 vendor announcements, additional Round 3 evaluation progress, and decentralized wallet/identity PQ experiments.