Post-Quantum Saturday — July 18 2026 Weekly Update

TL;DR — This Week

• liboqs 0.16.0 released (July 9, 2026): Stable milestone with full NIST-standardized algorithm support (ML-KEM, ML-DSA, SLH-DSA, HQC); SPHINCS+ removed; improved performance and bindings. Canonical open-source reference for PQC integration.
• Executive Order 14412 (June 22, 2026): Signed by President Trump; sets Dec 31, 2030 deadline for federal key establishment (encryption) and Dec 31, 2031 for digital signatures/authentication on high-value assets. Requires agency leads, plans, CBOM guidance, and contractor compliance. Accelerates prior 2035 timelines by ~5 years.
• FIPS 140-3 deadline pressure: Remaining FIPS 140-2 modules to Historical status Sept 21, 2026; only 140-3 acceptable for new federal procurement. Drives vendor HSM/secure element roadmaps.
• ISO standardization milestone: Post-Quantum's Classic McEliece becomes first PQC algorithm to achieve global ISO standard (July 2026).
• Blockchain & Freedom-tech focus: New papers on Bitcoin/Ethereum migration strategies; Ethereum roadmap highlights account abstraction advantages; calls for BIP-style soft forks and dual-address periods.
• Freedom-tech takeaway: Decentralized systems (Nostr, Bitcoin wallets, mesh networks, confidential compute) must prioritize hybrid KEMs, SLH-DSA for long-term signatures, and crypto-agility frameworks. 2026-2027 is the critical window for inventory and prototyping before external deadlines collide with technical debt.

The Week in Detail

1. liboqs 0.16.0 — Canonical Open-Source PQC Library (July 9, 2026)

The Open Quantum Safe project released liboqs v0.16.0, the first fully stable post-standardization release.

• Full support for FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), HQC (selected 2025), with FN-DSA work ongoing.
• SPHINCS+ removed (replaced by SLH-DSA); performance improvements especially for hash-based signatures.
• Ecosystem updates: oqs-provider (OpenSSL 3.x), language bindings (Rust, Go, Python, .NET), PQClean implementations.
• GitHub: https://github.com/open-quantum-safe/liboqs/releases/tag/0.16.0
• Relevance: Now the reference implementation for any Ungovernable.tech stack. Use for TLS/SSH (via oqs-provider), custom protocols (Nostr PQ key exchange, Bitcoin PQ primitives), or attestation in confidential computing. Avoid legacy Kyber/Dilithium parameter sets.

2. Executive Order 14412 & Federal Migration Acceleration

On June 22, 2026, President Trump signed Executive Order 14412, "Securing the Nation Against Advanced Cryptographic Attacks," accompanied by OMB Memorandum M-26-15.

Key requirements and timelines: - Agencies must identify PQC migration leads (within 30-90 days of EO). - Prioritized migration of high-value assets (HVAs) and high-impact systems: - Key establishment (encryption): Dec 31, 2030 - Digital signatures/authentication: Dec 31, 2031 - Federal contractors required to comply with PQC FIPS by end of 2030. - CISA/NIST to issue CBOM (Cryptographic Bill of Materials) guidance within 270 days. - Google’s March 2026 announcement sets a 2029 PQC migration target, not a Q-Day estimate.

Sources and context: - White House EO: https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/ - Cloudflare analysis: https://blog.cloudflare.com/post-quantum-eo-2026/ - CISA PQC Initiative: https://www.cisa.gov/topics/risk-management/quantum

Freedom-tech relevance: While focused on federal systems, the EO creates de-facto industry standards and supply-chain pressure. Decentralized projects should mirror the inventory + migration planning approach to avoid being left behind or vulnerable to "harvest now, decrypt later" on long-lived keys/identities.

3. FIPS 140-3 Enforcement & Hardware Migration

NIST CMVP will retire remaining FIPS 140-2 certificates to Historical status on September 21, 2026. Only FIPS 140-3 modules will be accepted for new federal procurement.

• Average validation timeline now >500 days.
• Direct impact on PQ-capable HSMs (Thales, Utimaco, AWS CloudHSM, Azure Dedicated HSM) and secure elements.
• CISA guidance on PQC product categories updated earlier in 2026.

This accelerates vendor timelines for ML-KEM/ML-DSA support in hardware roots of trust, critical for confidential computing attestation and key sealing.

4. ISO Standardization: Classic McEliece

Post-Quantum (company) announced Classic McEliece as the first post-quantum cryptography algorithm to achieve global ISO standardization (July 16, 2026 reports).

• Code-based KEM with strong conservative security profile (long history, no major breaks).
• Complements lattice-based (ML-KEM) and hash-based (SLH-DSA) standards.
• https://industrialcyber.co/news/post-quantums-classic-mceliece-becomes-first-post-quantum-cryptography-algorithm-to-achieve-global-iso-standardization/

Useful as a backup or for high-assurance use cases in freedom-tech (e.g., long-term key encapsulation in decentralized storage or messaging).

5. NIST Additional Signatures & PIV Integration

Round 3 of NIST's Additional Digital Signature Standardization (9 candidates: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV) entering 2-year evaluation period.

• Working drafts progressing for PIV (Personal Identity Verification) integration of ML-DSA/ML-KEM.
• Focus on compact signatures for constrained environments (smart cards, IoT, hardware tokens).

Relevant for Web of Trust, Nostr identity, and mesh attestation schemes.

6. Blockchain & Cryptocurrency Migration Research

Increased focus on quantum risks to Bitcoin and Ethereum:

• Google researchers (April 2026 onward) warning of accelerated Q-Day timelines; urging immediate migration planning.
• New paper: "Migrating Bitcoin and Ethereum Addresses to the Quantum Blockchain Era" (eprint 2026/352) proposes hybrid classical/PQ authorization for revealed-key assets and STARK-verifiable ownership for hidden keys.
• Ethereum roadmap emphasizes account abstraction advantages for PQ migration (EIP-7701, leanSig XMSS/Poseidon2 experiments).
• Bitcoin discussions around BIP-360 soft forks, dual-address periods, and 76-day full UTXO migration estimates.
• Project Eleven and others predicting Q-Day as early as 2030.

Ungovernable.tech angle: Bitcoin PQ Migration and Hybrid KEM Migration notes should incorporate these strategies. Hybrid schemes (X25519+ML-KEM) remain the pragmatic near-term path for wallets and identity systems. SLH-DSA or stateful hash signatures for long-term cold storage.

Evidence at a Glance

Primary sources

• Google’s 2029 PQC migration target