State of Post Quantum Cryptography | Wiz Blog

What it is

A Wiz blog follow-up (data as of May 2026) quantifying real PQC adoption across the three major cloud providers and naming the specific software versions and services that do and do not yet support post-quantum algorithms. It builds on Wiz's earlier "Preparing for Post-Quantum Cryptography" post and is anchored to Google's late-March-2026 announcement of a 2029 PQC migration timeline, with a shift in priority from key exchange toward authentication (digital signatures).

Preconditions / Affected

• TLS 1.3 (released 2018) is a prerequisite for PQC key exchange and is still not universally deployed.
• Cloud API endpoints reachable over HTTPS that lack ML-KEM hybrid key exchange are exposed to Harvest-Now-Decrypt-Later — e.g. AWS IAM at https://iam.amazonaws.com does not support PQC key exchange, so access keys created there could be at future risk.

What to do

• Update software/config to enable PQC key exchange — the standards are done; browsers and many TLS termination servers already support X25519MLKEM768, and SSH supports mlkem768x25519-sha256. The remaining work is finding and upgrading out-of-date components.
• Target ML-DSA for signing migration; do not wait on FN-DSA. NIST approved ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) in late 2024; FN-DSA (FIPS 206) was still unapproved as of May 2026. NIST recommends ML-DSA as the primary algorithm.
• Use Wiz's tester at https://www.wiz.io/pqc-tester to check whether a given API server supports PQC key exchange.

Concrete support status to plan against:

• OpenSSL: ML-DSA and SLH-DSA since 3.5.0 (April 2025).
• AWS KMS: ML-DSA keys/signing supported; CloudHSM not.
• GCP Cloud KMS: ML-DSA-65 and SLH-DSA-SHA2-128S.
• No current support: OpenSSH authentication, most VPNs, and the browser/CA ecosystem.

Measured cloud key-exchange support (Wiz's pqc-tester across customer traffic):

flowchart LR
    Q[ML-KEM hybrid key exchange on API servers?]
    Q --> GCP[GCP: 100% of API servers]
    Q --> AWS[AWS: 13% - only some services e.g. KMS]
    Q --> AZ[Azure: none found]

Caveats

• Key exchange is described as a "solved problem" only in the sense that standards exist and are broadly implemented — actual deployment still requires action.
• The browser signature gap is structural: quantum-resistant X.509 chains become very large, so browsers must move to Merkle Tree Certificates (compact inclusion proofs) before CA-chain PQC is practical — this is emerging, not shipped.
• The DSA performance/size trade-off table cited comes from Commey et al.'s 2025 study; numbers vary by hardware and are illustrative, not exhaustive.