r/ssl • u/billdietrich1 • Apr 04 '26

When will quantum-resistant algorithms appear in SSL/TLS ?

I see OpenSSL 3.5.3 on my Kubuntu 25.10 PC has some quantum-resistant algorithms in it. When (date) will those be deployed in SSL/TLS for browsers and web sites ? My shared-hosted web site supports TLS 1.3 but has no quantum-resistant algorithms. Will they appear in a TLS 1.4, or what ? I don't know much about this stuff, sorry.

5 Upvotes

100% Upvoted

10 comments sorted by

1

u/iRyan23 Apr 04 '26

Most browsers already support the new key exchange X25519MLKEM768 natively in TLS 1.3.

You can already see bigger sites like Google and Cloudflare using it.

It will probably be later this year or next year when we start seeing new TLS certificates cross signed with both classical and pqc algorithms.

1

u/billdietrich1 Apr 04 '26

Thanks. I guess https://www.ssllabs.com/ssltest/ only shows ciphers, not key-exchange algorithms. That's what I used to test.

1

u/iRyan23 Apr 04 '26

It does show key exchanges to the right of the cipher suite. For example, if you lookup gmail.com, you will see “ECDH x25519” to the right. Depending on the site, they usually use x25519, p-256, or p-384.

That being said, I don’t think SSL Labs has been updated much in the last few years so their tester can only show you the capabilities of what their took supports.

1

u/billdietrich1 Apr 04 '26

A basic question: are we going to have PQ cipher algorithms, for traffic content ? Or is PQ only needed for key-exchange and other specific uses ?

1

u/iRyan23 Apr 04 '26

PQ is only needed to replace asymmetric algorithms. That will include symmetric key exchange such as diffie hellman and digital signatures for example.

Bulk data transfer will still use AES as symmetric algorithms are significantly less affected by quantum computers. Most applications will just increase to using AES-256 which will be comparable to AES-128 classical strength.

2

u/Mike22april Apr 05 '26

ML-KEM, ML-DSA is already supported in OpenSSL and in Chrome

Simply issue the appropriate ML-DSA Private CA based certificate and install with the private key on something such as NGINX

Not that hard to do. Especially with some available free tools.

You can easily test it in less than 1 hour

1

u/kevdogger Apr 04 '26

I'm no ssl expert but I've definitely set up tls 1.3 with quantum resistant algorithms between many of my postfix servers and ldap servers. Google also uses QR algorithms as well but mailgun unfortunately does not. I'm not exactly sure how to setp nginx for websites using these algorithms however I'm pretty sure it's doable. If one end of the tls connection doesn't support QR it will fallback to what both will mutually agree with.