Post-Quantum Saturday — September 05 2026 Weekly Update

Weekly companion to Overview - Post-Quantum Cryptography, PQC Deployment and Libraries Tracker, The Dihedral Coset Attack Line, algorithm notes (ML-KEM, ML-DSA, SLH-DSA, HQC, FN-DSA Falcon), Merkle Tree Certificates, Hybrid KEM Migration, and Bitcoin PQ Migration. This note covers the two-week window since the August 22 update — there was no August 29 run, so the August 23 – September 4 window is covered here in full.

TL;DR — This Fortnight

1. Pure ML-KEM for TLS 1.3 was approved by the IESG on September 3, 2026. draft-ietf-tls-mlkem-10 went from IESG Evaluation → "Approved-announcement sent" in a single day, the "Approve" ballot was closed, and IANA action moved to In Progress (datatracker history). Deirdre Connolly posted -10 on September 2; Amanda Baber cleared IANA the same day; Tommy Jensen and Gorry Fairhurst recorded No Objection, Christopher Inacio Yes. This is the outcome Bernstein's four-part Last Call filing (75 sourced, non-withdrawn objections) did not prevent — the document publishes as Informational with the registry marking Recommended=N. Jensen's ballot comment is the tell: he cleared it because the draft now makes plain, in the document body, what Recommended=N actually means, putting it in "documenting real-world practice for interop and central visibility is good even if Recommended=Y isn't true." Éric Vyncke noted for the record that FIPS/NIST are US organizations. The appeal path Bernstein signalled (RFC 2026 complaint) now runs against an approved document rather than a pending one.

2. The inversion nobody predicted: pure ML-KEM cleared while ML-DSA-in-TLS sits frozen under appeal. draft-ietf-tls-mldsa-05 was approved and announced on July 8, 2026 — and then, the same day, Roman Danyliw pulled it back: "The IESG has received an appeal request on the processing of this document. While the IESG reviews this request, the document is being held." IESG state reverted to Approved-announcement to be sent::AD Followup, IANA action state to On Hold, action holder Deb Cooley, and it has not moved in 59 days as of this writing. Cloudflare's public timeline expected "RFC for use of ML-DSA in TLS, August 2026." That date has passed. The practical consequence for anyone planning PQ authentication: the key-exchange RFC track is done, and the authentication track is procedurally stuck.

3. Composite ML-DSA is in the RFC Editor queue — the enterprise-PKI path is effectively standardized. draft-ietf-lamps-pq-composite-sigs-19 (Ounsworth, Gray, Pala, Klaußner, Fluhrer) now shows IESG state RFC Ed Queue, IANA action state RFC-Ed-Ack, expert reviews OK, RFC Editor status In Progress (First Edit), last touched 2026-08-26. Intended status Proposed Standard. Prior vault entries had this at "LAMPS WG Last Call, RFC target Q4 2026" — it beat that target's process milestones. Composite ECDSA+ML-DSA in one X.509 certificate is now the near-term answer for private/enterprise PKI, distinct from Merkle Tree Certificates for the public web.

4. A genuine asymptotic lattice result: SVP in 2^0.7314n classical time (ePrint 2026/1587, Gao, Feng, Hu; PDF updated 2026-08-31). Randomized classical algorithm for exact Euclidean SVP on arbitrary full-rank lattices in 2^(0.73134n+o(n)) time and 2^(n/2+o(n)) space. It beats the 2^(n+o(n)) classical bound of Aggarwal–Dadush–Regev–Stephens-Davidowitz (STOC 2015) and the best known worst-case quantum bounds of Aggarwal–Chen–Kumar–Shen (2^0.9497n without QRAM, 2^0.8345n with). Technique: build a random prime-index superlattice Γ ⊃ L, run the ADRS discrete Gaussian sampler on Γ above the smoothing threshold, keep the shortest sample that lands back in L. Deployment impact: none. Exact-SVP exponents in n are not what determines ML-KEM's security margin (Core-SVP estimates against sieving in the relevant block sizes are), and a constant-factor exponent improvement on worst-case SVP does not translate to Module-LWE parameter breakage. What it does do is make the year's second "the exponents keep dropping" data point — and this one is peer-reviewable mathematics rather than a retracted claim.

5. A cryptanalytic result that does move parameters — but for FHE, not ML-KEM. Hou & Jiang, "Careful with the Ring: Enhanced Hybrid Decoding Attacks against Module/Ring-LWE" (ePrint 2026/366, CRYPTO 2026, full version updated 2026-08-30, merged with 2026/279). They exploit the ring structure of Z_q[x]/(x^N+1) — the exact ring family ML-KEM and FHE schemes use — to accelerate the guessing and decoding stages of hybrid decoding, giving a complexity improvement linear in N in the sparse-secret setting, 17×–114× faster than the state of the art on known-broken benchmark instances. Applied to sparse Ring-LWE parameter sets from five recent FHE papers, they improve attack complexity by up to 13 bits, and 12 of 16 parameter sets fall below their targeted 128-bit security level. ML-KEM does not use sparse secrets, so it is out of scope — but this is a direct hit on published FHE parameterizations and belongs on the FHE watch as much as the PQC one. It is also the counterexample to "algebraic structure has never been exploited to speed up attacks."

6. Classic McEliece: the August distinguisher gets a costing companion. Markku-Juhani Saarinen posted "Bit Operation Cost of `Holdout'' Key-Recovery Attacks Against Classic McEliece" (ePrint [2026/1786](https://eprint.iacr.org/2026/1786), Aug 24) — a self-contained arithmetic model for a prospective key-recovery attack on binary Goppa codes. Modeled totals: 2^172–2^235 gates affine/dense, 2^146–2^208 projective/nested; formceliece348864` one configuration reaches 2^142.15 modeled gates but needs 2^61.7 bits of retained state; an exhaustive scan of 19,338 singleton configurations finds a 2^114.35 supplier-complexity floor that no downstream-only improvement can cross. Saarinen explicitly labels it a living tracking document and states none of the tallies is an established break. Read alongside last fortnight's Ghoshal–Ishai–Jain–Sun quasipolynomial distinguisher (2026/1630): code-based confidence is being re-costed in public, in the open, two papers deep, while HQC standardization is still pending.

7. ML-DSA implementation research shifted from "is it fragile" to "make it fast and quiet." WeaveTLS (ePrint 2026/1828, Liu, Cheng, Zhang, Aug 28) executes ML-DSA authentication across concurrent mutual-TLS connections via a stackless OpenSSL continuation in an nginx worker, batching into 1/4/8-request AVX-512 kernels with rejection-aware slot refill. Result: 2.81–4.31× one-core nginx mTLS throughput over OpenSSL's default ML-DSA path, ML-DSA-65 signing 1.90× faster than lockstep scheduling — wire-transparent, TLS authentication barrier preserved. Bonus security property: cohort publication weakens the client-visible rejection-timing signal, dropping attempt-count/latency correlation to 0.063 at concurrency 16 and 0.008 at 64 (singleton execution retains the signal). Adjacent this fortnight: an open EM side-channel dataset for ML-KEM (ePrint 2026/1851, Sep 1) and a rank-ceiling analysis of single-twiddle perturbation faults on the forward NTT in ML-KEM/ML-DSA keygen (ePrint 2026/1188, updated Sep 4).

8. Library plumbing: liboqs main now carries mlkem-native and mldsa-native v2.0.0. Commits landed Aug 31 (mldsa-native → v2.0.0, #2522) and Sep 3 (mlkem-native → v2.0.0, #2521), plus ML-DSA extmu message-length and stateful-signature test fixes (#2541, #2542). Current release remains liboqs 0.16.0 (2026-07-09, 3,054 stars, pushed 2026-09-03) — the v2 formally-verified backends are queued for the next release, not shipped yet. mldsa-native v2.0.0 (2026-08-07) is that project's first stable release: C90, AArch64 Neon + x86_64 AVX2 backends via the SLOTHY super-optimizer, memory- and type-safety proofs. mlkem-native v1.3 gets LTS bugfixes only, through February 2027 inclusive.

9. OpenSSL shipped a multi-CVE security release on August 25 across every PQ-capable branch: 4.0.2, 3.6.4, 3.5.8. Most severe is Moderate; the set includes a QUIC server double-free on INITIAL packets (CVE-2026-18798), a heap buffer overflow in CMS key unwrapping (CVE-2026-63072), CMP server invalid pointer dereference and format-string issues (CVE-2026-63076, CVE-2026-63073), plus several memory-exhaustion paths in QUIC/DTLS/CMP and an OCSP client leak. None is PQ-algorithm-specific, but 3.5+ is where ML-KEM/ML-DSA/SLH-DSA live — every PQ pilot running OpenSSL needs this patch. Note 4.0.x is not an LTS branch.

10. Ethereum abandoned Poseidon for its post-quantum L1 roadmap (August 13). EF researcher Justin Drake announced the pivot to SHA-2 or BLAKE2s, calling it the end of an eight-year, eight-figure effort; the Poseidon1 Collision Prize (a $992K budget scheduled to run to January 2029) had been paused twelve days earlier, August 1. Nobody broke full-round Poseidon. What changed is the other side of the trade: binary-field proof systems (Binius, Diamond–Posen at EUROCRYPT 2025, and the BinarySpartan/Neo line — ePrint 2026/1656, 2026/242) made standard bit-oriented hashes cheap enough to prove that an arithmetization-friendly hash stopped being necessary. The lean-Ethereum design makes the hash the single primitive across consensus (leanXMSS hash-based aggregate signatures, ~3,000 bytes vs 96 for BLS), data availability, and zkVM — with ~898K active validators, roughly 374,000 hash verifications per second, so the hash choice is the roadmap. The transferable lesson for freedom tech: a primitive chosen to fit the performance constraint of its moment becomes a liability when the constraint moves, and engineering constraints move faster than confidence accumulates around a young design. Cross-reference STARKs and Bitcoin PQ Migration. Ethereum's 2nd Annual PQ Research Retreat is 9–12 October 2026, Cambridge UK.

11. Blockchain PQ migration research updated: hidden-key assets get a STARK treatment. ePrint 2026/352 (Kiraz, Kardas, revised Sep 1) separates revealed-key assets (Bitcoin outputs and EOAs whose pubkeys are already on-chain → hybrid classical/PQ authorization) from hidden-key assets (P2PKH/P2WPKH, unused EOAs, pubkey hidden behind a hash → STARK-verifiable ownership relation binding legacy address to a PQ pubkey without ever publishing the legacy EC public key), plus one-way migration-registry semantics and an SP1 prototype. They also draw the line that matters: transparent-STARK verification is the post-quantum path; Groth16/PLONK wrapping is only a current-EVM compatibility shim. Directly relevant to Bitcoin PQ Migration.

12. Policy clock: three dates inside four weeks. September 16, 2026 — GSA's 2026 Post-Quantum Cryptography Summit (hybrid; .gov/.mil only; 20 F Street + Zoom for Government). September 21, 2026 — FIPS 140-2 certificates move to Historical status; only FIPS 140-3 validated modules qualify for new federal procurement, against a FIPS 140-3 validation backlog averaging 500+ days. October 22, 2026 — OMB M-26-15 deadline for every civilian agency to submit its PQC Migration Plan to OMB and ONCD (risk-based prioritization, automated inventory methodology, crypto-agility architecture, third-party coordination, funding estimates, governance roles). M-26-15's five phases run 2026→2035: discovery 2026–27, pilots 2027–28, prioritized key-establishment migration 2028–30, signature migration 2031, full migration 2035. National Security Systems stay under CNSA 2.0. The federal signature deadline being a full year behind key establishment now mirrors Google Cloud's roadmap exactly — and mirrors the IETF reality in item 2.

13. DCP epilogue. The Gupte–Ragavan–Zhandry no-go (ePrint 2026/1693) received a metadata/version update September 1; the Lean 4 refutation repo (sragavan99/lean-ePrint-2026-1591-refutation, last push Aug 13) is quiet. No post-conference statement from Simon. The line is closed; see The Dihedral Coset Attack Line.

Freedom-tech implication: for the first time the transport story is finished on paper — hybrid X25519MLKEM768 is RFC 10024 and pure ML-KEM now has IESG approval, so both options exist as citeable documents and the argument moves entirely to which you deploy (still: hybrid). The authentication story is the opposite of finished, and this fortnight shows exactly which parts are stuck and why: composite ML-DSA reached the RFC Editor, ML-DSA-in-TLS is frozen behind an appeal with a 59-day clock, and Merkle Tree Certificates are two months static at WG-document stage while a CA has publicly committed to shipping them next year. Meanwhile the cryptanalysis that actually cost someone security bits this fortnight hit FHE sparse-secret Ring-LWE parameters, not ML-KEM — a reminder that structured-lattice risk is not uniform across the schemes that share the ring. And Ethereum retiring an eight-year hash bet because the proof systems moved is the cleanest available argument for crypto-agility as architecture rather than as slogan.

The Fortnight in Detail

1. Pure ML-KEM: what actually happened in the IESG

The sequence, from the datatracker history:

Two things are worth separating. Procedurally, the chairs never published the numbers or weighting method behind the rough-consensus call — Salowey's July 20 reply to the European Commission's Fabiana Da Pieve stated the chairs "do not intend to release any further detailed analysis." That is the substance of the pending complaint, and IESG approval does not answer it. Technically, nothing changed: pure ML-KEM-512/768/1024 NamedGroups rest confidentiality entirely on FIPS 203, are marked Recommended=N, and ship in an Informational RFC, while the hybrid group is standards-track with Recommended=Y. Sustained technical opposition (Kobeissi on compositional security, Lange, Bernstein) was recorded and overridden rather than resolved.

Operational guidance is unchanged and unambiguous: deploy hybrid. The pure groups exist so that procurement regimes mandating a standalone NIST algorithm have a stable reference to point at — not because anyone in the WG argued they are the better engineering choice. See Hybrid KEM Migration.

2. The ML-DSA appeal freeze

draft-ietf-tls-mldsa (Hollebeek/DigiCert, Schmieg/Google, Westerbaan/Cloudflare; Informational; shepherd Sean Turner) cleared Tommy Jensen's blocking DISCUSS on July 8 after text revisions and was approved and announced the same day — then held within hours on receipt of an appeal request. Roman Danyliw's note records a procedural detail worth keeping: "Approved Announcement Sent" has no sub-states an AD can use to hold a document, so the document had to be moved backwards into "Approved-announcement to be sent" to be holdable at all. IANA action: On Hold. No telechat date. No movement since.

Note the causal chain in Jensen's September 2 ML-KEM ballot comment: he cleared ML-KEM specifically because it "followed the same kind of edits I requested when I issued a blocking DISCUSS on the ML-DSA document." The two documents' fates are entangled — the editorial fix that unblocked ML-DSA in July is what unblocked ML-KEM in September, while ML-DSA itself remains held on process grounds.

What this means for planning: if you are scheduling PQ authentication work off published RFCs, ML-DSA in TLS is not one yet, and the delay is procedural rather than technical. Composite ML-DSA (RFC Ed Queue) will likely publish first. See ML-DSA.

3. Where each PQ authentication document actually stands (September 5, 2026)

The two-month stall on both -tls-mldsa and -plants-merkle-tree-certs is the single most useful fact in this update: the entire public-web PQ authentication path is currently blocked or early-stage, while Let's Encrypt has a staging commitment for late 2026. Either the PLANTS document moves fast this autumn or the staging environment ships ahead of its specification's WG process.

4. Reading the lattice results together

Three lattice items landed in this window, and they sit at different distances from anything deployed:

The pattern this library has been tracking since June holds: structural and asymptotic results keep arriving; none has moved a deployed ML-KEM/ML-DSA parameter set; the results that do bite land on adjacent schemes that share the algebra but not the parameter regime (FHE here, HAWK's ring choice in July). That is the empirical case for crypto-agility stated without exaggeration.

5. Implementation-layer maturity signals

Worth naming as a group, because together they mark a phase change from "does it work" to "does it work at line rate, quietly, with proofs":

• mldsa-native v2.0.0 — first stable release; formal memory/type-safety proofs; SLOTHY-optimized Neon and AVX2 backends; API aligned with mlkem-native v2.
• mlkem-native v2.0.0 — removes SUPERCOP aliases and the legacy config path, splits MLK_ERR_FAIL into specific error codes; v1.3 LTS bugfix-only through February 2027.
• Both now in liboqs main (Aug 31 / Sep 3) — next liboqs release inherits verified backends.
• WeaveTLS — 2.81–4.31× nginx mTLS throughput, and a security side effect (rejection-timing correlation collapsing under cohort publication) rather than a security cost.
• Open EM side-channel dataset for ML-KEM (2026/1851) — public datasets are how side-channel evaluation stops being vendor-private.
• Twiddle-perturbation fault rank ceiling (2026/1188) — first quantification of how much a single NTT twiddle fault disturbs the secret during keygen, where prior work either zeroed all twiddles (ML-KEM keygen) or hit individual ones (ML-DSA signing).

Evidence at a glance

Forward watchlist (next 7–21 days)

1. RFC number assignment for draft-ietf-tls-mlkem and whether an RFC 2026 formal complaint is filed against the consensus call after approval.
2. Any movement on the ML-DSA-in-TLS appeal — 59 days held; watch datatracker.ietf.org/doc/draft-ietf-tls-mldsa/history/ and the IESG appeals artifacts page.
3. draft-ietf-plants-merkle-tree-certs-06 — a -06 or a WGLC announcement is the signal that Let's Encrypt's late-2026 staging target is on track; continued silence is the signal it isn't.
4. liboqs 0.17.0 — first release carrying mlkem-native/mldsa-native v2.0.0 verified backends.
5. September 16 GSA PQC Summit — agenda was unpublished at time of writing; watch for federal marketplace/procurement guidance that extends the July CISA Product Categories.
6. September 21 FIPS 140-2 sunset — watch for vendor scrambles and validation-backlog complaints.
7. October 22 OMB M-26-15 plan deadline — whether any agency plan becomes public.
8. FIPS 206 (FN-DSA) final — still IPD in comment resolution; late 2026 / early 2027 expected. See FN-DSA Falcon.
9. Responses to 2026/366 — whether any FHE library (OpenFHE, Lattigo, HEaaN, TFHE-rs) reparameterizes its sparse-secret sets.
10. Ethereum PQ Research Retreat, October 9–12, Cambridge UK — hash choice, leanSig/leanXMSS aggregate-signature parameters.

Primary sources

• IETF datatracker — draft-ietf-tls-mlkem history, draft-ietf-tls-mldsa, draft-ietf-lamps-pq-composite-sigs, draft-ietf-plants-merkle-tree-certs
• ePrint 2026/1587 — SVP in 2^0.7314n via discrete Gaussian sampling on superlattices
• ePrint 2026/366 — Careful with the Ring: enhanced hybrid decoding against Module/Ring-LWE (CRYPTO 2026)
• ePrint 2026/1786 — Bit operation cost of Holdout key-recovery attacks against Classic McEliece
• ePrint 2026/1828 — WeaveTLS: cross-connection ML-DSA authentication in mTLS
• ePrint 2026/352 — Migrating Bitcoin and Ethereum addresses to the quantum blockchain era
• ePrint 2026/1693 — GRZ: the ePrint 2026/1591 quantum algorithm does not solve DCP
• ePrint 2026/650, 2026/1188, 2026/1851
• OpenSSL 4.0.2 release notes
• liboqs, mlkem-native, mldsa-native
• OMB M-26-15; GSA 2026 PQC Summit
• Ethereum quantum-resistance roadmap; Poseidon Initiative; lean Ethereum