From the lab
Audit reports, research, methodology, and conformance notes: what we find at the protocol and architecture layer, written so it generalises.
39 articles
Executive Order 14412 sets a 2030 federal PQC deadline
Executive Order 14412, signed on June 22, 2026, gives the federal post-quantum migration dates that agencies have to plan against: key establishment by December 31, 2030 and digital signatures by December 31, 2031 for High Value Assets and high impact systems. It also directs the FAR Council to propose a rule carrying the same 2030 requirement to covered contractors. Here is what the order obliges, when each clock runs out, and which parts reach past the federal perimeter.
noble-post-quantum: 18 findings, none in the primitives
We reviewed the most widely used pure-JavaScript post-quantum library twice, six days apart, and found eighteen defects. Not one of them is in the maths. The first round was merged in two hours; the second found twelve more in the repaired code; then the maintainer read our patches and found two defects in them.
The Dart NDK audit: a GPL-3.0 crate inside an MIT SDK
The most serious finding in our review of the Dart Nostr Development Kit was not cryptographic. It was a GPL-3.0-only crate inside an MIT-licensed SDK. Compiled into every application that depended on the SDK, whether or not that application used post-quantum code at all. All five findings are now fixed and shipped in ndk 0.9.0.
QuantaCipher audit: advertised ML-KEM, shipped Kyber
A product sold on FIPS 203 ML-KEM was shipping a pre-standard Kyber variant, at a lower security level than its own datasheet claimed. So we measured it. The cryptography underneath was sound, the runtime reported an algorithm string matching neither, and four of six findings are now closed.
Obelisk: the first Nostr client with post-quantum DMs
Nine days ago we published a proposal for giving a Nostr identity post-quantum keys, derived from its seed phrase where it has one. It is now running in a chat client anyone can open. Obelisk sends gift-wrapped direct messages carrying an ML-KEM-1024 payload, against public relays, with no relay changes and no changes required of clients that do not opt in. The four specification drafts are public. So is the bug we shipped and caught, which was in the routing rather than the cryptography.
Lazarus used ML-KEM to hide a Windows zero-day
Check Point Research disclosed that the North Korea-linked Lazarus Group used ML-KEM, the NIST-standardized post-quantum key encapsulation mechanism, to protect the delivery channel for a Windows kernel zero-day (CVE-2026-68820) in its Operation Dream Job campaign against defense and aviation firms. Microsoft patched the flaw in its August 2026 Patch Tuesday release, the only bug that month it flagged as actively exploited. The notable part is not quantum computers, it is that a well-reviewed, standardized primitive is now common enough that attackers reach for it too.
Post-quantum TLS 1.3 hybrid is now RFC 10024
The IETF has published RFC 10024, formally standardizing X25519MLKEM768, SecP256r1MLKEM768, and SecP384r1MLKEM1024 as hybrid post-quantum key agreement mechanisms for TLS 1.3. The three groups replace the long-running draft-ietf-tls-ecdhe-mlkem specification that browsers and libraries were already shipping as a de facto default. Here is what the RFC locks in, and what it still leaves for a separate migration.
Bitcoin self-custody: make your own randomness
In 2026, thieves emptied thousands of hardware wallets without breaking any of Bitcoin's cryptography. They just guessed the keys. Here is how that is possible, explained plainly, and the one simple thing that saved the people who did it.
A post-quantum transition for Nostr identities
Every encrypted Nostr message published today is a future plaintext. We are proposing a NIP, jointly with nostr-wot, that lets an identity derive post-quantum keys from its seed phrase where it has a 24-word one - so those words still restore the identity after the transition. Accounts without one, which is most of them, generate an independent key that needs its own backup. It is implemented and running against public relays, not a design document: you can send a post-quantum encrypted message and take it apart layer by layer.
Cloudflare adds post-quantum authentication to origins
Cloudflare now supports post-quantum authentication between its edge and your origin server: Authenticated Origin Pulls and Custom Origin Trust Store both accept ML-DSA (FIPS 204) certificates. Paired with the X25519MLKEM768 key exchange already running on that hop, this is the first mainstream path to a fully post-quantum CDN-to-origin connection, not just the browser-to-edge leg.
AI-found flaw sinks HAWK, a NIST PQC candidate
On July 28, 2026, Anthropic disclosed that its Claude Mythos Preview model found a structural weakness in HAWK, a lattice-based signature scheme in the third round of NIST's additional-signatures process. The flaw cut the estimated key-recovery cost for the smallest parameter set by roughly a million times, and the HAWK team withdrew the candidate days later. None of NIST's finalized standards, ML-KEM, ML-DSA, and SLH-DSA, are affected.
Go 1.27 brings post-quantum signatures to the stdlib
Go 1.27, released this month, adds a crypto/mldsa package implementing ML-DSA (FIPS 204), plus ML-DSA support in crypto/x509 and crypto/tls. Post-quantum signatures are no longer a third-party dependency for Go services, they are a standard-library import. Here is what shipped and what it means for the migration.
How much of the web already uses post-quantum TLS
By late 2025, around 43% of human web connections to Cloudflare were already using hybrid post-quantum key agreement, and X25519MLKEM768 is on by default in every major browser. The browser-to-edge hop is largely migrated. The unfinished half is origins, authentication, and your own stack. Here is where the line actually is.
How ML-KEM became the browser default, release by release
Chrome has negotiated hybrid post-quantum key agreement by default since version 131 in November 2024, migrating from a pre-standard Kyber draft to the finalized X25519MLKEM768. The other major browsers and libraries followed. Here is how the switch happened, and what the hybrid does and does not protect.
NIST's 2030 and 2035 deadlines for legacy cryptography
NIST's transition report, IR 8547, names the dates the whole migration is timed against: today's public-key algorithms deprecated after 2030 and disallowed after 2035. Those are not distant abstractions, they are a schedule you have to work backwards from. Here is what the deadlines say and what they mean.
CISA's 2026 SBOM minimum elements: what changed, and why
CISA, with the NSA, FBI, and international partners, replaced the 2021 NTIA baseline for what a software bill of materials must contain. The new floor asks for cryptographic hashes on every component, a signature on the SBOM itself, full transitive-dependency depth, and machine-processable identifiers, and it applies to open-source, AI software, and SaaS. Here is what changed, why it was done, and why it lands next to the cryptographic bill of materials we build.
A field guide to post-quantum readiness, free and in the open
Most post-quantum material is one of two things: a vendor pitch that tells you to panic, or a standard that assumes you already have a doctorate. We built the part in between and put it online for free. The quantakrypto knowledge base is 11 collections, 49 topics, an 85-term glossary, and straight answers, with reading paths for employees, IT, and leadership.
You cannot migrate what you cannot see: build a CBOM with qScan
Every post-quantum migration plan starts with the same step, and almost everyone underestimates it: know exactly what cryptography you have. A cryptographic bill of materials (CBOM) is that inventory in a standard, machine-readable form. Here is how to produce one across your code and your infrastructure in about a minute, with qScan, and what to do with it once you have it.
A well-known URI for cryptographic posture: the crypto-agility manifest
A machine can already ask a site what to crawl (robots.txt) and who to email about a bug (security.txt). It cannot ask what cryptography the site runs or how far along its post-quantum migration is. We are proposing a small well-known file that answers exactly that, and shipping the emitter in qScan. It is a proposal, not a ratified standard.
Governments set the post-quantum deadlines. Their own sites are behind.
We added 201 government and public-sector sites to the PQC Observatory and measured them as their own panel. Just under a third negotiate post-quantum key exchange today. The pattern is not the one you would guess: several of the governments writing the migration mandates have not enabled it on their own front doors, while smaller states are already there.
From a snapshot to a signal: continuous post-quantum posture
A one-time scan tells you where you stand today. Migration is a moving target, so we now track posture over time: an append-only snapshot per scan, a drift alert when a commit reintroduces quantum-vulnerable crypto, and migration projects that group findings by an identity that survives a line shift.
A post-quantum readiness credential a machine keeps checking
Point-in-time certificates go stale the day after issuance, and buyers know it. Our attestation keeps the issuance proof but adds a machine that re-verifies the posture against live scans on a schedule; the public status degrades to re-verifying and then lapsed if the evidence drifts, and recovers on its own.
Not all RSA is equal: quantifying harvest-now-decrypt-later exposure
Every scanner treats RSA on a marketing microsite and RSA on 25-year health records as the same finding. Real risk is a property of the data behind the crypto. We now compute an exposure score per finding, vulnerability times data sensitivity times a Mosca margin, and rank the migration backlog by risk instead of by count.
The PQC Observatory: measuring post-quantum readiness across the web
Every month we probe a fixed panel of public hosts for hybrid key exchange and certificate posture, then publish the trend. Here is what the observatory measures, how, and why a vendor-neutral series is worth keeping.
A post-quantum workflow for AI coding agents
AI coding agents are fluent in cryptography and blind to its expiry date. The quantakrypto MCP gives them the missing sense. Here is the workflow we actually use: what to delegate to the agent, and where a human still decides.
You migrated to post-quantum crypto. Is the implementation actually conformant?
Audits catch exploitable bugs; conformance is a different axis. Here is how to test any ML-KEM / ML-DSA / SLH-DSA implementation against FIPS 203/204/205 in a few minutes, plus a real (since-fixed) FIPS 203 deviation it surfaced in a widely-used library.
Passwords are an organizational problem: why policy and tooling beat "pick a better password"
Credential theft is the front door to most breaches, and the fix is not a sterner lecture about passwords. It is a system: modern policy grounded in NIST 800-63B, the tooling that makes the policy real, and scanning that catches secrets in code before they ship.
Mosca's theorem: the equation that decides when to start post-quantum migration
You cannot predict when a quantum computer will break RSA, and Mosca's inequality (X + Y > Z) says you do not need to. Here is the arithmetic that decides whether you should already be migrating.
We scanned 43 open-source projects for quantum risk. The bigger problem was classical.
We built a scanner to inventory quantum-vulnerable cryptography and ran it across 43 popular open-source projects. It flagged the RSA and elliptic-curve keys we expected and, more often than we'd like, TLS certificate verification switched off in production.
Introducing quantakrypto
We exist for one reason: to get your systems quantum-ready before Q-day. Here's who we are, what the lattice in our mark means, and what you'll find on this blog.
Why we built quantakrypto
Quantum computing just hit its transistor moment: real systems, real early uses, and a cryptographic reckoning that's a planning problem today and a break-glass problem in the 2030s. The gap between a finished standard and an unstarted migration is why this firm exists.
The clock is already running
Why we don't wait for a quantum computer to arrive before we act, and how to decide what to migrate first using a clock you already own.
How we help you get quantum-ready
Four steps from "we should look into this" to a certificate you can hand an auditor: audit, tools, certification, training. Here's how each one works.
Post-quantum migration is a risk-asymmetry problem, not a timeline bet
You do not need to predict when a cryptographically relevant quantum computer arrives. You need to weigh the cost of migrating too early against the cost of migrating too late, and those costs are not symmetric.
From the audit floor: replay-attackable post-quantum prekeys
A messaging system issued post-quantum prekeys one-shot but never retired them after use, letting an attacker replay the same ML-KEM encapsulation and quietly defeat forward secrecy.
X-Wing and the TLS group: choosing a hybrid KEM combiner
Hybrid KEMs and hybrid signatures are not the same problem. For key exchange, the industry has largely converged on X25519MLKEM768, and there are good reasons to follow rather than invent.
Sieve: conformance testing ML-KEM and ML-DSA against the bugs that matter
Even a correct-looking post-quantum implementation can fail in the specific bug-class patterns we see repeatedly in audits. Sieve encodes those classes as targeted, reusable test batteries.
The crypto inventory: finding every place asymmetric crypto hides
“Add post-quantum” is not a single switch. The first deliverable of a serious migration is a cryptographic inventory: every place asymmetric cryptography is used, and what depends on it. Here is how national cyber agencies build one, and why it is the hard part.
From the audit floor: variable-time decapsulation and the KyberSlash class
We have audited ML-KEM implementations whose decapsulation leaked secret-dependent timing, the class of side-channel that the 2024 KyberSlash and clangover attacks turned into practical key recovery.
Turn quantum risk into a credential.
Book a discovery call and get an indicative scope and pricing for your organisation.