Your browser has probably already made the switch, and it never asked. The HTTPS connections it negotiates now increasingly pair classical elliptic-curve cryptography with ML-KEM-768, a post-quantum algorithm, in what is quietly becoming the largest cryptographic migration in internet history. By April 2026, more than two-thirds of human-initiated TLS traffic to Cloudflare's network was post-quantum protected. In August 2026, the IETF published RFC 10024, giving that deployment a formal standards-track home. No flag day, no announcement, no prompt to click. The padlock just got harder to pick — against computers that don't exist yet.
The paperwork is finished
Start with the paperwork, because for once the paperwork is finished. NIST finalized FIPS 203 on August 13, 2024. It specifies ML-KEM, the module-lattice key encapsulation mechanism derived from CRYSTALS-Kyber, in three parameter sets: ML-KEM-512, ML-KEM-768 and ML-KEM-1024. Beside it sit FIPS 204, specifying ML-DSA for digital signatures, and FIPS 205, specifying SLH-DSA, a conservative hash-based signature alternative.
For TLS 1.3, key exchange is the standard that matters first, and the reason is mechanical. TLS negotiates a shared secret for every connection. Replace the classical step with ML-KEM and that connection becomes quantum-resistant. The industry converged on ML-KEM-768, the middle set, targeting security roughly equivalent to AES-192, with 1,184-byte public keys and 1,088-byte ciphertexts, paired with the classical X25519 exchange in a hybrid construction. Those keys and ciphertexts are larger than their classical equivalents; every major operator looked at the cost and paid it anyway.
For two years the construction lived in a peculiar state: deployed at planetary scale, technically a draft. August 2026 ended the excuse. RFC 10024 standardizes hybrid ML-KEM key exchange for TLS 1.3 as an IETF Proposed Standard, referencing NIST FIPS 203 for the post-quantum component and RFC 9846 — the updated TLS 1.3 specification, July 2026 — for the protocol framework. X25519MLKEM768 is now marked "Recommended Y" in the IANA registry. The pre-standard Kyber code points are formally discouraged. The draft era is over, which removes the last respectable reason for an enterprise to wait.
The browsers carried it
The deployment history is a case study in how internet-scale cryptography actually changes: not by committee deadline, but by update channel. Chrome shipped hybrid Kyber key exchange behind a flag in August 2023, enabled it by default in April 2024 as X25519Kyber768Draft00, and moved to the standardized X25519MLKEM768 in Chrome 131 in November 2024. By Chrome 138, the option to disable ML-KEM was removed entirely. Opt-in experiment to non-negotiable default in under two years.
Firefox moved on a parallel track — hybrid key exchange since Firefox 132 in October 2024, X25519MLKEM768 since Firefox 135 — and Microsoft Edge has shipped ML-KEM hybrid PQ TLS since Edge 131. Apple added X25519MLKEM768 across iOS 26 and macOS Tahoe, open-sourced its corecrypto library in May 2026, and exposed ML-KEM and ML-DSA through CryptoKit. Add it up: with Chrome, Firefox, Edge and Safari all shipping it by default, the majority of global web traffic is now quantum-resistant at the key-exchange layer. The hardest distribution problem in cryptography — getting new code onto billions of devices — was solved by update channels the industry already had.
Cloudflare solved the server side at scale, and its telemetry tells the acceleration story: by late October 2025, more than half of human-initiated TLS traffic to its network was negotiating a hybrid post-quantum key exchange. By April 2026 the figure exceeded 65 percent. In February 2026 Cloudflare went further, launching full post-quantum SASE covering TLS, MASQUE and IPsec, with a published roadmap targeting 2029 as the hard deadline for full migration. Akamai completed post-quantum mid-tier connections across all its networks in Q1 2026. AWS rolled ML-KEM post-quantum TLS into KMS, ACM and Secrets Manager, with ML-DSA keys available via KMS APIs — and its AWS-LC library became the first FIPS-validated open-source cryptographic library with ML-KEM support. Pre-standard Kyber code points are being removed across AWS services through 2026.
Below the browser layer, platform vendors spent 2026 wiring the algorithms into the foundations developers build on. Microsoft made PQC APIs generally available in Windows Server 2025, Windows 11 and .NET 10 — ML-KEM, ML-DSA, SLH-DSA — and shipped Active Directory Certificate Services support for ML-DSA certificate signing in May 2026, with composite ML-DSA-plus-ECDSA signatures in Windows Insider builds for the transition. Google set a 2029 hard deadline for full PQC migration across its estate and integrated ML-DSA into Android 17 via the KeyMint and KeyPairGenerator APIs. OpenSSH 10.0, released in April 2025, made ML-KEM hybrid key exchange the default for SSH connections.
Nobody went pure
Every major deployment chose the hybrid — X25519 plus ML-KEM — over pure ML-KEM. Three reasons recur across IETF discussions and operator postmortems. First, defence in depth. Lattice-based cryptography is young, and a classical break of ML-KEM, while considered unlikely, cannot be ruled out. The X25519 component means such a break degrades security to the classical baseline rather than to zero — the long-standing position of Germany's BSI and France's ANSSI. Second, the SIKE precedent. The 2022 classical break of SIKE, a previous NIST post-quantum candidate, demonstrated that "post-quantum" does not mean "unbreakable." The hybrid's 32-byte X25519 share is trivial insurance against a repeat.
Regulation is now marching in step with deployment. The NSA's Commercial National Security Algorithm Suite 2.0, updated after NIST finalized the standards, sets the enforcement schedule for National Security Systems. From January 1, 2027, all new acquisitions must support CNSA 2.0 — that is the procurement gate, and vendors feel it first. By December 31, 2030, non-compliant equipment is phased out. By the end of 2031, CNSA 2.0 is mandatory across NSS cryptography. By 2035, full quantum resistance per National Security Memorandum 10. Within the suite, the NSA specifies ML-KEM-1024 for key establishment and ML-DSA-87 for signatures, with software and firmware signing exclusively CNSA 2.0 by 2030.
On the civilian side, OMB memorandum M-26-15, issued June 24, 2026, provides execution guidance for federal migration, with remaining federal systems targeted to complete risk-based migration by 2035. Set those dates against the threat estimate: consensus places a cryptographically relevant quantum computer around 2029 to 2032. Uncomfortably inside the migration windows. On the consensus numbers the schedules are barely adequate. Nation-state espionage groups accelerating harvest-now, decrypt-later collection are banking ciphertext today against tomorrow's machines, which is why key exchange moved before signatures: recorded traffic can be decrypted retrospectively, recorded signatures cannot be forged backwards.
One clarification keeps the headline figure honest. The two-thirds number describes key exchange — the part of the connection that decides whether recorded traffic can be decrypted later. It does not mean two-thirds of the web has completed its migration. Certificates still authenticate classically in most deployments, code signing is earlier still, and the long tail of embedded systems, VPN appliances and internal services has barely started. The layer that could not wait is the layer that moved. The remaining layers have deadlines measured in years.
The unglamorous roadmap
For enterprise teams, the work distils to a sequence. First, inventory. Build a cryptographic bill of materials: every system using RSA or ECDH, what data it protects, how long that data must stay confidential. Systems protecting data that must remain secret past 2030 should already be in active migration. Second, key exchange before signatures. Hybrid TLS is production-ready today in every major browser, CDN and cloud, so enable it where it isn't already default. Certificate and code-signing migration to ML-DSA follows. Third, demand crypto-agility from vendors — the ability to swap algorithms without re-architecting — and write it into RFPs and renewals, particularly for HSMs, VPNs and PKI, where the 2026–2030 category deadlines bite first.
The rebuild mindset extends one layer down as well. The same teams re-platforming their cryptography are re-platforming their monitoring, part of the shift that has cloud security engineers rebuilding the perimeter around the kernel with eBPF. Cloud architecture has to make the same transition without giving up isolation, which is the problem addressed by zero-knowledge cloud security for sovereign multi-tenant enclaves — proof systems and side-channel defenses designed for tenants who cannot trust the building they run in. And the recovery side of the same estates is being rebuilt in parallel, in enterprise ransomware defence, where immutable and air-gapped copies carry the day.
What could still go wrong? Downgrade attacks, mostly. An attacker who can force a connection to negotiate classical-only cryptography defeats the hybrid's purpose; IETF drafts for TLS-layer PQC continuity signaling address this, but deployment lags the key-exchange rollout. Behind everything sits the harvest problem itself: traffic recorded today can be stored, then decrypted later — which is why key exchange couldn't wait, and why data with a long secrecy life is exposed right now, not in 2032.
The timeline risk cuts both ways. Migrate too slowly and harvest-now-decrypt-later wins. Migrate recklessly and you break production. The organisations navigating this well share one trait: they inventoried their cryptography in 2024–2025 and are executing now, rather than starting now. The standards are final. The browsers have shipped. Two-thirds of one very large network's traffic already runs the new key exchange. The migration's remaining question isn't whether. It's whether your inventory exists.
There is a final irony in how this migration happened. For decades, the fear was that replacing the internet's cryptography would require a coordinated flag day that never came — too many vendors, too many devices, too much risk. Instead, the change rode in through the most mundane channel in software: the routine update. Browsers updated, CDNs enabled, clouds rolled it into managed services, and the post-quantum era began as a line in release notes. Enterprises still running classical-only estates are not behind because the technology is missing: the technology is, at this point, the default setting of the tools they already use. They are behind because knowing where your cryptography lives — the inventory — is unglamorous work that nobody demos. On the evidence of this migration, unglamorous work is the whole game. Standards work is usually where momentum goes to die, which is what makes the IANA detail — X25519MLKEM768 marked "Recommended Y" — worth more than its size: it converts years of deployment momentum into the default expectation for every TLS stack still to be written. Migration deadlines are being set by an adversary's storage budget, not by standards bodies. Inventory is the roadmap.
Sources
- postquantum.com — "RFC 10024: Hybrid ML-KEM TLS 1.3 Standard Finalized" (August 2026)
- GitHub (czinda/state-of-protocols-and-pqc) — "PQC Status Report 2026-06-10"
- GitHub (darshan2209/pqc-hybrid-tls-research) — deployment evidence, hybrid rationale, Signal/OpenSSH history
- GitHub (subodhpatil/suubodhpatil.github.io) — "Post-Quantum Cryptography: TLS Not Safe Forever" (July 2026)
- postquantum.com — "NSA Updates CNSA 2.0 After NIST Finalizes PQC Standards" (2026)
- postquantum.com — "NSA Unveils CNSA 2.0 Post-Quantum Algorithm Suite" (2026)
- thequantuminsider.com — "Quantum Security Deadlines Are Here" (May 2026)
- GitHub (raybeecham/quantum-research-scout) — "standards-timeline.md" (FIPS 203/204/205 dates, HQC selection, OMB M-26-15)
