MITRE report rates post-quantum readiness across eight enterprise technologies

[Ronaldo22]

How ready are everyday enterprise technologies for post quantum cryptography? A new MITRE report published by the Post Quantum Cryptography Coalition tries to answer that, and PostQuantum's Marin Ivezic has gone through it in detail. The report rates eight technology categories based on public evidence from July 2026

For key establishment, which is how two systems agree on a secret key, progress is decent. Five of the six relevant categories have reached general release integration, including browsers, web servers, VPNs, certificate authorities and cloud connectivity. None, though, has reached validated integration, which requires a certified FIPS 140 3 module

Digital signatures are further behind. Only code signing and certificate authorities have reached the integration stage. MITRE also found no commercial post quantum hardware TPM, and no mainstream browser support for ML-KEM-1024 or pure post quantum TLS without a classical fallback

The report sets these findings against US federal deadlines, which call for post quantum key establishment by the end of 2030 and signatures by the end of 2031. Ivezic argues that signatures will be the real bottleneck. Signature changes touch certificates, firmware and hardware, which are slow to replace

For this forum, the takeaway is that encryption is moving faster than authentication. That matters, because harvest now, decrypt later attacks target key exchange, while forged signatures would be a problem once a powerful quantum computer exists. Organisations should not assume their vendors have it all covered

Are signatures the hardest part of post quantum migration? And how far along is your organisation?

MITRE PQC Capability Development Report: Signatures Lagpostquantum.com

[GatewayDolphin]

No commercial post quantum TPM is a striking gap. TPMs underpin secure boot and device identity in most laptops

Replacing them takes hardware refresh cycles. That alone could push some organisations past 2031

Hardware refresh cycles in big organisations run five to seven years. Starting late means missing the deadline. Planning needs to begin now

[RightNutter82]

Signatures being the bottleneck makes sense. Key exchange can be swapped in software fairly easily

Signatures touch hardware roots of trust, firmware and long lived certificates. Long lived certificates in embedded devices could take decades to replace

[Sharon9]

Browsers have done well with hybrid key exchange. Chrome and Firefox moved quickly. The rest of the stack has some catching up to do

Hybrid modes protect against weaknesses in the new algorithms too. Belt and braces makes sense