Loading story…
Post-quantum cryptography support has been added to Python through the widely used pyca/cryptography library, bringing NIST-standard algorithms into the ecosystem ahead of broader migration pressure. The update introduces ML-KEM for key establishment and ML-DSA for digital signatures, giving Python developers access to standardized post-quantum primitives as organizations prepare for future quantum-era risks.
Trail of Bits reported shipping the capability with funding from the Sovereign Tech Agency, while subsequent coverage highlighted the move as a practical step toward greater crypto agility in mainstream software. The addition is intended to help developers begin testing, integrating, and planning for post-quantum transitions now, rather than waiting for an emergency replacement cycle once quantum threats become more immediate.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Trail of Bits reported that the Python ecosystem now has post-quantum cryptography support through the pyca/cryptography library, including ML-KEM and ML-DSA. The work was funded by the Sovereign Tech Agency and was presented as a step toward crypto agility.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. government is accelerating post-quantum cryptography adoption across federal systems and the defense industrial base, with new executive and Defense Department directives setting milestones for agencies and contractors to support PQC by 2030 and use it by 2031. Reporting on the Pentagon’s strategy says the Cybersecurity Maturity Model Certification program will be updated with quantum-resistant requirements, while broader federal policy frames a two-track quantum strategy that combines defensive migration with continued national quantum advancement. Officials and industry sources warn that many contractors remain unprepared, even as governments and security agencies increasingly cite **Harvest Now, Decrypt Later** as a current risk to long-lived sensitive data. At the same time, industry is arguing that organizations cannot delay deployment waiting for better algorithms, even as implementation flaws raise fresh concerns around today’s standards. Cloudflare said `ML-DSA`, standardized alongside `ML-KEM`, is imperfect but the most practical near-term signature option and remains central to its plan for full post-quantum security by 2029. Separate research coverage highlighted practical key-recovery attacks against buggy `ML-DSA` implementations, including failures involving nonce reuse and corrupted signing randomness, underscoring that migration urgency must be matched by rigorous engineering, testing, and protections against side-channel and randomness-leakage failures.
Jul 14, 2026
Recent developments in post-quantum cryptography are addressing the growing threat posed by quantum computers to traditional digital signatures and encrypted communications. The National Institute of Standards and Technology (NIST) has approved new post-quantum digital signature algorithms, such as ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), to replace vulnerable mechanisms like RSA and elliptic curve signatures. These algorithms are designed to ensure the integrity and authenticity of digital documents and communications, even in the face of future quantum attacks. The focus on hybrid key exchanges, such as X25519MLKEM, is also gaining traction to mitigate "harvest now, decrypt later" (HNDL) threats, where adversaries collect encrypted data today to decrypt it once quantum capabilities become available. In parallel, industry innovation is bringing quantum-resistant technologies into operational environments. Forward Edge-AI has delivered its Isidore Quantum One-Way Data Diode to National Central University in Taiwan, marking a significant step in quantum-safe data protection for critical infrastructure. This device uniquely combines unidirectional data flow with NIST-approved post-quantum encryption (AES-256 GCM and ML-KEM), addressing the limitations of traditional data diodes that lack encryption and are vulnerable to HNDL attacks. The Isidore Quantum solution also offers deployment flexibility across both fiber and copper networks, reducing costs and accelerating adoption of quantum-safe communications.
Jun 29, 2026
Apple has released the post-quantum cryptography components of its `corecrypto` library as open source, publishing implementations of the NIST-standardized **ML-KEM** and **ML-DSA** algorithms alongside mathematical proofs, documentation, and verification tooling for independent review. The company said `corecrypto` underpins encryption, hashing, random number generation, and digital signatures across more than 2.5 billion active devices, and that post-quantum protections introduced in 2024 are already used in **iMessage**, VPN services, and TLS networking, including the **PQ3** messaging protocol Apple previously described as a large-scale quantum-secure design. Apple said it validated the code through a hybrid assurance model combining conventional testing, simulation, independent review, and formal verification, using a workflow that linked portable C implementations to **Cryptol** and **Isabelle** proofs with support from Galois. According to Apple, that process uncovered a subtle early **ML-DSA** flaw that could rarely produce incorrect output and likely would have escaped standard testing; the issue was fixed before deployment. The release is intended to make Apple’s analysis reproducible and give outside experts a chance to scrutinize security-critical cryptographic code as organizations prepare for future quantum threats.
Jun 29, 2026