New cryptographic standards mandate post-quantum upgrades by 2029

The latest edition of the influential "Cryptographic Right Answers" guide, published in October 2026, establishes a firm 2029 deadline for completing the transition to post-quantum cryptography. This update, continuing a tradition started by Colin Percival in 2009 and maintained by Latacora, signals that asymmetric encryption methods must change immediately to withstand future quantum computing threats.

What happened

The timeline for adopting post-quantum cryptographic standards has accelerated significantly. While previous iterations of the guide focused on refining classical algorithms, the 2026 edition declares that the transition must be complete within three years. The authors note that while symmetric cryptography remains secure against known quantum attacks, all asymmetric answers have changed compared to recommendations from 2018 and even 2024.

The guide provides specific algorithmic replacements for developers building new systems or auditing existing ones. For key exchange, it recommends combining X25519 with ML-KEM-768. For asymmetric signatures, the new standard is ML-DSA-44. These changes are designed to protect data against both current classical attacks and future quantum decryption capabilities. The authors emphasize that these recommendations assume no specific compliance regime, though they remain largely compatible with FIPS 140.

Another major shift in the 2026 landscape is the role of artificial intelligence in code security. The guide now explicitly states that getting a review from the best large language model available is a "Cryptographic Right Answer." This joins the long-standing advice to use memory-safe languages, reflecting the reality that LLMs have become highly effective at identifying bugs in cryptographic implementations.

Key details

• Deadline: The post-quantum transition must be completed by 2029.
• Key Exchange: Use X25519 combined with ML-KEM-768 in a secure protocol.
• Signatures: Adopt ML-DSA-44 for asymmetric signing operations.
• Data Encryption: Use cloud KMS where possible, or XAES-256-GCM and XChaCha20Poly1305 locally.
• Large Files: Use Cobblestone-128 for encrypting messages larger than a few megabytes.
• Code Review: Utilize advanced LLMs to audit cryptographic code for bugs.

Background

To understand these changes, it helps to distinguish between symmetric and asymmetric cryptography. Symmetric cryptography uses the same key for encryption and decryption. It is generally faster and, according to the guide, remains secure because quantum computers do not break it efficiently enough to matter. Asymmetric cryptography, used for key exchange and digital signatures, relies on mathematical problems that quantum computers can solve much faster than classical machines. This is why the asymmetric recommendations have changed drastically.

The term "post-quantum" refers to cryptographic algorithms that are resistant to attacks by both classical and quantum computers. The National Institute of Standards and Technology (NIST) has been standardizing these algorithms, leading to the selection of ML-KEM and ML-DSA as primary candidates. The guide reflects this consensus, moving away from older elliptic curve methods that are vulnerable to Shor's algorithm, a theoretical quantum algorithm that can break current public-key infrastructure.

Why it matters

For teams running their own software, this update means that current TLS certificates and key exchange mechanisms are on a clock. If your infrastructure relies on traditional RSA or ECC keys for handshakes, you will need to upgrade your libraries and configurations before 2029. This is not just a theoretical concern; browsers and operating systems will begin enforcing these standards, potentially breaking connectivity for outdated servers.

The recommendation to use specific libraries like rustls, Go’s crypto/tls, or BoringSSL simplifies this task. These libraries are actively updating their default cipher suites to include post-quantum algorithms. By choosing a well-maintained library, you offload the complexity of implementing ML-KEM and ML-DSA correctly. However, you must ensure you are running updated versions that support these new primitives.

Additionally, the emphasis on using cloud KMS or specific AEAD constructions like XAES-256-GCM highlights the risk of custom cryptographic implementations. Rolling your own encryption logic is error-prone, especially when dealing with nonce management and large file streaming. The guide’s warning against unauthenticated modes and raw stream ciphers serves as a reminder that convenience often compromises security in homegrown solutions.

What you can do

• Audit your current TLS libraries to ensure they support post-quantum key exchange mechanisms.
• Replace any custom asymmetric encryption code with standardized libraries supporting ML-KEM-768.
• Switch to XAES-256-GCM or XChaCha20Poly1305 for local data encryption tasks.
• Implement Cobblestone-128 for streaming encryption of large files instead of basic AEADs.
• Use LLM-assisted code reviews to identify potential bugs in your cryptographic implementation.
• Monitor your certificate expiry dates closely as you transition to new algorithm suites.