PQC Solutions
8 articles in this category.
Beyond TLS: Post-Quantum VPNs (WireGuard and IPsec)
How experimental post-quantum WireGuard forks and IKEv2 Multi-KE (RFC 9370) carry hybrid ML-KEM handshakes over UDP, and how to prevent IP-layer fragmentation of oversized PQC handshake datagrams.
Read More about Beyond TLS: Post-Quantum VPNs (WireGuard and IPsec)→The Enterprise PQC Migration Checklist: Discovery to Deployment
A phased, checklist-driven structure for CISOs and DevOps leads to inventory cryptographic assets, update TLS libraries, and roll out hybrid PQC on reverse proxies without causing handshake outages.
Read More about The Enterprise PQC Migration Checklist: Discovery to Deployment→The 47-Day TLS Certificate: Automation as a Prerequisite for PQC
Why CA/Browser Forum-mandated certificate lifespans falling to 100 days by 2027 and 47 days by 2029 force ACME automation — and why that automation is the exact crypto-agility infrastructure a PQC algorithm swap requires.
Read More about The 47-Day TLS Certificate: Automation as a Prerequisite for PQC→Deploying PQC on Edge: Nginx and Envoy Configurations
The current state of PQC support in OpenSSL and BoringSSL, concrete nginx.conf and Envoy config snippets for hybrid key exchange, and how to verify the negotiated group with openssl, curl, and bssl.
Read More about Deploying PQC on Edge: Nginx and Envoy Configurations→Implementing Hybrid TLS in Go: A Developer's Guide
How crypto/tls adopted hybrid post-quantum key exchange from X25519Kyber768Draft00 to X25519MLKEM768, with working server and client tls.Config examples and fallback guidance.
Read More about Implementing Hybrid TLS in Go: A Developer's Guide→The Performance Cost of PQC: Key Sizes and Network Latency
Byte-level comparison of Ed25519/X25519 versus ML-KEM-768 and ML-DSA-65, and how the resulting payload growth interacts with TCP congestion windows, fragmentation, and QUIC/DTLS anti-amplification limits.
Read More about The Performance Cost of PQC: Key Sizes and Network Latency→Buying and Deploying PQC-Ready Certificates: Providers, ACME, and Nginx
The current state of PQC certificate issuance across major CAs, how ACME accommodates large ML-DSA signatures, and a copy-pasteable nginx.conf for hybrid key exchange with your existing certificate.
Read More about Buying and Deploying PQC-Ready Certificates: Providers, ACME, and Nginx→Cryptographic Agility: Best Practices for the PQC Migration
Why hardcoded cryptographic primitives are an architectural liability in the PQC era, and how to design systems that swap ML-KEM, ML-DSA, or their successors without rewriting business logic.
Read More about Cryptographic Agility: Best Practices for the PQC Migration→