Where is post-quantum work heading, and who is driving it?
Building in post-quantum cryptography means making commitments while the technical and commercial landscape is still moving. Which capabilities belong on the next product roadmap? Where is research translating into implementation? Which teams are shaping the protocols a product will depend on?
We built PQScope to pursue those questions across the research, standards, implementation, policy, and patent record. The October 26 collection spans 4,444 research items, 378 research ideas, 2,284 researcher profiles, and 740 organizations. That breadth supports investigations that cross those boundaries: whether an active research area has credible implementation work behind it, which contributors appear across competing proposals, and which dependencies remain unsettled before a design becomes expensive to change.
The figures below examine selected parts of that landscape. They retain their October 21 research snapshot, October 23 process evidence, and individual observation dates. The newer corpus totals above describe the collection as of October 26.
Where research activity is concentrating
Constrained-device protocols, HQC, ML-DSA, and hybrid key exchange lead the October 21 momentum ranking. They represent different engineering commitments: accommodating tight resource budgets, supporting another KEM, integrating signatures, and deploying hybrid key agreement. A product roadmap may depend on several of them at once.
Six areas of research activity
Research momentum · October 21, 2026PQ for constrained devices and IoT protocols
/ 100
HQC
/ 100
ML-DSA (Dilithium)
/ 100
Hybrid key exchange (X25519MLKEM768 and relatives)
/ 100
PQ migration planning and measurement
/ 100
FN-DSA (Falcon)
/ 100
Quarterly counts behind the trends
| Concept | 2025 Q1 | 2025 Q2 | 2025 Q3 | 2025 Q4 | 2026 Q1 | 2026 Q2 | 2026 Q3 | 2026 Q4 |
|---|---|---|---|---|---|---|---|---|
| PQ for constrained devices and IoT protocols | 3 | 6 | 5 | 4 | 7 | 9 | 13 | 9 |
| HQC | 4 | 2 | 4 | 10 | 10 | 10 | 6 | 10 |
| ML-DSA (Dilithium) | 5 | 6 | 1 | 6 | 7 | 6 | 10 | 5 |
| Hybrid key exchange (X25519MLKEM768 and relatives) | 6 | 3 | 4 | 6 | 9 | 14 | 13 | 10 |
| PQ migration planning and measurement | 8 | 6 | 11 | 10 | 10 | 22 | 26 | 10 |
| FN-DSA (Falcon) | 6 | 4 | 3 | 6 | 6 | 5 | 12 | 3 |
The quarterly record makes the activity more concrete. Migration planning and measurement rose from 10 tracked items in 2026 Q1 to 22 in Q2 and 26 in Q3. Hybrid key exchange recorded 9, 14, and 13 items across those same completed quarters; constrained-device work recorded 7, 9, and 13.
For teams building migration or integration products, the next step is to examine what those items contribute: measurements of existing systems, new tools, implementation results, or recurring constraints that a product might address. Publication activity alone does not establish customer demand.
The field, quarter by quarter
2025 Q1 to 2026 Q4The 12 most active ideas over the last 8 quarters; darker is more activity. The last quarter is still running.
| Idea | 2025 Q1 | 2025 Q2 | 2025 Q3 | 2025 Q4 | 2026 Q1 | 2026 Q2 | 2026 Q3 | 2026 Q4 |
|---|---|---|---|---|---|---|---|---|
| Side-channel attacks and masking for PQC | 19 | 17 | 15 | 22 | 25 | 13 | 2 | 0 |
| PQ migration planning and measurement | 8 | 6 | 11 | 10 | 10 | 22 | 26 | 10 |
| Post-quantum migration of blockchains and wallets | 3 | 2 | 10 | 5 | 12 | 5 | 14 | 16 |
| PQC hardware acceleration and embedded implementations | 4 | 10 | 10 | 16 | 21 | 3 | 2 | 0 |
| Hybrid key exchange (X25519MLKEM768 and relatives) | 6 | 3 | 4 | 6 | 9 | 14 | 13 | 10 |
| LWE, SIS and NTRU hardness and new variants | 9 | 11 | 9 | 10 | 17 | 2 | 0 | 0 |
| Other code-based constructions and cryptanalysis | 13 | 9 | 12 | 9 | 11 | 4 | 0 | 0 |
| Other multivariate constructions and cryptanalysis | 2 | 9 | 6 | 8 | 7 | 8 | 14 | 3 |
| HQC | 4 | 2 | 4 | 10 | 10 | 10 | 6 | 10 |
| PQ for constrained devices and IoT protocols | 3 | 6 | 5 | 4 | 7 | 9 | 13 | 9 |
| PQ key exchange in SSH, IPsec and WireGuard | 13 | 5 | 4 | 4 | 6 | 8 | 8 | 4 |
| SQIsign | 4 | 5 | 7 | 1 | 6 | 10 | 13 | 5 |
One color scale across all rows. Cell values are available on hover and to screen readers. On small screens, scroll the table to compare quarters.
TLS research and protocol activity are moving at different rates
The TLS analysis records 44 papers in the recent six-month window, compared with 11 a year earlier. After accounting for growth across post-quantum papers overall, TLS research grew at an estimated 2.21 times the field’s rate, with a 95% interval of 1.15 to 4.23.
Active TLS drafts show a different pattern: a relative growth estimate of 0.91×, with an interval of 0.51 to 1.61. The increase in research activity has no comparably clear counterpart in active-draft growth in this snapshot.
TLS: where the growth signal is clear
October 21, 2026Growth relative to post-quantum work overall · estimates and 95% intervals
44 vs 11 items · rising
10 vs 7 items · no clear change
27 vs 19 items · no clear change
23 vs 6 items · no clear change
16 vs 10 items · no clear change
1× = growing at the same rate as the field. Logarithmic scale. Recent six months compared with the same six months a year earlier. Intervals crossing 1× do not establish faster or slower growth.
That divergence deserves a closer look before it becomes a roadmap assumption. Which results can be implemented within existing protocols? Which require a new negotiation mechanism, a different certificate format, or agreement on operational behavior? The aggregate figures identify the divergence; answering those questions requires examining the individual work.
Deployment changes the differentiation question
Post-quantum key agreement reached 62.9% of HTTPS requests observed by Cloudflare in the week of October 26, 2026, up from 42.8% in the corresponding week a year earlier. The implementation figure also records hybrid key-agreement support in OpenSSL 3.5 and Go 1.24, alongside algorithm and module validation evidence.
For a startup, that changes the question from whether a capability exists to where its product adds value as that capability enters widely used libraries. Integration, authentication, constrained environments, migration tooling, and operational assurance each require their own assessment.
Post-quantum key agreement in observed traffic
Weekly observations · October 27, 2025 to October 26, 202662.9%used post-quantum key agreement
Week of October 26, 2026
HTTPS requests reaching Cloudflare. This measures key agreement, not post-quantum certificates or signatures, and is not a measure of all Internet traffic.
Weekly deployment observations
| Week starting | Share (%) |
|---|---|
| 2025-10-27 | 42.79 |
| 2025-11-03 | 43.46 |
| 2025-11-10 | 44.43 |
| 2025-11-17 | 45.55 |
| 2025-11-24 | 45.44 |
| 2025-12-01 | 45.76 |
| 2025-12-08 | 47.72 |
| 2025-12-15 | 49.08 |
| 2025-12-22 | 49.38 |
| 2025-12-29 | 49.38 |
| 2026-01-05 | 50.88 |
| 2026-01-12 | 51.68 |
| 2026-01-19 | 53.61 |
| 2026-01-26 | 54.77 |
| 2026-02-02 | 55.0 |
| 2026-02-09 | 55.43 |
| 2026-02-16 | 55.43 |
| 2026-02-23 | 55.72 |
| 2026-03-02 | 56.08 |
| 2026-03-09 | 56.47 |
| 2026-03-16 | 56.24 |
| 2026-03-23 | 56.32 |
| 2026-03-30 | 56.45 |
| 2026-04-06 | 57.29 |
| 2026-04-13 | 57.6 |
| 2026-04-20 | 57.7 |
| 2026-04-27 | 57.94 |
| 2026-05-04 | 58.06 |
| 2026-05-11 | 57.97 |
| 2026-05-18 | 58.29 |
| 2026-05-25 | 58.66 |
| 2026-06-01 | 58.55 |
| 2026-06-08 | 58.92 |
| 2026-06-15 | 59.82 |
| 2026-06-22 | 59.77 |
| 2026-06-29 | 59.31 |
| 2026-07-06 | 59.81 |
| 2026-07-13 | 59.43 |
| 2026-07-20 | 59.33 |
| 2026-07-27 | 59.51 |
| 2026-08-03 | 59.93 |
| 2026-08-10 | 59.77 |
| 2026-08-17 | 59.77 |
| 2026-08-24 | 59.99 |
| 2026-08-31 | 60.59 |
| 2026-09-07 | 60.81 |
| 2026-09-14 | 61.54 |
| 2026-09-21 | 61.99 |
| 2026-09-28 | 62.11 |
| 2026-10-05 | 62.11 |
| 2026-10-12 | 62.69 |
| 2026-10-19 | 62.61 |
| 2026-10-26 | 62.93 |
OpenSSL 3.5
Version 3.5 supports X25519MLKEM768 and puts it first in the default TLS group list.
Peers must support a common group; application settings can override defaults.
Go crypto/tls 1.24
Version 1.24 enables X25519MLKEM768 in the default configuration.
Applies when CurvePreferences is nil; tlsmlkem=0 changes the default.
These examples describe library defaults, not measured deployment. Documentation reviewed October 21, 2026.
331 distinct tracked implementations with a validated post-quantum algorithm
25 tracked FIPS 140-3 modules including a post-quantum algorithm
Algorithm validations and module validations are separate measures; counts are not additive.
The traffic series measures key agreement within Cloudflare’s observations. It does not establish post-quantum authentication or adoption across the entire Internet. A product thesis built around certificate infrastructure or signing cannot borrow that deployment percentage as evidence of its own market’s progress.
The protocol dependencies behind a roadmap
The original NIST competition narrowed 69 accepted submissions to five selected algorithms. In the October 21 snapshot, ML-KEM, ML-DSA, and SLH-DSA have final standards; HQC and FN-DSA remain selected but not final. NIST’s additional-signature process runs separately.
For teams considering HQC or FN-DSA support, the work extends across algorithm specifications, protocol integration, implementation behavior, and validation. Each can introduce a dependency with its own timetable.
The original NIST competition
2017 to 2025 selectionsFinal standards: ML-KEM, ML-DSA, SLH-DSA
Selected, not final: HQC, FN-DSA
Candidate counts and NIST sources
Counts describe candidate entries at milestones, not proposed standards or deployment. Gray branches show reductions, including mergers, withdrawals and non-advancement. Spacing shows stages, not elapsed time.
| Milestone | Date | Key establishment | Signatures | Total |
|---|---|---|---|---|
| Accepted | 2017 | 49 | 20 | 69 |
| Round 2 | 2019 | 17 | 9 | 26 |
| Round 3 | 2020 | 9 | 6 | 15 |
| Selected | 2022 to 2025 | 2 | 3 | 5 |
- 69 submissions met NIST's entry requirements: 49 encryption/key-establishment and 20 signature schemes. NIST IR 8240 · first-round report
- 26 candidate entries advanced. Several first-round submissions merged before the second round. NIST IR 8240 · first-round report
- 15 candidates remained: nine encryption/key-establishment schemes and six signature schemes, across finalists and alternates. NIST IR 8413 · third-round report
- Four algorithms were selected in 2022. HQC joined them after round 4 in March 2025. Selection and final publication are separate milestones. NIST IR 8413 · third-round report · NIST selects HQC · March 11, 2025
At the protocol layer, 119 of the 181 active or published IETF documents in the October 21 snapshot were individual proposals. Another 15 were in working-group development, 19 in last call or publication review, and 28 published as RFCs.
Post-quantum protocols at the IETF
Document status · October 21, 2026181 tracked documents are active or published.
Individual proposals, working-group drafts and published RFCs.
One square = one tracked document.Bar length = tracked documents, on one shared scale. These are current statuses, not a historical conversion funnel.
What the groups include
Individual proposals: 113 individual drafts and 6 calls for adoption. Working-group development: 15 adopted drafts. Review: 7 at working-group last call and 12 with the IESG or RFC Editor. Expired and replaced records are excluded. RFC publication does not necessarily confer Internet Standard status or indicate deployment.
Recent recorded milestones
A team committing to one of those proposals needs to examine implementation support, sustained participation, and unresolved choices that could force a redesign. PQScope connects the document history with its authors, related research, and technical ideas so that the assessment can follow a specific dependency through the record.
The historical view shows why that work matters. Of 110 individual drafts first posted before October 21, 2024, 47 had expired without adoption and 28 had become RFCs by the snapshot date. The remaining drafts had been adopted, stayed active as individual proposals, or been replaced.
Proposal activity and the path to publication
Corpus · October 21, 2026Draft activity counts documents revised in the preceding 185 days, grouped by draft-name prefix. RFC counts are cumulative, using RFC Editor publication dates. These series differ from current process-status counts above. Dashed segments mark the incomplete quarter.
Chart data
| Quarter | Individual draft activity | Working-group draft activity | Cumulative RFCs |
|---|---|---|---|
| 2022 Q1 | 16 | 1 | 6 |
| 2022 Q2 | 16 | 1 | 6 |
| 2022 Q3 | 15 | 4 | 6 |
| 2022 Q4 | 22 | 6 | 6 |
| 2023 Q1 | 23 | 12 | 6 |
| 2023 Q2 | 25 | 11 | 6 |
| 2023 Q3 | 32 | 12 | 6 |
| 2023 Q4 | 33 | 14 | 6 |
| 2024 Q1 | 35 | 13 | 6 |
| 2024 Q2 | 40 | 20 | 6 |
| 2024 Q3 | 35 | 19 | 7 |
| 2024 Q4 | 49 | 22 | 7 |
| 2025 Q1 | 64 | 25 | 8 |
| 2025 Q2 | 59 | 29 | 11 |
| 2025 Q3 | 57 | 33 | 12 |
| 2025 Q4 | 70 | 31 | 17 |
| 2026 Q1 | 73 | 33 | 19 |
| 2026 Q2 | 112 | 32 | 23 |
| 2026 Q3 | 127 | 31 | 28 |
| 2026 Q4 | 130 | 31 | 28 |
What became of earlier individual drafts?
110 drafts first posted before October 21, 2024
How long did recorded milestones take?
First version → recorded WG adoption
29 completed recordsPublication request → first recorded IESG approval
33 completed recordsFirst version → RFC publication
28 completed recordsSeparate completed-record cohorts, not sequential stages for the same drafts or forecasts for pending work. The publication range reflects month-only publication dates, not a confidence interval. Process evidence assembled October 23, 2026.
Milestone definitions and source records
Adoption uses recorded working-group adoption events; approval runs from publication request to first recorded IESG approval; publication runs from first version to RFC Editor publication. Pending and incomplete records are excluded from medians.
- First version → recorded WG adoption: 29 eligible; excluded: none.
- Publication request → first recorded IESG approval: 36 eligible; excluded: 3 pending.
- First version → RFC publication: 28 eligible; excluded: none.
Selected source examples:
- Merkle Tree Certificates Deployment Use Cases: 99 days, first version 2026-07-06 to adoption 2026-10-13.
- A Larger Internet Key Exchange version 2 (IKEv2) Payload: 1525 days, first version 2022-07-27 to adoption 2026-09-29.
Completed records also put the time commitment in view: a median of 331 days from first version to recorded working-group adoption, and roughly 764 to 793 days from first version to RFC publication. Those are separate cohorts, not a schedule for pending work. They give a team reason to examine the history of its particular dependency before attaching a delivery date to it.
Who is shaping the work
The October 26 corpus maps 2,284 researchers and 740 organizations. For a team assessing potential hires, collaborators, suppliers, or competitors, the useful detail is in their contributions: who publishes on a technique, who authors its protocol proposals, and who is involved in implementation.
In the October 21 organization view, SQIsign appears among the featured topics for IBM Research, CNRS, Shanghai Jiao Tong University, and KU Leuven. Their other featured interests differ, from threshold signatures to FN-DSA and isogeny-based protocols. That gives an investigation a specific starting point: the work each group has contributed and how it relates to the technical problem at hand.
Who’s doing the work
Six leading organizations · October 21, 2026SQIsign is highlighted wherever it appears among these organizations’ three featured topics. Shared focus indicates overlapping interests; it does not establish collaboration.
IBM Research
/ 100
large company
20 tracked items in the past 12 months
Featured research focus
- SQIsign
- FN-DSA (Falcon)
- Isogeny-based advanced protocols
CNRS
/ 100
academic
20 tracked items in the past 12 months
Featured research focus
- ML-DSA (Dilithium)
- Post-quantum threshold signatures
- SQIsign
Shanghai Jiao Tong University
/ 100
academic
25 tracked items in the past 12 months
Featured research focus
- ML-DSA (Dilithium)
- FN-DSA (Falcon)
- SQIsign
Chinese Academy of Sciences
/ 100
academic
19 tracked items in the past 12 months
Featured research focus
- HQC
- ML-DSA (Dilithium)
- Post-quantum threshold signatures
Tsinghua University
/ 100
academic
26 tracked items in the past 12 months
Featured research focus
- HQC
- Hybrid key exchange (X25519MLKEM768 and relatives)
- FN-DSA (Falcon)
KU Leuven
/ 100
academic
33 tracked items in the past 12 months
Featured research focus
- ML-DSA (Dilithium)
- Isogeny-based advanced protocols
- SQIsign
The HQC example follows one such connection into a concrete proposal. HQC-KEM Key Agreement for TLS 1.3 was first posted on October 9 and revised on October 20, 2026. The record connects the proposal with John Preuß Mattsson, Sini Ruohomaa, Ericsson, and the underlying IETF text.
From an idea to its source
HQC · October 21, 2026- 01 · IdeaHQC
Code-based key encapsulation. Related research, standards, and contributors.
- 02 · ProposalHQC-KEM Key Agreement for TLS 1.3
Individual draft, active. First posted October 9, 2026; revised October 20, 2026.
- 03 · ContributorsJohn Preuß Mattsson and Sini Ruohomaa
Authors and organizational affiliations connect the proposal to related work.
- 04 · Primary source
The proposal and revision history provide the primary source record.
For a team considering HQC in a TLS product, technical diligence can begin with the proposed integration, its revision history, related implementation work, and the contributors whose decisions may affect compatibility.
The commercial assessment extends beyond the protocol
The October 26 collection includes 335 NIST-validated implementations and 42 retained ISO patent declarations, alongside government guidance and the research record. These materials belong in the same investigation when a product decision depends on validation requirements, migration timetables, or disclosed intellectual property.
A certificate-infrastructure assessment, for example, may turn on a combination of signature choices, certificate-size constraints, implementation support, procurement requirements, and patent disclosures. The relevant evidence will rarely sit in one paper or standards document.
PQScope’s reports on TLS, PKI, blockchains, and secure messaging organize investigations around those application contexts. The patent-disclosure collection connects declarations and filings with relevant ideas and source passages. A declaration can prompt a closer review; its presence alone does not establish the scope of a patent or its application to a design.
Research supporting legal engagements
PQScope contains 36,161 searchable evidence records, including public discussion, and 1,934 source records with retained text as of October 26. Retained passages let an investigation return to the wording of a proposal, publication, or disclosure when a conclusion depends on the details.
Our team uses the collection and its reports in client investigations. MCP integration supports research with compatible AI assistants, including search and retrieval of retained source passages.
An investigation can begin with a product decision:
A team is considering HQC support in a TLS product. Which proposals and implementations are relevant, who is contributing, and which dependencies remain unresolved? What source evidence distinguishes implemented capabilities from proposed work?
We built PQScope for questions arising in our own practice. It supports sustained investigation across post-quantum research, standards, implementations, policy, and intellectual property for clients making technical and commercial commitments in the field.