Shipping post-quantum cryptography to Python
Summary: With funding from the Sovereign Tech Agency, Trail of Bits implemented support for ML-KEM and ML-DSA in pyca/cryptography, shipping in version 48 as Rust bindings with a cross-binding API and AWS-LC backend support. The release follows a June 22, 2026 White House order directing federal agencies to use post-quantum key establishment by December 31, 2030 and post-quantum signatures by December 31, 2031.
What's compelling: pyca/cryptography pulls 1.2 billion downloads a month and underpins Ansible, Certbot, Apache Airflow, and paramiko, so the migration deadline lands on a package most Python teams never think about directly. Post-quantum public keys, signatures, and ciphertexts run 1-2 orders of magnitude larger than the Ed25519 and X25519 values they replace, which means any protocol or wire format with hardcoded sizes needs more than a primitive swap.
Read the original at Trail of Bits Blog ↗
- Topics
- Governance, Risk & Compliance
- Related
- Upcoming Speaking Engagements Cyber Risks · Nov 14, 2026Friday Squid Blogging: Pacific Flying Squid Populations Dropping in Korean Waters Cyber Risks · Nov 13, 2026AI Doesn’t Have to Go Rogue to Break the World Cyber Risks · Nov 13, 2026