Transitioning TLS to Post-Quantum Cryptography

Source context: this article examines information published by the source on October 15, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What was published

The NCSC has released updated technical guidance regarding the configuration of post-quantum cryptography (PQC) for Transport Layer Security (TLS). This update incorporates standards from IETF RFC 10024, which defines post-quantum traditional hybrid key agreement mechanisms specifically for TLS 1.3.

Status and scope

The guidance is intended for general use and the protection of government OFFICIAL information. It focuses on data in transit and establishes a timeline suggesting that high-priority migration activities should be completed by 2031. The scope is limited to key agreement; updates for IPsec and post-quantum authentication are planned for future release.

What the guidance covers

The core of the update addresses the necessity of migrating to TLS 1.3, as versions 1.2 and older do not support PQC and will not be upgraded to do so. The NCSC recommends two primary configuration paths:

• Hybrid Configurations: These combine post-quantum and traditional algorithms. They are currently the most widely deployed options within common cryptographic libraries.
• Pure PQC Configurations: These rely solely on post-quantum algorithms. While stable implementations exist in several major libraries, the final RFC for these options is still awaiting publication.

How organizations can use it

Vulnerability management teams and infrastructure owners can use this guidance to identify assets relying on legacy TLS versions (1.2 or older) that are inherently incapable of quantum resilience. The documentation provides a technical baseline for selecting cipher suites based on the organization’s risk appetite regarding hybrid versus pure PQC implementations.

Decisions and next steps

Our analysis suggests that defenders should prioritize the following actions to reduce exposure:

1. Inventory TLS Versions: Identify all internal and external-facing endpoints utilizing TLS 1.2 or older. Because these versions cannot be upgraded for PQC, they represent a permanent quantum exposure point.
2. Evaluate Library Support: Before deploying pure PQC, verify that the specific cryptographic libraries in use support the configurations mentioned in RFC 10024. Given that hybrid options are more widely deployed, they may offer a more stable initial migration path.
3. Phased Migration to TLS 1.3: Prioritize the transition of high-value data streams to TLS 1.3. This move is a prerequisite for any PQC implementation.

To verify that exposure has been reduced, defenders should use protocol analyzers or scanning tools to confirm that the handshake successfully negotiates a PQC or hybrid cipher suite, rather than relying solely on a version check of the software.

Limits and open questions

A significant limitation is the current lack of a final RFC for pure PQC options, meaning these implementations may be subject to change. Additionally, this guidance does not yet address post-quantum authentication or IPsec, leaving those areas of the infrastructure exposed until further updates are released. Implementing TLS 1.3 with PQC configurations reduces the risk of future quantum decryption but does not eliminate all cryptographic risks associated with current traditional algorithms.

Source and editorial note

Post-quantum updates to our TLS guidance · Source date: October 15, 2026 · Retrieved October 15, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment