ungovernable.tech
search 245 entries/ctrl k

Briefing · Post-Quantum Saturday

Post-Quantum Saturday — October 03 2026 Weekly Update

published 2026-10-03 30 min read Post-Quantum Cryptography

Weekly companion to Overview - Post-Quantum Cryptography, PQC Deployment and Libraries Tracker, The Dihedral Coset Attack Line, algorithm notes (ML-KEM, ML-DSA, SLH-DSA, HQC, FN-DSA Falcon), Merkle Tree Certificates, Hybrid KEM Migration, and Bitcoin PQ Migration. This note covers the week since the September 26 update — the September 26 – October 03 window. The week is dominated by AWS-LC v5.11.0 (released Oct 1) — the sixth release of September and the first release of October — plus the FIPS 140-2 sunset having now landed Sept 21 with no further security advisories in this window, the OMB M-26-15 PQC Migration Plan deadline at October 22 (19 days out), and a quiet but consequential IETF datatracker surface: both draft-ietf-tls-mlkem and draft-ietf-tls-mldsa remain Blocked under the Sept 24 appeal, the mlkem-11 version remains the live document with IANA Action RFC-Ed-Ack, and the LAMPS and PLANTS documents continue to advance without IETF-stream conflict. The week closes the September line and opens the October line: the M-26-15 deadline (Oct 22) and IETF-127 (Nov 14-20) bookend the next 49 days, with the FIPS 206 (FN-DSA) IPD still in NIST administrative approval and no new public draft this week.

TL;DR — This Week

  1. AWS-LC v5.11.0 was released on 2026-10-01 23:32 UTC by skmcgrail (commit fa9bc8d, PR #3610). It is the sixth release since Sept 1 (v5.5.0, v5.6.0, v5.7.0, v5.8.0, v5.9.0, v5.10.0, v5.11.0) and includes 32 changed PRs since v5.10.0. PQ-relevant changes: fix(ml_kem): Gate ML-KEM x86-64 on BMI2 in addition to AVX2 (#3596) — a deployment correctness fix that prevents the ML-KEM AVX2 fast path from running on older x86-64 silicon that lacks BMI2 (bit manipulation instruction set 2, Haswell+); fix(ci): restrict calls for autofix (#3599); Restricting CI permissions so fork-PR code doesn't run CI with ECR push and shared S3 write permissions (#3546); and a FIPS-service-3.x EOL extension to February 2030 (#3539). The release also lands feat(duvet): RFC 8032 (EdDSA) requirement coverage + annotation-regression CI (#3477) and three X.509/CSR/TLS hardening fixes (#3537, #3566, #3592) that affect ML-DSA-in-X.509 and ML-DSA-in-TLS flows. Cross-reference PQC Deployment and Libraries Tracker.

  2. The Sept 24 RFC Editor re-block on both pure PQ-TLS documents held throughout this week with no change. draft-ietf-tls-mlkem-11 (Connolly, uploaded 2026-09-16) remains the live document; RFC Editor status is "Awaiting Reference Checker, formatting" per the datatracker landing page snapshot; IANA Action remains RFC-Ed-Ack; IESG state remains "RFC Ed Queue". The document shepherd's recorded writeup reaffirms the consensus position: the draft-ietf-tls-mlkem document remains an information document with a recommended status of "N" in the IANA registry meaning that there was no consensus to recommend this group. draft-ietf-tls-mldsa-06 (Schmieg/Westerbaan, uploaded 2026-09-11) remains in the same Blocked state. No new appeal correspondence has been published to the tls@ietf.org archive in this window, suggesting the appeals are at the RFC Editor administrative-review stage rather than at the IESG-ad-judication stage. Hybrid X25519MLKEM768 (RFC 10024) remains the operationally-endorsed default. 42 days to IETF-127; the TLS WG agenda will inherit this dispute. Cross-reference Hybrid KEM Migration.

  3. draft-ietf-lamps-pq-composite-sigs is now in its 70th day in the RFC Editor queue (started 2026-07-23, first forward motion to "Awaiting Second editor" on 2026-09-23 per last week's note). No additional RFC Editor forward motion in this window — the document remains in "Awaiting Second editor" awaiting the RFC Production Center's second-editor assignment. The IANA registry step is procedurally complete. Estimate unchanged: 2-6 weeks further to publication. Cite as draft-ietf-lamps-pq-composite-sigs-19 (the version in front of the RFC Editor queue is -19; datatracker may be showing the -14 Last Call version for historical record per the September 26 datatracker snapshot, but the September 23 state change to "Awaiting Second editor" was on the latest queue version). Composite ML-DSA in X.509 PKI is the only PQ-Web-PKI authentication rail advancing. Cross-reference ML-DSA.

  4. draft-ietf-plants-merkle-tree-certs remains at -05 (uploaded 2026-07-06) with no -06 visible in datatracker this week. Last week's Sept 26 note had reported a Sept 21 -06 upload by David Benjamin based on the prior datatracker history page; this week's datatracker history snapshot still shows -05 as the latest version, so the -06 either remains in author-review state without a public version bump, or the previous week's analysis read the -06 record against a transitional cache. The MTC document remains in WG Document state, no shepherd, no AD, no IANA review. The PLANTS WG's roadmap (Let's Encrypt staging late 2026, production 2027, Chrome preferred) is unchanged. Cross-reference Merkle Tree Certificates.

  5. FIPS 206 (FN-DSA / Falcon) is unchanged in this window. Per the most recent NIST pqc-forum thread (groups.google.com/a/list.nist.gov/g/pqc-forum/c/1HXzjlMUU6Y), the FIPS 206 IPD remains in the administrative approval chain for publication within the Department of Commerce. Ray Perlner's most recent stated position: we don't have a concrete release date for the draft of FIPS 206 yet, though we're hopeful it will be soon. No fresh public-facing material from NIST this week. Cross-reference FN-DSA Falcon.

  6. ePrint 2026/2113 (Sept 25, Branco/Döttling/Müller-Quade/Quan) — "Post-Quantum PKE and More from a Noisy Unstructured Linear Algebraic Assumption: Beyond LWE and LPN" is the most consequential cryptanalytic result of the week for freedom-tech. The paper introduces an NLA (noisy linear algebraic assumption) that is plausibly hard given an oracle that breaks even constant-noise-rate LPN (a strictly stronger LPN break than current lattice attacks provide), while remaining plausibly hard given an LWE oracle. The result: a single new natural assumption yields (i) public-key encryption, (ii) two-round maliciously secure oblivious transfer, and (iii) one-time circular-secure SKE. The relevance for freedom-tech: diversification beyond the lattice-only assumption of ML-KEM/ML-DSA — the paper is the first to make a single, structured assumption viable for all three primitives while explicitly being not LPN-broken. The paper's cryptanalysis rules out (1) combinatorial ISD-style attacks, (2) dimension reduction, (3) dual lattice attacks. Important boundary: this is a new hardness assumption; it is not a threat to ML-KEM, ML-DSA, or SLH-DSA; it is a diversification track.

  7. ePrint 2026/1992 (Sept 23, Khurana et al., "Bridging the Cryptographic Transition: A Unified Framework for Post-Quantum Key Exchange") formalizes the hybrid-PQ-KEX architecture against a Google 2029 internal PQC migration deadline that is deliberately ahead of the 2035 NIST/federal horizon. The paper's framing — that the 2029 deadline is driven by faster-than-expected progress in quantum hardware, QEC, and revised resource estimates — is the first formal academic treatment of the private-sector PQC deadline. For freedom-tech: the 2029 date is Google’s migration target, not a predicted date for decrypting recorded traffic; the unified framework gives a reduction-style argument for the hybrid composition (classical KEM + PQ KEM) that RFC 10024 implements operationally.

  8. The federal PQC procurement calendar enters the 19-day window for the OMB M-26-15 deadline. Every covered civilian agency must submit a PQC Migration Plan to OMB and ONCD by 2026-10-22 (19 days from this update). The M-26-15 nine required content elements (system prioritization, phased timelines, TLS 1.3 milestones, inventory methodology, crypto-agility architecture, third-party coordination, resource estimates, risk-management strategy, governance roles) are unchanged. The GSA FICAM PQC working group was due to be stood up 60 days after M-26-15 (by August 23) — no public update this week on its first meeting or output. The M-26-15 deadline (Oct 22) and the IETF-127 final-agenda publication (Oct 23) fall on adjacent days, meaning the federal PQC plan submissions and the IETF final agenda will land within 24 hours of each other. Cross-reference Hybrid KEM Migration and Merkle Tree Certificates.

  9. FIPS 140-2 sunset (Sept 21) is now 12 days behind us with no fresh security advisories on the OpenSSL 4.0.x / 3.6.x / 3.5.x security-patch cadence from Sept 9. The 4.0.3 / 3.6.5 / 3.5.9 multi-CVE cluster remains the most recent significant security advisory; the cadence has slowed rather than accelerated. OpenSSL 4.1.0 final is scheduled for release in October 2026 (per the OpenSSL library blog post on the 4.1 alpha / beta cycle); the 4.1 line carries an end-of-life date of November 2027, while 4.0 is supported through May 2027. The 4.1 release is the feature line that will absorb the DTLS 1.3 + PQC optimization work (AVX-512 SHAKE for ML-DSA, ppc64le ML-DSA/ML-KEM NTT, s390x ML-DSA). Operators should plan for 4.1 adoption in late 2026 / early 2027 alongside OpenSSL 3.x EOL planning.

  10. The liboqs / oqs-provider repository has been silent at the release level for the full September line — 0.16.0 (July 9) remains the current tagged release. Commits continue to land on main (the Sept 21 XMSS OOB fix #2511, the Sept 24 AES-192 commit b196b57, the Sept 23 build-system fix #2576, the Sept 21 XMSS code-scan #2577, all from last week's report), and oqs-provider commit 36cafae0 from Sept 19 (MAYO/MQOM/SNOVA Round 3 update) is the most recent oqs-provider commit. No fresh oqs-provider release tag in this window. A 0.17 release will be the next tagged version, but is not imminent. For freedom-tech deployers: pin to a known liboqs SHA rather than rely on the tag.

The Week in Detail

1. AWS-LC v5.11.0 (Oct 1) closes the September line and opens October

AWS-LC shipped v5.11.0 on 2026-10-01 23:32 UTC (release page, commit fa9bc8d, PR #3610). The release is the sixth AWS-LC release since Sept 1 (v5.5.0 through v5.10.0, plus v5.11.0 — seven total in the Sept 1 – Oct 1 window), maintaining the weekly cadence.

PQ-relevant changes in v5.11.0:

PR Title Significance
#3596 fix(ml_kem): Gate ML-KEM x86-64 on BMI2 in addition to AVX2 Deployment correctness — the AVX2 ML-KEM fast path is now also gated on BMI2, which is Haswell (2013) and later. AMD Bulldozer/Piledriver/Steamroller (pre-2017) and early Intel Atom lines (Saltwell/Silvermont) lack BMI2 and will now fall back to the C reference implementation. The fallback is correct (CAVP-validated) but slower. Library distributors should verify their build's runtime detection is intact; the fix prevents silent fallback to incorrect code on these CPUs.
#3592 fix(x509): Verify CSR proof-of-possession on -req Affects ML-DSA-in-X.509 CSR flows (proof-of-possession for ML-DSA-signed CSRs).
#3537 Reject unoffered cipher suite in TLS 1.3 client ML-KEM hybrid groups in the TLS 1.3 client hello.
#3566 fix(ssl): Check buffer-view bounds before pointer arithmetic Defensive fix affecting all TLS 1.3 record-layer processing including ML-KEM and ML-DSA.
#3546 Restricting CI permissions so fork-PR code doesn't run CI with ECR push and shared S3 write permissions Supply-chain hardening for the AWS-LC build pipeline.
#3539 Extend FIPS 3.x EOS to February 2030 FIPS 3.x module's end-of-support extended ~3 years; relevant for federal operators on the validated module.
#3543 Harden a number of code-paths to avoid e.g. hangs and invalid input Hardening sweep.
#3595 Harden previous-finished* length in v1/v2 transfer Defensive fix.
#3585 Use the dummy key when a PKCS#7 content encryption key is the wrong length PKCS#7 defensive fix.
#3586 Resize md_data when an HMAC EVP_MD_CTX changes digest Defensive fix.
#3477 feat(duvet): RFC 8032 (EdDSA) requirement coverage + annotation-regression CI Test-coverage expansion.
#3597 fix(acvp): place the IUT public key correctly in KAS-ECC fixedInfo ACVP test-vector fix.
#3538 Add context length guard in ML-DSA ACVP siggen Test-vector hardening.
#3504 Seed groups and signature algorithms from the system crypto policy Cross-link to the system crypto-policy reader added in v5.10.0.
#2709 Add EVP_PKEY_check and EVP_PKEY_public_check for KEMs API addition; first-class KEM public-key validation. Operators on the AWS-LC FIPS 3.x module can now validate ML-KEM public keys against the IPD/spec — relevant for hybrid handshake validation where both ML-KEM and the classical component must be validated.

Non-PQ but adjacent: #3561 ci: fix openssh-master integration (PQC OpenSSH integration), #3590 Update Ruby (master) integration patch, #3591 fix: Add patch for failing gRPC master branch. Cross-reference PQC Deployment and Libraries Tracker.

Notable: the ML-KEM BMI2+AVX2 gate is the most operationally consequential PQ change in the release. AWS-LC's ML-KEM C reference implementation is CAVP-validated; the AVX2 fast path is a performance optimization that has historically been gated on runtime detection of AVX2 support. The fix tightens that gate to also require BMI2, because the AVX2 implementation uses BMI2 instructions (specifically _pdep_u32 / _pext_u32) and would fail to link or produce undefined behavior on silicon that lacks BMI2. The fix is correct, but operators on legacy x86-64 hardware should verify the fallback path is being exercised as expected (no perf surprise). For embedded and IoT paths, this is a non-event (most embedded targets are ARMv8 and use aarch64 codepaths, not x86-64).

2. The Sept 24 RFC Editor re-block on pure PQ-TLS — no change in 7 days

draft-ietf-tls-mlkem and draft-ietf-tls-mldsa have been in RFC Editor "Blocked" state for 9 days as of this update (Sept 24 → Oct 3). The IETF datatracker landing page snapshots show:

  • draft-ietf-tls-mlkem-11: Last updated 2026-09-17 (revision 2026-09-16). WG state: Submitted to IESG for Publication. IESG state: RFC Ed Queue. IANA state: RFC-Ed-Ack. RFC Editor state: "Awaiting Reference Checker, formatting". Responsible AD: Deb Cooley.
  • draft-ietf-tls-mldsa-06: Last updated 2026-09-11 (revision 2026-09-11). WG state: Submitted to IESG for Publication. IESG state: RFC Ed Queue. RFC Editor state: Blocked (Sept 24 re-block). Responsible AD: Deb Cooley.

The IETF datatracker history pages have not been updated with new state changes in this window, suggesting the appeals remain at the RFC Editor administrative-review stage (i.e., Deb Cooley and the chairs are reviewing the substantive complaints; no new institutional action has been published). The Sept 25 freenode.net synthesis (IETF rejects appeal on ML-KEM TLS consensus and NSA conflict claims) remains the most current public record of the IETF's institutional response.

The Sept 26 datatracker history-page snapshot for draft-ietf-lamps-pq-composite-sigs shows the canonical timeline: -14 (Jan 31, 2026 IETF Last Call review assignment), -12 (Oct 20, 2025 Publication Requested), -09 (Sept 28, 2025 posted confirmation), -08 (Sept 20, 2025 WG Last Call). The Sept 23 forward motion to "Awaiting Second editor" is on the RFC Editor queue version -19 (per the prior week's Sept 26 note and the Sept 23 datatracker state change log entry); -14 is the last version with WG Last Call record visible in the public history page. The datatracker public history page may not show queue-version state changes — RFC Editor queue versions are tracked in a separate queue. Operators citing this document should reference draft-ietf-lamps-pq-composite-sigs-19 per the Sept 23 RFC Editor state change record; the IANA registry content is unchanged.

The TLS WG agenda at IETF-127 (Nov 14-20, 42 days out) will inherit this dispute. The Final IETF-127 agenda is published Oct 23, 2026 (one day after the OMB M-26-15 deadline). Operators planning IETF-127 attendance should expect the TLS WG session to discuss (a) the Sept 24 re-block, (b) any further state changes between Oct 3 and Nov 14, and (c) the path forward for either pure PQ-TLS or a renewed push toward the hybrid-only operational default. Recommend tracking the IETF-127 agenda publications and pre-registered draft discussions on the IETF-127 wiki and the datatracker meeting agenda as they accumulate.

3. The pqc-forum and the FIPS 206 (FN-DSA) silence

The NIST pqc-forum FIPS 206 status thread (groups.google.com/a/list.nist.gov/g/pqc-forum/c/1HXzjlMUU6Y) has not received a public post from the FIPS 206 team since Ray Perlner's Sept 4 "we are ready to send out a draft within a few days once it's approved, but we don't really know when that will be" reply. The most recent public-facing material from NIST on FIPS 206 remains the Sept 25, 2025 Perlner presentation at the 6th PQC Standardization Conference (csrc.nist.gov/presentations/2025/fips-206-fn-dsa-falcon) and the Sept 2025 freenode.net piece (NIST locks FN-DSA to fixed-point math for FIPS 206).

The fixed-point signing design decision, first publicly stated by Perlner in August 2025 and now embedded in the in-clearance draft, is the substantive change operators should be planning for. The single, precisely specified signing procedure (initially 32.32 for keygen, 64.64 for signing) that produces identical KAT outputs is what unblocks validation testing. For freedom-tech deployers: the FIPS 206 design constraint means a single signing-procedure implementation can be CAVP-validated, which is the prerequisite for inclusion in FIPS 140-3 modules. DigiCert's "wait until final" position holds — the IPD is necessary but not sufficient for production FN-DSA rollouts. The COSE draft draft-ietf-cose-falcon-04 (Prorock, expired 2026-09-16 per the IETF draft page) has not been re-uploaded as a -05 in this window, which is a maintenance concern; operators citing it should verify the document state on the datatracker before relying on the text. Cross-reference FN-DSA Falcon.

4. ePrint 2026/2113 (Sept 25) — the diversification track beyond LWE/LPN

The Branco-Döttling-Müller-Quade-Quan paper "Post-Quantum PKE and More from a Noisy Unstructured Linear Algebraic Assumption: Beyond LWE and LPN" (ePrint 2026/2113) is the most consequential new cryptographic-assumption paper of the week for freedom-tech. The construction's key property: the NLA is plausibly hard against an oracle that breaks even constant-noise-rate LPN, while still being plausibly hard against an LWE oracle.

Why this matters for freedom-tech: the lattice-only assumption of ML-KEM and ML-DSA has been the single load-bearing assumption of the NIST PQC standardization. The Sept 25 note's Mattsson recommendation (ML-KEM + HQC hybrid for diversification) was the operational workaround — but HQC is also lattice-derived (code-based, with a lattice-closest reduction), so the diversification is partial. 2026/2113 opens a path to an NLA-derived PKE primitive that is provably not in the LPN-broken regime even if LWE weakens. For a deployer fielding PQC on the wire, the practical implication is: in 12-24 months, there will be additional PKE candidates worth evaluating that are structurally distinct from lattices. Track this paper for replication and implementation maturity.

Important boundary: 2026/2113 introduces a new hardness assumption; it does not break ML-KEM, ML-DSA, or SLH-DSA. The paper's contribution is in the assumption landscape, not in the primitive landscape. Deployers should not delay ML-KEM / ML-DSA / SLH-DSA adoption in anticipation of a 2026/2113-derived primitive — the standardization-and-deployment gap would be 3-5 years even on an accelerated path. The paper's value is in expanding the diversification menu for long-lived deployments that want non-lattice alternatives.

5. ePrint 2026/1992 (Sept 23) — Google 2029 deadline formalized

The Khurana et al. paper "Bridging the Cryptographic Transition: A Unified Framework for Post-Quantum Key Exchange" (ePrint 2026/1992) introduces a formal security framework for migrating classical KEX to PQ KEX, framed against the Google 2029 internal PQC migration deadline. The deadline is the central research framing: Google has established 2029 (deliberately ahead of the 2035 NIST/federal horizon) as the year for completing PQC migration in its production stack. The motivation, per the paper: faster-than-expected progress in (a) quantum computing hardware, (b) quantum error correction, and (c) revised resource estimates for quantum computers to break current cryptographic schemes.

For freedom-tech: the 2029 Google deadline is the first private-sector PQC deadline published by a hyperscaler. The NIST/federal horizon is 2030/2031/2035 (Phase 3/4/5 per OMB M-26-15); the 2030/2031 dates are for priority systems (HVAs, high-impact), not the full estate. The 2035 date is the backstop for the rest. Google’s 2029 target is a migration deadline. It cannot be used to infer a three-year interval between recording traffic and a future quantum decryption capability. The paper's unified framework gives a reduction-style argument that the hybrid composition (classical KEM + PQ KEM) implemented in RFC 10024 is security-preserving under the standard IND-CCA assumptions on both components. Cross-reference Hybrid KEM Migration.

6. The October line — what's next

Date Event PQC relevance
2026-10-09 → 2026-10-12 Ethereum Foundation 2nd Annual PQ Research Retreat, Cambridge UK leanVM / PQ consensus / signature aggregation
2026-10-22 OMB M-26-15 federal Migration Plan submission deadline 19 days out — covered in this update
2026-10-23 IETF-127 Final Agenda published One day after M-26-15 — TLS/LAMPS/PLANTS/JOSE WGs will publish their final agenda
2026-11-02 IETF-127 Internet-Draft submission cut-off (all I-Ds, including -00) Last chance to land a new I-D before IETF-127
2026-11-14 → 2026-11-20 IETF-127 San Francisco 42 days out — TLS, LAMPS, PLANTS, JOSE, IKE WGs
2026-12-07 → 2026-12-11 ASIACRYPT 2026 Hong Kong Includes ePrint 2026/2017 (ZZDSD-AKE) presentation
2027-01-01 CNSA 2.0 first enforcement 90 days out
2027-Q1 FIPS 206 (FN-DSA) final expected Late 2026 / early 2027
2027-Q1/Q2 FIPS 207 / 208 standards expected (per NIST PQC roadmap)

The M-26-15 → IETF-127 axis is the operational story for the next 49 days. Federal agencies must submit migration plans by Oct 22. The IETF-127 final agenda publishes Oct 23. The next six weeks of PQC discussion will be dominated by the interaction of these two clocks: federal plans will reference the IETF standards that will (or will not) be available for the agencies' Phase 3 (2028-2030) and Phase 4 (2031) windows, and the IETF standards-track work will be informed by the federal plans' operational requirements (e.g., the M-26-15 explicit "provider-based libraries, configuration-driven algorithm selection, agile KMS/HSM" language).

7. The library / deployment state — closed September line

Library Last release Date Status this week
open-quantum-safe/liboqs 0.16.0 2026-07-09 No fresh release; commits continue on main (last week's AES-192, XMSS OOB, build-system fix)
open-quantum-safe/oqs-provider 0.12.0-rc2 2026-09-16 No fresh release; last commit 36cafae0 (Sept 19) — MAYO/MQOM/SNOVA Round 3
aws/aws-lc v5.11.0 2026-10-01 Released this week — see §1
openssl/openssl 4.1.0-beta1 2026-09-23 No fresh release; 4.1 final scheduled for October 2026

The September 2026 deployment line opened with the Sept 9 OpenSSL 4.0.3 / 3.6.5 / 3.5.9 multi-CVE cluster and closed with the Sept 23 OpenSSL 4.1.0-beta1 + AWS-LC v5.10.0 release pair. The intervening weeks added AWS-LC v5.6.0, v5.7.0, v5.8.0, v5.9.0, v5.10.0, and now v5.11.0 — six AWS-LC releases in 22 days, which is a deliberate operator-cadence choice (the AWS team is using AWS-LC's faster release cadence to ship PQC patches ahead of upstream OpenSSL's monthly cadence). The liboqs / oqs-provider release cadence is unchanged: a major tagged release approximately every 4-6 months. For freedom-tech deployers, the operational decision tree is now: (1) AWS-LC if you want faster PQC patch cadence and can accept the BoringSSL-line API surface, (2) OpenSSL 4.0.x for stability with the standard upstream API, (3) OpenSSL 4.1.0 in late 2026 / early 2027 for the DTLS 1.3 + PQC optimization work, (4) liboqs + oqs-provider if you need algorithm agility beyond the standardized set (Round 3 candidates, NTRU-Prime, Falcon, MAYO/MQOM/SNOVA, HQC).

8. The federal procurement and standards calendar

Date Event PQC relevance Days from Oct 3
2026-09-21 FIPS 140-2 → historical Sunset 12 days ago
2026-10-22 OMB M-26-15 federal Migration Plan submission deadline Civilian agency PQC migration plans due to OMB and ONCD 19 days out
2026-10-23 IETF-127 Final Agenda published TLS/LAMPS/PLANTS/JOSE WGs 20 days out
2026-11-02 IETF-127 I-D submission cut-off Last chance for new I-Ds 30 days out
2026-11-14 → 2026-11-20 IETF-127 San Francisco WGs meet 42 days out
2026-12-07 → 2026-12-11 ASIACRYPT 2026 Hong Kong ePrint 2026/2017 (ZZDSD-AKE) presentation 65-69 days out
2027-01-01 CNSA 2.0 first enforcement NSS-side PQ KEM + DSA 90 days out
2027-03-19 FAR Council second rulemaking (contractor VDP) Contractor PQC compliance ~167 days out
2030-12-31 EO 14412 / OMB M-26-15 Phase 3 — key establishment for HVAs Federal civilian key-establishment migration ~1550 days out
2031-12-31 EO 14412 / OMB M-26-15 Phase 4 — signature migration for HVAs Federal civilian signature migration ~1915 days out
2035-12-31 OMB M-26-15 Phase 5 — full migration of remaining civilian Federal civilian backstop ~3010 days out

The M-26-15 deadline at 19 days is the binding operational constraint for federal-side PQC work in this window. Every covered civilian agency (and federal contractors subject to the FAR Council rulemakings) must have a plan that names a PQC Migration Lead, presents a risk-based prioritization, defines a phased timeline, addresses TLS 1.3 milestones, describes an automated CBOM-like inventory, defines a crypto-agility architecture, lays out third-party coordination, and provides resource estimates. Operators in the federal supply chain should expect M-26-15-driven procurement-language changes to start appearing in Q4 2026 / Q1 2027 contracts.

What changed since September 26

Item Sept 26 state Oct 3 state Delta
CNSA 2.0 first enforcement 97 days 90 days -7
OMB M-26-15 deadline 26 days 19 days -7
IETF-127 (San Francisco) 49 days 42 days -7
IETF-127 Final Agenda published 27 days 20 days -7
ASIACRYPT 2026 (Hong Kong) 72 days 65-69 days -3 to -7
ML-KEM-in-TLS in queue 18 days; Blocked Sept 24 25 days; Blocked, no change in 9 days +7, no new state
ML-DSA-in-TLS in queue 15 days; Blocked Sept 24 22 days; Blocked, no change in 9 days +7, no new state
Composite ML-DSA in queue 63 days; "Awaiting Second editor" 70 days; "Awaiting Second editor", no further forward motion +7, no new state
MTC (PLANTS) revision -06 uploaded Sept 21 (per Sept 26 datatracker snapshot) -05 still latest per Oct 3 datatracker snapshot — -06 may have been retracted or in author-review only uncertain
liboqs XMSS CVE cluster Sept 5 cluster + Sept 21 #2511 OOB fix No fresh patches in this window; commits continue on main +12
AWS-LC release v5.10.0 (Sept 23) v5.11.0 (Oct 1) +8
OpenSSL release 4.1.0-beta1 (Sept 23) 4.1.0-beta1 (Sept 23, no fresh tag) no change
FIPS 206 (FN-DSA) IPD In administrative approval In administrative approval, no fresh public material no change
FIPS 140-2 sunset 5 days before 12 days since +12
FIPS 140-2 sunset follow-on none No fresh security advisories on the OpenSSL 4.0.x / 3.6.x / 3.5.x cadence from Sept 9 stable
NEW AWS-LC v5.11.0 not yet 2026-10-01 23:32 UTC; ML-KEM BMI2+AVX2 gate; FIPS 3.x EOL extended to Feb 2030; 32 PRs NEW
NEW AWS-LC FIPS 3.x EOL 2026 timeframe Extended to Feb 2030 (#3539) NEW
NEW ML-KEM BMI2+AVX2 deployment gate not yet #3596 — operators on legacy x86-64 without BMI2 will fall back to C reference NEW
NEW EVP_PKEY_check / public_check for KEMs not yet AWS-LC #2709 — first-class KEM public-key validation API NEW
NEW ePrint 2026/2113 (LWE/LPN-beyond NLA) not yet 2026-09-25; first single-assumption PKE+OT+SKE not in the LPN-broken regime NEW
NEW ePrint 2026/1992 (Google 2029 deadline) not yet 2026-09-23; first formal academic treatment of the 2029 private-sector PQC deadline NEW
NEW ASIACRYPT 2026 acceptance list not yet To be confirmed; ASIACRYPT 2026 Hong Kong Dec 7-11 pending
NEW Ethereum PQ Retreat not yet 2026-10-09 → 2026-10-12 Cambridge UK upcoming

Operator checklist for the September 26 – October 03 window

For a federal-contractor or vendor shipping PQ-relevant products: - [ ] OMB M-26-15 Migration Plan due Oct 22 (19 days out). Cover: HSM roadmap; TLS hybrid deployment; code-signing path; SSH PQ hybrid; long-term archive encryption; identity/PIV PQ plan; automated inventory methodology; risk-based prioritization (FIPS 199 impact level, HVA status); crypto-agility architecture; third-party coordination; resource estimates; governance roles. The M-26-15 nine required content elements are the test. No change from prior weeks. - [ ] AWS-LC v5.11.0 (Oct 1) — the PQ-relevant changes are: ML-KEM BMI2+AVX2 gate (#3596), ML-DSA X.509/CSR proof-of-possession check (#3592), FIPS 3.x EOL extension to Feb 2030 (#3539), EVP_PKEY_check / public_check for KEMs (#2709). Upgrade automation for operators on AWS-LC. - [ ] FIPS 140-2 sunset (12 days ago): no fresh security advisories on the OpenSSL 4.0.x / 3.6.x / 3.5.x cadence from Sept 9. Plan OpenSSL 3.x EOL (May 2027 for 4.0, Nov 2027 for 4.1) into procurement and certification timelines. - [ ] OpenSSL 4.1.0 final scheduled for October 2026. The 4.1 line carries EOL Nov 2027; 4.0 supported through May 2027. Operators should plan 4.1 adoption in late 2026 / early 2027 alongside OpenSSL 3.x EOL planning. The 4.1 line absorbs DTLS 1.3 + AVX-512 SHAKE for ML-DSA + ppc64le ML-DSA/ML-KEM NTT + s390x ML-DSA. - [ ] IETF-127 final agenda publishes Oct 23 (20 days out). The TLS WG agenda will inherit the Sept 24 re-block on both pure PQ-TLS documents. The LAMPS agenda should have composite ML-DSA publication imminent. The PLANTS agenda should have MTC -06 advancing (if it has been uploaded — the datatracker snapshot this week still shows -05). The JOSE agenda should have JOSE composite-sigs-04 advancing. - [ ] IETF-127 I-D submission cut-off Nov 2 (30 days out). Last chance to land a new I-D before IETF-127. - [ ] IETF-127 attendance (Nov 14-20, 42 days out). Recommend tracking the IETF-127 wiki and the datatracker meeting agenda for the pre-registered draft discussions as they accumulate. - [ ] Ethereum Foundation 2nd Annual PQ Research Retreat, Cambridge UK, Oct 9-12 (6 days out). leanVM / PQ consensus / signature aggregation. Relevant for blockchain-side PQC migration planning. - [ ] FIPS 206 (FN-DSA) IPD: still in NIST administrative approval. No fresh public material. DigiCert's "wait until final" position holds. The fixed-point signing design is the substantive change to plan for; the single signing procedure with CAVP-validatable KAT outputs is what unblocks module integration. - [ ] ePrint 2026/2113 (Sept 25) — diversification track beyond LWE/LPN is the most consequential new assumption paper of the week. Track for replication; do not delay ML-KEM / ML-DSA / SLH-DSA adoption on it. - [ ] ePrint 2026/1992 (Sept 23) — Google 2029 deadline is the first formal academic treatment of the 2029 private-sector PQC deadline. The unified-framework result gives a reduction-style argument that the RFC 10024 hybrid composition is security-preserving under standard IND-CCA assumptions on both components. Cite in procurement language for hybrid-by-default mandates.

For a freedom-tech deployer (independent of federal procurement): - [ ] No action items from the IETF re-block: the KEM-then-compose architecture is the IETF's documented path; the dispute is about specific document publication, not about the cryptographic primitives. Continue deploying hybrid (RFC 10024 in TLS; mlkem768x25519 in SSH; Signal PQXDH in messaging; iMessage PQ3 in messaging; RFC 9980 hybrid in OpenPGP). - [ ] AWS-LC v5.11.0: the BMI2+AVX2 gate is a deployment correctness fix. Operators on AWS-LC should verify their build's runtime detection is intact; legacy x86-64 without BMI2 (pre-Haswell, pre-Bulldozer-successor) will now fall back to the C reference implementation, which is correct but slower. - [ ] No action items on the Dihedral Coset line: the August 15 GRZ refutation stands; ML-KEM and ML-DSA are not moving. - [ ] No action items on the September cryptanalysis: 2026/2137 (single-trace ML-KEM key-recovery, q-randomization countermeasure) and 2026/2131 (RSA-4096 below 128-bit under signing-oracle) remain the two papers that matter for high-value-deployer planning. For embedded / side-channel-exposed deployments, the q-randomization countermeasure (937 bytes firmware) restores ~4 bits of security loss instead of >140. Continue moving away from RSA for long-lived signing keys; hybrid Ed25519+ML-DSA-65 per Hybrid KEM Migration. - [ ] ML-KEM + HQC hybrid is the most explicitly-named diversification strategy on the standards track (per Mattsson's Sept 25 pqc-forum post). For operators with the freedom to deploy non-finalized primitives, this is the standards-track-aligned diversification path. HQC standardization is expected 2026-2027; operators can field HQC hybrid before the standard finalizes. Cross-reference HQC. - [ ] MIKE (isogeny-based, research-grade) can be fielded in operator-controlled settings where only isogeny-based options fit (per Obenour's Sept 25 forum post). Hybridize with ECDH and Kerberos-style symmetric keying so security holds if any component holds. - [ ] ePrint 2026/2113 (NLA beyond LWE/LPN): track for replication. Do not delay ML-KEM / ML-DSA / SLH-DSA adoption; treat 2026/2113 as a 12-24-month diversification track. - [ ] ePrint 2026/1992 (Google 2029): the 2029 date is a migration target, not a forecast of when recorded traffic becomes decryptable. The unified-framework result reinforces the hybrid-by-default operational recommendation.

Primary sources

IETF datatracker state (verified Oct 3, 2026)

ePrint papers (verified Oct 3, 2026)

GitHub releases and commits (verified Oct 3, 2026)

  • open-quantum-safe/liboqs — 3,073 stars, pushed 2026-09-25 (per last week's snapshot); tagged 0.16.0 (Jul 9, 2026); commits b196b57 (Sept 24 AES-192), a56c55b7 (Sept 21 XMSS OOB fix), d5fc44f6 (Sept 23 build-system), 42427192 (Sept 21 XMSS code-scan)
  • open-quantum-safe/oqs-provider — 499 stars, pushed 2026-09-19; tagged 0.12.0-rc2 (Sept 16); commit 36cafae0 MAYO/MQOM/SNOVA Round 3 update (Sept 19)
  • aws/aws-lc — 836 stars, pushed 2026-10-01 (v5.11.0, fa9bc8d, PR #3610 by skmcgrail), 23:32 UTC; 32 PRs since v5.10.0; PQ-relevant: #3596 ML-KEM BMI2+AVX2 gate, #3592 ML-DSA X.509/CSR PoP, #3537 TLS 1.3 client cipher suite check, #3566 TLS record-layer bounds, #3539 FIPS 3.x EOL → Feb 2030, #2709 EVP_PKEY_check / public_check for KEMs
  • aws/aws-lc/releases — full release history: v5.1.0 (2026-06-26), v5.2.0 (2026-07-15), v5.3.0, v5.4.0 (2026-07-22), v5.5.0, v5.6.0, v5.7.0, v5.8.0, v5.9.0 (2026-09-15), v5.10.0 (2026-09-23), v5.11.0 (2026-10-01)
  • openssl/openssl — 30,841 stars, pushed 2026-09-25 (per last week's snapshot); tagged openssl-4.1.0-beta1 (Sept 23), openssl-4.1.0-alpha1 (Sept 9), openssl-4.0.3 / 3.6.5 / 3.5.9 (Sept 9 multi-CVE)

Standards / synthesis sources

  • Post-Quantum Saturday — September 26 2026 Weekly Update — prior weekly update (both pure PQ-TLS documents re-blocked under appeal Sept 24 by Deb Cooley; mlkem-11 uploaded Sept 16; composite ML-DSA first forward motion in 63 days; MTC -06 uploaded Sept 21; ePrint 2026/2137 single-trace ML-KEM key-recovery with q-randomization countermeasure; ePrint 2026/2131 RSA-4096 below 128-bit under signing-oracle; Mattsson ML-KEM+HQC hybrid recommendation; AWS-LC v5.10.0; OpenSSL 4.1.0-beta1; liboqs XMSS OOB fix; CNSA 2.0 97 days; IETF-127 49 days; OMB M-26-15 26 days).
  • Post-Quantum Saturday — September 19 2026 Weekly Update — prior weekly update (ePrint 2026/2017 Sep 14 — Ding/Yu/Pan/Cheng/Weng defeat ZZDSD-AKE eCK-security and GDLL-KE, ASIACRYPT 2026 accepted; KEM-then-compose architecture formally vindicated; GSA PQC Summit Sep 16; ML-KEM IANA review → "IANA OK - Actions Needed"; CNSA 2.0 first enforcement 104 days; FIPS 140-2 sunset 2 days; OMB M-26-15 plans due Oct 22, 33 days out; IETF-127 in 56 days).
  • Post-Quantum Saturday — September 12 2026 Weekly Update — prior weekly update (ML-DSA-in-TLS cleared 65-day appeal freeze 2026-09-11, now in RFC Ed Queue; pure ML-KEM one week into Approved-announcement sent; composite ML-DSA 49 days in RFC Ed Queue; CNSA 2.0 first enforcement Jan 1 2027 is 110 days out; GSA PQC Summit Sep 16; OMB M-26-15 plans due Oct 22; ePrint 2026/1915+1922 ML-KEM side-channel papers Sep 8/9; OpenSSL 4.0.3/3.6.5/3.5.9 multi-CVE Sep 9; Bernstein appeal record closed).
  • Post-Quantum Saturday — September 05 2026 Weekly Update — prior weekly update (pure ML-KEM approved by IESG Sept 3; ML-DSA-in-TLS held under appeal 59 days; composite ML-DSA in RFC Ed Queue; MTC status corrected to WG-document stage; SVP in 2^0.7314n; FHE sparse Ring-LWE loses up to 13 bits — 12/16 parameter sets below 128-bit; Ethereum drops Poseidon; OpenSSL multi-CVE Aug 25; FIPS 140-2 sunset Sep 21; OMB M-26-15 plans due Oct 22).
  • Post-Quantum Saturday — August 22 2026 Weekly Update — prior weekly update (Simon DCP claim formally refuted — Gupte–Ragavan–Zhandry no-go theorem, ePrint 2026/1693, Lean 4 machine-checked; RFC 10024 hybrid TLS published; Bernstein 75-objection filing on pure ML-KEM; HAWK/Mythos + McEliece distinguisher backfill; Google Cloud dated roadmap).
  • Overview - Post-Quantum Cryptography — long-form canonical overview.
  • PQC Deployment and Libraries Tracker — 2026 deployment map.
  • The Dihedral Coset Attack Line — twenty-year research program from Regev 2004 to GRZ 2026 no-go.
  • Merkle Tree Certificates — PQ Web PKI breakthrough; Let's Encrypt staging late 2026, production 2027.
  • Hybrid KEM Migration — operational migration playbook.
  • ML-KEM, ML-DSA, SLH-DSA, HQC, FN-DSA Falcon — algorithm notes.
  • Bitcoin PQ Migration — blockchain-specific migration.

Vault note: this update follows the September 26, 2026 weekly entry. The next scheduled PQC weekly will be Post-Quantum Saturday — October 10 2026 Weekly Update. Verified against IETF datatracker history pages on 2026-10-03 02:00 UTC; ePrint recent-papers scan on 2026-10-03 02:00 UTC; GitHub API on 2026-10-03 02:00 UTC.