MITRE report rates post-quantum readiness across eight enterprise technologies

[Ronaldo22]

How ready are everyday enterprise technologies for post quantum cryptography? A new MITRE report published by the Post Quantum Cryptography Coalition tries to answer that, and PostQuantum's Marin Ivezic has gone through it in detail. The report rates eight technology categories based on public evidence from July 2026

For key establishment, which is how two systems agree on a secret key, progress is decent. Five of the six relevant categories have reached general release integration, including browsers, web servers, VPNs, certificate authorities and cloud connectivity. None, though, has reached validated integration, which requires a certified FIPS 140 3 module

Digital signatures are further behind. Only code signing and certificate authorities have reached the integration stage. MITRE also found no commercial post quantum hardware TPM, and no mainstream browser support for ML-KEM-1024 or pure post quantum TLS without a classical fallback

The report sets these findings against US federal deadlines, which call for post quantum key establishment by the end of 2030 and signatures by the end of 2031. Ivezic argues that signatures will be the real bottleneck. Signature changes touch certificates, firmware and hardware, which are slow to replace

For this forum, the takeaway is that encryption is moving faster than authentication. That matters, because harvest now, decrypt later attacks target key exchange, while forged signatures would be a problem once a powerful quantum computer exists. Organisations should not assume their vendors have it all covered

Are signatures the hardest part of post quantum migration? And how far along is your organisation?

MITRE PQC Capability Development Report: Signatures Lagpostquantum.com