Technical readiness record for the SQUIRL OS prototype stating its position against the post-quantum cryptography standards and deadlines in force as of October 30, 2026. Version 1.1. NIST published the final version of NISTIR 8547 on 2026-10-27 and withdrew the 2024 draft the same day. The headline dates held: quantum-vulnerable public-key algorithms are deprecated after 2030 and disallowed under NIST standards and guidelines after 2035. What changed is scope. The final report deprecates every approved classical strength after 2030, including P-256, P-384, RSA-3072 and Ed25519, where the draft deprecated only 112-bit parameter sets. Version 1.1 closes two CNSA 2.0 gaps identified in version 1.0. First, the signature parameter set: NSA names ML-DSA-87 at every classification level, so ML-DSA-65 does not satisfy the suite and the canonical signature is now ML-DSA-87. Second, SLH-DSA: NSA states that SLH-DSA, while hash-based, is not part of CNSA 2.0 and is not approved for any use in National Security Systems, and that the only approved hash-based options for firmware and software validation are LMS or XMSS per SP 800-208. Version 1.1 adds a full CNSA 2.0 conformance table covering AES-256, SHA-384/512, ML-KEM-1024, ML-DSA-87, LMS/XMSS, HashML-DSA and SLH-DSA. The record keeps its central distinction: correcting the approved algorithm set is not the same as re-keying running components. The remaining open items are stated explicitly, including the implementation audit, a firmware validation path, hybrid key establishment specification, and an inventory of non-migratable systems. No certification and no compliance attestation is claimed. SQUIRL OS is a prototype provided for educational and research purposes.
Technical readiness record for the SQUIRL OS prototype stating its position against the post-quantum cryptography standards and deadlines in force as of October 30, 2026. Version 1.1. NIST published the final version of NISTIR 8547 on 2026-10-27 and withdrew the 2024 draft the same day. The headline dates held: quantum-vulnerable public-key algorithms are deprecated after 2030 and disallowed under NIST standards and guidelines after 2035. What changed is scope. The final report deprecates every approved classical strength after 2030, including P-256, P-384, RSA-3072 and Ed25519, where the draft deprecated only 112-bit parameter sets. Version 1.1 closes two CNSA 2.0 gaps identified in version 1.0. First, the signature parameter set: NSA names ML-DSA-87 at every classification level, so ML-DSA-65 does not satisfy the suite and the canonical signature is now ML-DSA-87. Second, SLH-DSA: NSA states that SLH-DSA, while hash-based, is not part of CNSA 2.0 and is not approved for any use in National Security Systems, and that the only approved hash-based options for firmware and software validation are LMS or XMSS per SP 800-208. Version 1.1 adds a full CNSA 2.0 conformance table covering AES-256, SHA-384/512, ML-KEM-1024, ML-DSA-87, LMS/XMSS, HashML-DSA and SLH-DSA. The record keeps its central distinction: correcting the approved algorithm set is not the same as re-keying running components. The remaining open items are stated explicitly, including the implementation audit, a firmware validation path, hybrid key establishment specification, and an inventory of non-migratable systems. No certification and no compliance attestation is claimed. SQUIRL OS is a prototype provided for educational and research purposes.
The impressively fast development of quantum computing is a serious threat to classical public-key cryptography, and algorithms such as Shor's and Grover's will render RSA and elliptic curve systems essentially useless as soon as a cryptanalytically relevant quantum computer becomes available. Although it is still some way off before such machines are available, the harvest-now-encrypt-later threat highlights the need for proactive defense. In response, the National Institute of Standards and Technology (NIST) published the first post-quantum cryptography standards in 2024, including ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) for digital signatures and SLH-DSA (SPHINCS+) as a stateless hash-based alternative. This paper is a summary of the evolving post-quantum landscape, starting with the standards and their underlying security and then moving on to migration policies such as CNSA 2.0 and CISA, NSA and NIST guidance. It also looks at integration patterns for important protocols such as TLS, IPsec, SSH, and code signing. A performance, interoperability and overhead evaluation methodology is presented with results showing that hybrid deployment and crypto-agile architectures make PQC adoption a viable option. The paper concludes by providing a governance-oriented roadmap, where inventory, prioritization and pilot deployments are identified as near-term actions, with open questions remaining on performance optimization, implementation security and algorithm resilience over time.
Post-quantum cryptographic standardization is complete for the algorithms that matter most, yet adoption across financial infrastructure remains uneven and, in critical segments, largely absent. This paper argues that migration is no longer a research question but an execution question, and that the window for orderly transition is narrower than the commonly cited “Q-Day” horizon of 2030-2035 implies. Because adversaries can record encrypted traffic today and store it for decryption once cryptographically relevant quantum computers exist, the effective deadline for protecting data with multi-year confidentiality requirements has already passed. We review the NIST-approved suite — ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) — alongside hybrid key-exchange constructions now deployed at internet scale, and assess their applicability to financial systems. We map the compliance landscape consolidating around 2030 and 2035, including NIST IR 8547, NSA CNSA 2.0, and the 2026 G7 Cyber Expert Group roadmap, alingside converging UK and EU timelines. Finally, we offer a practical migration framework organized around cryptographic inventory, exposure-window triage, and crypto-agility. Our central finding is that technical barriers to beginning migration are substantially lower than institutional inertia suggests: for many systems, post-quantum key agreement is a library upgrade rather than a redesign.
The prospect of cryptographically relevant quantum computers threatens public-key primitives underpinning modern digital infrastructure, including RSA, Diffie-Hellman, and elliptic-curve cryptography. Post-quantum cryptography (PQC) responds with algorithms believed to be hard for both classical and quantum adversaries. In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalised the first three PQC standards: FIPS 203 (ML-KEM, based on Kyber), FIPS 204 (ML-DSA, based on Dilithium), and FIPS 205 (SLH-DSA, based on SPHINCS+). This paper surveys the algorithmic families behind these standards, the harvest-now-decrypt-later threat model, hybrid migration strategies, performance trade-offs, and the engineering challenges of transitioning the global cryptographic stack. We examine deployment progress in TLS, SSH, X.509, and constrained devices, and outline open research questions on side-channel security, falcon-style signatures, and the long-term replacement schedule for classical asymmetric cryptography.
Large-scale quantum computers would invalidate the hardness assumptions behind many deployed public key cryptosystems and reduce the effective strength of symmetric primitives. As a result, governments and industry have begun a multi-year transition toward post quantum cryptography and quantum safe protocols. This survey provides a structured overview of that transition. It classifies the main families of post quantum schemes, with emphasis on the standardized lattice based and hash-based algorithms ML-KEM, ML-DSA, SLH-DSA, FALCON and Classic McEliece, and it summarizes their parameter sets, key sizes, ciphertext or signature lengths and performance profiles across the NIST security categories. The survey then reviews stateful hash-based signatures, multivariate and isogeny-based proposals and emerging MPC in the head constructions and discusses their security assumptions and level of maturity. At the protocol level it analyzes hybrid designs for TLS 1.3, QUIC, IPsec, SSH and public key infrastructures and draws lessons from early deployments in web, IoT, and cloud environments. By collating detailed parameter data from recent NIST standards and reference implementations and mapping them to concrete deployment scenarios, the survey links high-level policy guidance to engineering choices. The paper also synthesizes cross cutting implementation and migration challenges, including side channel resistance, cryptographic agility, asset inventory and migration planning, and algorithm diversity across deployments. Finally, it identifies open problems such as leakage resilient implementations, domain specific post quantum profiles for constrained devices and combinations of post quantum cryptography with quantum key distribution. The goal is to give researchers and practitioners a coherent reference that connects algorithms, standards, protocol mechanisms and deployment guidance for building quantum safe systems.
FIPS 203, 204 and 205 closed the algorithmic gap in post-quantum cryptography (PQC); the production gap -- hybrid combiners, conformance evidence, migration tooling, stateful signing, protocol helpers -- remains open. A methodology that scores it must not choose its own dimensions, so we anchor nine to external requirements (CNSA 2.0, CMVP, the TNO CADI survey, the IETF hybrid draft). We present quantum-safe, a hybrid-by-default Python library built against this rubric, and an audit of nine PQC libraries (September 2026). The exercise can lower our own score, and it does.
Hybrid combiners exist in three of six verifiable libraries, not the one a March-2026 snapshot found. Discovery and inventory tooling is the sharper gap: none of seven audited libraries has it; quantum-safe adds a CycloneDX CBOM. Only Bouncy Castle holds a CMVP FIPS 140-3 certificate; quantum-safe reports 225/225 runnable ACVP known-answer cases, which is conformance evidence, not validation. Bouncy Castle also supports LMS and XMSS where quantum-safe has LMS only, and quantum-safe's defaults sit below the CNSA 2.0 parameter sets; we score both against ourselves.
Every benchmark figure is computed from archived raw runs (bootstrap intervals over 15 runs). A full X25519 + ML-KEM-768 handshake takes a median of 231 microseconds under Docker/Linux (95% interval 218-250), 5.3x an X25519-only handshake and 0.46-2.3% of a typical TLS 1.3 budget. Throughput is flat from 100 to 5,000 threads but below the single-thread rate: threads do not speed up the hybrid path, although liboqs does release the GIL in longer calls (ML-DSA-65 signing scales 2.6x on four threads). Timing side channels are treated in a companion paper.
This paper evaluates quantum and AI-accelerated risks to TLS 1.3 cryptographic dependencies under an evidence-tiered model, distinguishing mechanism-backed threats (Shor algorithm against RSA and ECC) from contingency-backed risks to lattice-based post-quantum cryptography (PQC) and hypothesis-only risks to hash-based and symmetric primitives. We do not identify any known breaks of ML-KEM, ML-DSA, SLH-DSA, or AES-256. Instead, we use explicit scenario assumptions, organized as a four-scenario capability model with parameters and pseudocode for reproducibility, to stress-test migration timelines accompanied by parameter sensitivity analysis and explicit falsification analysis. The primary methodological contribution is a reproducible scenario-estimation instrument together with its explicit update mechanics: every parameter is a named, anchored quantity that can be varied and the model rerun; a stated protocol maps observed conformance to, or deviation from, the modeled curves onto revisions of specific parameters, so progressive refinements can be tested against accumulating historical data. The paper is a methodological companion to quantum resource-estimation studies and to expert-elicitation timeline surveys such as the Global Risk Institute quantum threat reports, with its revision rules stated explicitly. As of mid-2026, the model does not show any NIST-approved algorithms as broken. Instead, the vulnerability spectrum under different scenarios shows RSA risk crossing the 50% threshold between 2030-2032 and the PQC risk becoming a non-zero risk after 2032-2035 under contingency scenarios conditional on the unproven dimension-collapse. We urge PQC migration as mandatory per the 2030 and 2031 federal deadlines and by Mosca HNDL reasoning, and that crypto-agility and hybrid cryptographic deployment be considered necessary complements to any PQC migration efforts.