Verify Your TLS 1.3 Post-Quantum Readiness Before the 2027 CNSA 2.0 Gate
NSA CNSA 2.0 sets 1 January 2027 for new National Security System acquisitions to support quantum-resistant algorithms, and NIST IR 8547 schedules classical RSA and ECDSA deprecation for 2030. Run a safe port-443 TLS handshake check, model your Harvest-Now-Decrypt-Later exposure, and copy tested hybrid server configs.
- NSA CNSA 2.0 Gate
- 01 JAN 2027
- NIST Deprecation
- IR 8547 · 2030
- Default Hybrid KEM
- FIPS 203 (768)
TLS 1.3 ClientHello Wire-Byte Comparator
Port-443 TLS 1.3 Readiness Checker
Performs one standard browser-equivalent TLS handshake on port 443 after DNS SSRF validation. Private IP ranges, loopback addresses, and opted-out domains are blocked automatically.
Mosca Horizon Calculator
Harvest-Now-Decrypt-Later (HNDL) exposure opens when secrecy shelf-life (X) plus migration duration (Y) exceeds the quantum decryption horizon (Z).
Active HNDL window: traffic recorded today with a 7-year secrecy requirement overlaps your migration schedule by 2 year(s). Deploy hybrid X25519MLKEM768 on external TLS 1.3 ingress now.
Module-Lattice Key Encapsulation Specimen (FIPS 203)
Combining elliptic-curve X25519 with ML-KEM-768 ensures session secrecy remains at least as strong as classical TLS 1.3 while blocking Harvest-Now-Decrypt-Later recording.
- Encapsulation Key
- 1,184 bytes
- KEM Ciphertext
- 1,088 bytes
Five-Step Transport & Inventory Runway
Full 4-Phase Checklist- 01TLS 1.3 Ingress
Upgrade external reverse proxies and load balancers to TLS 1.3 (hybrid ML-KEM requires TLS 1.3 key_share extensions).
- 02IANA 0x11EC
Enable X25519MLKEM768 ahead of classical X25519 in ssl_ecdh_curve or groups lists on OpenSSL 3.5+.
- 032-Packet MTU
Test stateful middleboxes and deep-packet inspection firewalls for multi-segment (>1,500 byte) ClientHello tolerance.
- 04OpenSSH 9.9+
Enforce mlkem768x25519-sha256 ahead of classical curves in /etc/ssh/sshd_config on administrative bastions.
- 05CycloneDX v1.6
Generate an OWASP CycloneDX v1.6 Cryptographic Asset Inventory (CBOM) covering internal mTLS and PKCS#11 HSMs.
Copy-ready production configurations for Nginx, OpenSSL 3.5+, HAProxy 3.1+, and OpenSSH 9.9+ bastions, plus curl timing probes to isolate two-packet ClientHello middlebox stalls.
Exact wire byte budgets and security categories for ML-KEM, ML-DSA, and stateless hash-based SLH-DSA.
Four-Phase Enterprise Migration To-Do List
Track interactive milestones from external TLS 1.3 ingress to east-west mTLS meshes, PKCS#11 HSM firmware validation lead times, and offline CA rotation before 2030.
CycloneDX v1.6 CBOM & Audit RFP Kit
Validate cryptoProperties JSON schemas for CI/CD builds, or visit our sister governance publication qdayaudits.com for 12-domain GRC audit scoping.
State of Post-Quantum TLS: 10 Reference Endpoint Handshakes
Baseline port-443 TLS 1.3 handshake observations recorded by the Q-Day Check engineering desk (last verified 1 November 2026). Edge CDNs lead hybrid adoption, while origin-terminated infrastructure frequently remains on classical X25519 despite running TLS 1.3.
| Domain | Protocol | Negotiated Key Share | Share Size | Posture | Engineering Observation |
|---|---|---|---|---|---|
| cloudflare.com | TLSv1.3 | X25519MLKEM768 (0x11EC) | 1,216 B | Hybrid PQC Active | Enabled across edge ingress; negotiates 1,216-byte client / 1,120-byte server hybrid key share cleanly. |
| csrc.nist.gov | TLSv1.3 | X25519MLKEM768 (0x11EC) | 1,216 B | Hybrid PQC Active | Publishes FIPS 203-205 standards; CDN edge negotiates hybrid X25519MLKEM768 on TCP/443. |
| github.com | TLSv1.3 | X25519 (0x001D) | 32 B | TLS 1.3 Classical | HTTPS origin uses classical X25519; SSH fleet supports mlkem768x25519-sha256 on OpenSSH 9.9+ clients. |
| signal.org | TLSv1.3 | X25519MLKEM768 (0x11EC) | 1,216 B | Hybrid PQC Active | Adopts hybrid post-quantum key agreement across both HTTPS edge transport and PQXDH messaging layers. |
| ietf.org | TLSv1.3 | X25519MLKEM768 (0x11EC) | 1,216 B | Hybrid PQC Active | Cloudflare-fronted standards portal negotiating hybrid ML-KEM-768 (0x11EC). |
| wikipedia.org | TLSv1.3 | X25519 (0x001D) | 32 B | TLS 1.3 Classical | Wikimedia edge terminates TLS 1.3 with classical 32-byte X25519. |
| npmjs.com | TLSv1.3 | X25519MLKEM768 (0x11EC) | 1,216 B | Hybrid PQC Active | Edge CDN negotiates hybrid ML-KEM key share for package registry connections. |
| python.org | TLSv1.3 | X25519MLKEM768 (0x11EC) | 1,216 B | Hybrid PQC Active | Edge CDN ingress negotiates hybrid X25519MLKEM768 (0x11EC) over TLS 1.3. |
| mozilla.org | TLSv1.3 | X25519MLKEM768 (0x11EC) | 1,216 B | Hybrid PQC Active | Both Firefox NSS client engine and web edge negotiate hybrid X25519MLKEM768 (0x11EC). |
| openssl.org | TLSv1.3 | X25519MLKEM768 (0x11EC) | 1,216 B | Hybrid PQC Active | Project web edge negotiates 0x11EC; OpenSSL 3.5+ ships native ML-KEM, ML-DSA, and SLH-DSA providers. |
Reviewed by Callum Reid, Principal Infrastructure & Cryptography Editor
Reviews OpenSSL/Nginx PQC transport deployments and CycloneDX CBOM workflows.
Last reviewed:
Reviewed every 3 months
AI-assistance & editorial check: Research outlining and formatting are assisted by AI tools in an offline draft workflow. Nothing on this site publishes automatically without verification. A named human editor opens and verifies every primary source link, command snippet, and factual statement prior to publication. See our Editorial Policy and Corrections Policy.
Verified Primary Sources
- FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM) (National Institute of Standards and Technology (NIST), August 2024)
- NIST IR 8547: Transition to Post-Quantum Cryptography Standards (NIST Computer Security Resource Center, November 2024)
- Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) FAQ (U.S. National Security Agency (NSA), 2027 NSS Mandate)
Get NIST & TLS Post-Quantum Standards Updates
PQC & Hybrid TLS Readiness BriefingsStore your email for updates when NIST, browser root programs, OpenSSL/OpenSSH, or NSA CNSA 2.0 timelines change. No emails are sent yet.