Post-Quantum Saturday — September 19 2026 Weekly Update

Weekly companion to Overview - Post-Quantum Cryptography, PQC Deployment and Libraries Tracker, The Dihedral Coset Attack Line, algorithm notes (ML-KEM, ML-DSA, SLH-DSA, HQC, FN-DSA Falcon), Merkle Tree Certificates, Hybrid KEM Migration, and Bitcoin PQ Migration. This note covers the week since the September 12 update — the September 12–18 window, dominated by a clean negative result on direct LWE-based authenticated key exchange (ePrint 2026/2017, ASIACRYPT 2026, Hong Kong Dec 7–11), the GSA PQC Summit on September 16, and the continued slow-motion publication of the three PQ-TLS rail documents.

TL;DR — This Week

1. A clean negative on direct LWE-based AKE: ePrint 2026/2017, Ding/Yu/Pan/Cheng/Weng (Sep 14, ASIACRYPT 2026 accepted). The paper On the eCK Security of MQV-Style LWE-Based Authenticated Key Exchange definitively shows that ZZDSD-AKE (Zhang et al., EUROCRYPT 2015) cannot achieve eCK security — the 11-year open question is resolved negatively — and that GDLL-KE (Gao et al., IEEE TC 2018), the documented "hardened" variant with randomized noise, falls to a geometric signal-leakage attack in roughly 180 queries (vs ~1,700 for the unhardened ZZDSD). The attack is an implementation / signal-leakage class, not a cryptanalytic break of the underlying Module-LWE problem. The implication for the standards world is decisive: NIST's KEM-then-compose strategy (ML-KEM + signature) is vindicated; direct LWE-AKE is off the table as a research direction; the geometric signal-leakage framework becomes the new minimum bar any future direct LWE-AKE proposal must clear. The NIST-standardized primitives (ML-KEM, ML-DSA) remain secure at every parameter set. Cross-reference ML-KEM §implementation.

2. The GSA 2026 PQC Summit convened September 16 in Washington DC (Department of Transportation West Atrium, hybrid Zoom for Government; GSA event, PQCA event). The agenda: federal migration strategy framework, PIV/identity in the PQ migration, AI-and-PQC threat intersection, crypto-agility patterns, GSA's contract-vehicle marketplace for quantum-readiness products. Vendor turnout confirmed (PQSecure, IBM, AWS, Cloudflare/infrequent on the gov side). No public release of new policy text observed in the 48 hours after the event; OMB M-26-15 Migration Plan submissions are still due October 22 and the federal migration timeline is unchanged. CNSA 2.0 first enforcement is now 104 days away (January 1, 2027), down from 110 at the September 12 update.

3. The three PQ-TLS documents are in different stages of the same publication pipeline. draft-ietf-tls-mlkem-10 (pure ML-KEM, Informational) is IESG state "Approved-announcement sent" since 2026-09-03, IANA review state "IANA OK - Actions Needed" (a step forward from last week's "In Progress" without the OK qualifier), IANA action In Progress, no RFC number yet. draft-ietf-tls-mldsa-06 (pure ML-DSA, Informational) is RFC Ed Queue since 2026-09-11, IANA review state "Version Changed - Review Needed" (the expected re-verify after the -06 post), IANA action In Progress, RFC Editor status "Awaiting Reference Checker, formatting". draft-ietf-lamps-pq-composite-sigs-19 (composite ML-DSA, X.509 PKI) is RFC Ed Queue, In Progress (First Edit), last touched 2026-08-26 — now 56 days in the queue (up from 49 last week). No publication has been issued in the September 12–18 window.

4. LAMPS composite updates: a -21 of composite ML-KEM (X.509 PKI) posted September 1, 2026, but draft-ietf-lamps-pq-composite-kem-21 is in IESG Evaluation::Revised I-D Needed state (downgraded since the -19 version) — a worse outcome than the composite-sigs document, which is at least procedurally in. The composite-KEM stream is blocked on substantive review feedback that has not been publicly disclosed. Operators planning around X.509 PKI migration should treat composite ML-DSA in certificates as imminent-but-unpublished (now 8 weeks of bodies, no movement), and composite ML-KEM in certificates as not imminent. Companion: draft-ietf-jose-pq-composite-sigs-04 (Prabel/Sun/Gray/Reddy, JOSE WG, WG document) updated 2026-09-11 — fresh activity in the JOSE composite line. draft-reddy-tls-composite-mldsa-12 (Composite ML-DSA in TLS, individual) last updated 2026-08-31, still no stream, still I-D Exists.

5. CNSA 2.0 / federal procurement clock — 104 days to first enforcement. The CNSA 2.0 timeline is unchanged from prior weeks: January 1, 2027 = all new NSS acquisitions must be CNSA 2.0-compliant by default. December 31, 2030 = non-compliant phase-out. December 31, 2031 = full enforcement. 2035 = full quantum resistance across NSS. GSA's PQC Summit this week was the federal community's annual operational on-ramp to that calendar. The migration calendar is now dominated by: October 22 (OMB M-26-15 Migration Plans), October 9–12 (Ethereum Foundation 2nd Annual PQ Research Retreat, Cambridge UK, pq.ethereum.org), November 14–20 (IETF-127 San Francisco), December 7–11 (ASIACRYPT 2026 Hong Kong). Each of these has a substantive agenda item that maps onto the procurement calendar.

6. Library state: liboqs main continues absorbing mlkem-native / mldsa-native v2.0.0. Current tagged release remains 0.16.0 (2026-07-09, 3,054+ stars on open-quantum-safe/liboqs). mldsa-native at v2.0.0 (formal release 2026-08-07, C90 + AArch64 Neon + x86_64 AVX2 backends, formal memory/type-safety proofs). mlkem-native at v2.0.0 (formal release 2026-07-23). Trail of Bits' ptp-mldsa-native high-assurance fork continues. AWS-LC merge of v2 backend code queued, not shipped. No new oqs-provider or AWS-LC release in the September 12–18 window. Cross-reference PQC Deployment and Libraries Tracker.

7. OpenSSL cadence. No fresh PQ-capable-branch security release in the September 12–18 window. The last PQ-relevant patch line was September 9 (4.0.3 / 3.6.5 / 3.5.9, multi-CVE; per the September 12 note). The five-week cadence of PQ-capable-branch security releases (Aug 25 → Sep 9) has now stretched to 9+ days with no fresh advisory observed; the next one would be expected late-September to early-October per historical rhythm. Operators maintaining PQ-enabled OpenSSL stacks should keep upgrade automation tight — oqs-provider on top of OpenSSL 3.5+ is the documented path.

8. FIPS 206 (FN-DSA / Falcon) status: unchanged. NIST submitted the draft for approval on 2025-08-28; the IPD has been under public comment since (NIST CSRC page timestamps the FIPS 206 project page as "25 September 2025" last update). No fresh public document from NIST in the September 12–18 window. DigiCert's "wait until final" position holds. Adjacent: draft-ietf-jose-pqc-kem-06 (Tschofenig/Reddy/Banerjee, JOSE WG, no shepherd, no AD, last updated 2026-07-06) still cites FIPS 206 as upstream — unchanged.

9. The federal procurement window is now the gating constraint on the operator migration calendar. A TLS-using operator in late 2026 is being timed against GSA Schedule 70 / 84 contract vehicles, FIPS 140-3 validation expirations on HSMs, and the OMB M-26-15 Migration Plan due-date — not against ePrint preprints. The research calendar (ePrint 2026/2017, ASIACRYPT 2026, Ethereum PQ Retreat, IETF-127) is still relevant, but its output is standards-track inputs (PQ-Hybrid in IKE, signature policy guidance, interoperability profiles) rather than parameter-set revisions. ML-KEM-768 / -1024 and ML-DSA-65 / -87 are not moving.

10. The Dihedral Coset / EDCP line — still closed. The August 15 Gupte–Ragavan–Zhandry refutation of the Simon DCP claim stands; ePrint 2026/1693 (Lean 4 machine-checked, no-go) is the resolved record. No new filing against the bridge (Wen–Zheng CRYPTO 2026, Module-LWE ↔ IP-M-EDCP) appeared in the September 12–18 window. The ePrint 2026/2017 attack is on a different problem family (signal-leakage on MQV-style reconciliation) and does not bear on the lattice-primitive hardness. Cross-reference The Dihedral Coset Attack Line.

Freedom-tech implication: the ePrint 2026/2017 result is the strongest signal in this week's input that the KEM-then-compose architecture (ML-KEM + signature, as in RFC 10024 hybrid + RFC 9881 ML-DSA-65 X.509 + RFC 9980 OpenPGP composite) is the right design — direct LWE-AKE is off the table for standardization. The freedom-tech impact is minimal in the near term because the freedom-tech stack (TLS, SSH, OpenPGP, code signing, secure messaging, Monero/Bitcoin-style blockchain) was never planning to deploy ZZDSD-AKE or GDLL-KE. The impact is in the attestation of choice: the math now formally backs the architectural choice that was already operationally forced by NIST's standardization path. The remaining substantive moves (October M-26-15 plans, October Ethereum PQ Retreat, November IETF-127, December ASIACRYPT 2026) are all standards-tracking and procurement-tracking items, not primitive-revision items.

The Week in Detail

1. The eCK-Security negative — ePrint 2026/2017 (ASIACRYPT 2026 accepted)

The paper appeared at the IACR Cryptology ePrint Archive on 2026-09-14; it has been accepted for presentation at ASIACRYPT 2026 (Hong Kong, December 7–11). Authors: Ruoyu Ding (Jinan University), Tianrun Yu (Jinan), Yanbin Pan (Academy of Mathematics and Systems Science, CAS), Chi Cheng (Guangzhou University), Jian Weng (Guangzhou). Categories: Attacks and cryptanalysis. Keywords: Learning with errors, key exchange protocol, signal leakage attack, post-quantum cryptography.

The two targets:

• ZZDSD-AKE (Zhang–Zhang–Ding–Sun–Dong, EUROCRYPT 2015): the MQV-style lattice analog of HMQV. Adapts MQV's static-plus-ephemeral key blending to ideal lattices. From 2015 onward, the central open question was: does it achieve eCK security (the LaMacchia–Lauter–Mityagin 2007 framework — adversary can compromise either the long-term static key or the ephemeral key material from a completed session, but not both from the same session)?
• GDLL-KE (Gao–Dai–Lin–Li, IEEE TC 2018): documented as "robust against key-reuse" via a randomized-noise countermeasure.

The attack: a signal-leakage attack, not a Module-LWE cryptanalysis. The reconciliation step (called a "signal function") that converts the noisy LWE-based approximate agreement into an exact shared-secret bit is shown to leak enough information about the static secret that an adversary who can observe many sessions (under the active eCK adversary who gets the ephemeral key) can recover the static key.

The query counts:

Why this is not a break of ML-KEM: ML-KEM is a KEM (key encapsulation mechanism), not an AKE (authenticated key exchange) protocol. It does not have reconciliation-style signals that are reused across sessions in the same way. The attack class (signal-leakage on MQV-style reconciliation under active adversary with ephemeral-key compromise) does not apply to ML-KEM's IND-CCA2-secure Fujisaki–Okamoto transform construction. Cross-reference ML-KEM §implementation-hardening.

The broader message: the direct LWE-AKE research program (2012–2026) is now formally narrowed. The geometric signal-leakage framework is the new minimum bar. The KEM-then-compose architecture used by ML-KEM + signature (Ed25519, ML-DSA, or hybrid) is the architecturally defensible choice and is what NIST has standardized. The CRYPTO 2026 concurrent result showing that ML-KEM-based AKE achieves eCK-PFS security via a new authenticated forward-secure KEM construction points to one proven forward direction — itself composable with the KEM-then-compose model.

For a freedom-tech deployer: no action item. The result is epistemics — it confirms that the KEM-then-compose architectural choice was the right call, which is what the operational freedom-tech stack (TLS 1.3, SSH, Signal PQXDH, iMessage PQ3, OpenPGP RFC 9980, Bitcoin Taproot) already implements. There is no parameter-set revision to track; ML-KEM-768 / -1024 is unchanged.

2. The GSA 2026 PQC Summit — September 16 (recap)

The summit convened at the Department of Transportation West Atrium (1200 New Jersey Ave SE, Washington, DC 20240) with a Zoom for Government virtual track. Agenda pillars (per the GSA event page and the LinkedIn promotional posts from GSA ITC and from PQSecure's deployment-ready track):

1. Federal migration strategy and prioritization framework for PQC implementation.
2. PIV and identity management in PQ migration context — the PQC transition for federal identity credentials, certificates, and authentication infrastructure.
3. AI and PQC threat intersection — quantum-AI cybersecurity, intersection of emerging tech and crypto-agility.
4. Crypto-agility strategies for long-term quantum resilience.
5. Quantum-safe marketplace — vendor showcases (PQSecure's hardware/software + FPGA/ASIC accelerators, side-channel/fault-injection mitigations; AWS; Cloudflare; IBM).

No fresh policy text was released publicly in the 48 hours after the event. The September 12 note's GSA Summit Sep 16 item is now historical. The migration calendar it reinforces is the same one that has been on the page all year:

The September 16 summit's main operational output (to the extent any is published) would be marketplace signals — which GSA contract vehicles are now carrying PQ-capable products, what the procurement language patterns are, and how PIV/identity is being sequenced in the Migration Plan templates that agencies will submit October 22.

3. The PQ-TLS publication pipeline — three documents, three stages

The IANA "OK - Actions Needed" qualifier on mlkem-10 is the substantive delta this week. It indicates IANA has confirmed the registry changes are needed and the IANA action itself is the only remaining step before the registry record is updated. That is procedurally one step closer to RFC publication — though the RFC Editor's own first-edit cycle still has to complete and an RFC number still has to be assigned.

The composite ML-DSA queue drag continues to be the IANA version-changed re-verify on the -19 vs the -18 that the queue first-edited on. The September 5 estimate of "4–10 weeks further" should now be read as "5–12 weeks further" given the queue has not been touched in 24 days and counting. Composite ML-DSA in X.509 PKI is the most-cited near-term publication, and the queue drag is not procedural dispute; it is RFC Editor bandwidth against IANA review back-cycle.

Composite ML-KEM (X.509 PKI) — separate document, separate trajectory. draft-ietf-lamps-pq-composite-kem-21 was posted 2026-09-01 and is in IESG Evaluation::Revised I-D Needed state — a downgrade relative to the composite-sigs document's queue position. This means substantive review feedback has come back from the IESG that requires a revised draft. The composite-KEM X.509 PKI stream is therefore behind the composite-sigs stream in publication prospects, not ahead. The September 12 note did not catch this; this is a correction.

4. The federal procurement clock

Unchanged from prior weeks; the GSA Summit was the on-ramp event, the M-26-15 deadline is the first deliverable, the January 1 enforcement is the first pass/fail gate. For a federal contractor or vendor, the operational checklist is:

• HSM: FIPS 140-3 validated module supporting ML-KEM, ML-DSA, SLH-DSA in the IKE/TLS code paths the agency's contracts exercise. (FIPS 140-2 sunset Sep 21 → historical.)
• TLS: hybrid X25519MLKEM768 (RFC 10024) as the wire default; ML-DSA-65 X.509 leaf (RFC 9881) when the issuing CA pipeline supports it.
• SSH: mlkem768x25519 or hybrid (per the OpenSSH/curve25519 implementation).
• Code signing: hybrid Ed25519+ML-DSA-65 (per the Bernstein June 2026 analysis; August 8 update §3) for high-value keys; SLH-DSA alone for conservative backup; FN-DSA / FIPS 206 when finalized (late 2026 / early 2027).
• Encrypted archives (multi-decade): hybrid ML-KEM-1024 key wrap + AES-256-GCM.
• Identity / PIV: PQ-capable path is in the M-26-15 plans due Oct 22; the September 16 Summit was the canonical venue for the PIV/identity track discussion.

5. The lattice cryptanalysis update

One paper this week, in addition to the ePrint 2026/2017 negative on direct LWE-AKE (which is on the protocol level, not the primitive level):

No new primitive-level cryptanalysis papers against ML-KEM or ML-DSA were observed in the September 12–18 window. The September 5 / 12 cycle's side-channel papers (ePrint 2026/1915, 2026/1922) remain the latest entries on the ML-KEM implementation-research line. The Dihedral Coset / EDCP line (ePrint 2026/1693, Wen–Zheng CRYPTO 2026, The Dihedral Coset Attack Line) is closed at the primitive level.

6. The library / deployment state

No fresh oqs-provider, AWS-LC, liboqs-tagged, mlkem-native, or mldsa-native release in the September 12–18 window. The liboqs main branch continues to absorb the v2.0.0 native backends. The Trail of Bits ptp-mldsa-native fork (github.com/trailofbits/ptp-mldsa-native) continues the high-assurance line.

OpenSSL cadence (PQ-relevant):

7. The federal / IETF / standards calendar through Q1 2027

Compiled for the record, in date order:

What changed since September 12

Operator checklist for the September 12–18 window

For a federal-contractor or vendor shipping PQ-relevant products:

• [ ] GSA PQC Summit attendance (Sept 16): complete; capture any session-level material that maps onto the M-26-15 Migration Plan template due Oct 22.
• [ ] HSM refresh plan: FIPS 140-3 validated module with ML-KEM/ML-DSA/SLH-DSA in the IKE/TLS code paths. FIPS 140-2 sunset Sep 21 → historical; any new procurement must specify 140-3.
• [ ] OpenSSL upgrade automation: keep oqs-provider + liboqs 0.16.0+ on top of OpenSSL 3.5+ / 3.6+ / 4.0+. Last PQ-relevant release Sep 9 (4.0.3 / 3.6.5 / 3.5.9); expected next late September to early October.
• [ ] ML-KEM-in-TLS readiness: draft-ietf-tls-mlkem-10 is the imminent RFC. Operators planning to cite the RFC should wait for the RFC number; the wire-level guidance (hybrid X25519MLKEM768, RFC 10024) is already citeable.
• [ ] ML-DSA-in-TLS readiness: draft-ietf-tls-mldsa-06 is in the RFC Ed Queue. Cite as draft-ietf-tls-mldsa-06 for the next 4–8 weeks; assume RFC publication by IETF-127 (Nov 14–20).
• [ ] Composite ML-DSA in X.509 PKI: cite as draft-ietf-lamps-pq-composite-sigs-19; assume RFC publication in the next 4–10 weeks (queue drag continues).
• [ ] Composite ML-KEM in X.509 PKI: cite as draft-ietf-lamps-pq-composite-kem-21; assume not imminent (IESG Evaluation::Revised I-D Needed). The composite-KEM document is behind the composite-sigs document, not ahead.
• [ ] OMB M-26-15 Migration Plan: due Oct 22. Cover: HSM roadmap; TLS hybrid deployment; code-signing path; SSH PQ hybrid; long-term archive encryption; identity/PIV PQ plan.
• [ ] IETF-127 attendance (Nov 14–20): TLS WG agenda item should have the freshly-published ML-KEM and ML-DSA TLS RFCs; LAMPS agenda should have composite-sigs published or imminent; JOSE agenda should have JOSE composite-sigs-04 advancing.

For a freedom-tech deployer (independent of federal procurement):

• [ ] No action items from ePrint 2026/2017: the KEM-then-compose architecture is now formally confirmed as the right call. Continue deploying ML-KEM-768/1024 in TLS, SSH, and messaging.
• [ ] Hybrid everywhere: hybrid X25519MLKEM768 (RFC 10024) in TLS; mlkem768x25519 (OpenSSH) in SSH; Signal PQXDH in messaging; iMessage PQ3 in messaging; RFC 9980 hybrid in OpenPGP.
• [ ] Long-term archive encryption: hybrid ML-KEM-1024 key wrap + AES-256-GCM. Per Hybrid KEM Migration.
• [ ] No FN-DSA integration yet: wait for FIPS 206 final. DigiCert's wait-until-final position holds.
• [ ] No action items on the Dihedral Coset line: the August 15 refutation stands; ML-KEM and ML-DSA are not moving.

Related Notes

• Post-Quantum Saturday — September 12 2026 Weekly Update — prior weekly update (ML-DSA-in-TLS cleared 65-day appeal freeze; pure ML-KEM 9 days into Approved-announcement sent; composite ML-DSA 49 days in queue; CNSA 2.0 first enforcement 110 days; GSA PQC Summit Sep 16; OMB M-26-15 due Oct 22; ePrint 2026/1915+1922 ML-KEM side-channel).
• Post-Quantum Saturday — September 05 2026 Weekly Update — pure ML-KEM approved by IESG Sep 3; ML-DSA-in-TLS held under appeal 59 days; composite ML-DSA in RFC Ed Queue; MTC status corrected; SVP in 2^0.7314n; FHE sparse Ring-LWE loses up to 13 bits; OpenSSL multi-CVE Aug 25; FIPS 140-2 sunset Sep 21; OMB M-26-15 plans due Oct 22.
• Post-Quantum Saturday — August 22 2026 Weekly Update — Simon DCP claim formally refuted (GRZ 2026, ePrint 2026/1693, Lean 4 machine-checked); RFC 10024 hybrid TLS published; Bernstein 75-objection filing.
• The Dihedral Coset Attack Line — twenty-year research program from Regev 2004 to GRZ 2026 no-go.
• Merkle Tree Certificates — PQ Web PKI breakthrough; Let's Encrypt staging late 2026, production 2027.
• Hybrid KEM Migration — operational migration playbook for TLS, SSH, messengers, code signing, encrypted backups.
• PQC Deployment and Libraries Tracker — 2026 deployment map for TLS, SSH, messaging, OS distributions, libraries, and migration roadmaps.
• ML-KEM, ML-DSA, SLH-DSA, HQC, FN-DSA Falcon — algorithm notes.
• MOC - Composing Primitives.
• Glossary — Hybrid KEM, harvest-now-decrypt-later, Module-LWE, lattice cryptography, Grover.

Vault note: this update follows the September 12, 2026 weekly entry. The next scheduled PQC weekly will be Post-Quantum Saturday — September 26 2026 Weekly Update.