OpenSSL · Corporation
Field Dispatch / № 028

The lattice, the ledger, the handshake.

Tomáš Vávra walks the room through post-quantum cryptography in the OpenSSL Library — ML-KEM, ML-DSA, SLH-DSA, three FIPS standards, fifteen interop providers, and the one command that turns it all into a working TLS session.

Dispatch from ICMC26 · Tomáš on PQC
Tomáš Vávra at the podium in Salon 1 with the OpenSSL 3.5 feature slide projected behind him.
Salon 1–3 · 11:00
ICMC26 · 22 Apr 2026
The 3.5 feature board
Server-side QUIC, PQC algorithms, CMP key gen, opaque symmetric keys — mid-reading.
IMG / 5020
Speaker
Tomáš Vávra
Engineering Manager, OpenSSL
Session
Q21a · Salon 1–3
Wed 22 Apr · 11:00
Standards
FIPS 203 · 204 · 205
ML-KEM · ML-DSA · SLH-DSA
Interop
15 providers
IETF Hackathon R5
Pass rate
100% ML-DSA
certificates, all variants

The question in cryptography this decade is no longer whether the post-quantum algorithms are coming — NIST finalised them, the browsers shipped them, the governments signed the memos. The question is whether the libraries you already depend on can actually do the work. On Wednesday morning, for forty-five minutes in Salon 1, Tomáš Vávra's answer was: yes, and here is the command line.

It was a talk that started with a tongue-in-cheek self-portrait and ended with a shared secret. In between: three NIST standards, the three OpenSSL releases that shipped them, a speed table that tells you what a lattice actually costs, and the results of an interop hackathon that answers the quiet question behind every PQC rollout — will it work with the other guys?

A packed Salon 1 at ICMC26 — rows of attendees listening, many with laptops open, the grand Renaissance-Arlington chandelier above.
The room
Salon 1–3 · Wed 11:00
Forty-five minutes, two Tomášes, one track.
Engineers, lab testers, program managers — PQ is, by now, a shared working problem.
IMG_5223
Tomáš Vávra reading from his laptop at the ICMC26 podium, OpenSSL polo, glasses catching the screen glow.
01 / The speaker · introduced by the other Tomáš

Three years in OpenSSL. Sixteen in telco. One Eagle-Peacock.

Role · Engineering Manager In OpenSSL · 3 yrs Before · 16 yrs telco

The session was chaired by Tomáš Mráz, CTO of the OpenSSL Foundation, who introduced — as the symmetry of the project demands — Tomáš Vávra, engineering manager of the OpenSSL Corporation. Two Tomášes, one PQ track. The moderator handed off; the engineering manager opened the way engineering managers open these things, which is with a personality-test result. “I'm an Eagle / Peacock,” he said, and left the audience to translate that into whichever framework they grew up with.

The self-deprecating continuous goal, delivered on slide four: “switching open-source development into agile development — which is fun, especially when you don't have the resources.” Anyone who has tried to land a post-quantum algorithm into a library that ships to every Linux distribution on earth recognises this as, technically, a mission statement.

02The three releases that shipped it

Three versions, one algorithm family.

Before PQC, there was infrastructure for PQC. Tomáš walked through three releases in order — 3.5, 3.6, 4.0 — because the work that landed in 4.0 last week is only interesting if you understand the year of plumbing that preceded it.

3.5LTS · PQ by default
The arrival — and quietly, the switch. Server-side QUIC, pluggable 3rd-party QUIC stacks, ML-KEM / ML-DSA / SLH-DSA first-class, interop tested against BoringSSL and friends. The line Tomáš repeated twice from the stage: “if you install 3.5 and start using it, by default you will be using post-quantum algorithms. If you don't want that, you have to change the configuration.” The default flipped, and most users have not noticed.
08 Apr 2025
3.6Feature · 13mo
The FIPS layer. LMS signature verification (SP 800-208), deterministic FIPS 186-5 ECDSA, EVP_SKEY promoted to a first-class symmetric handle, configutl helper, NIST security-level categories on PKEY objects, FIPS provider upgraded so KDF & KEXCH understand opaque keys. C99 now required; ANSI-C support dropped.
01 Oct 2025
4.0Major
The major. Encrypted Client Hello (RFC 9849), hybrid curveSM2MLKEM768 TLS group, cSHAKE (SP 800-185), ML-DSA-µ external-digest variant, TLS 1.2 FFDHE negotiated groups, deferred FIPS tests, opaque ASN1_STRING, and the legacy sweep Tim read into the record on Tuesday — SSLv3 gone, ENGINE API gone, SSLv2 hello gone.
14 Apr 2026

Read top-to-bottom, the sequence is legible: ship the algorithms, harden the FIPS path, remove the legacy that would have blocked the next decade. Not one of those three steps is optional. Do any of them out of order and the rollout stops.

03Why we added PQC

Because the record-now, decrypt-later calendar is running.

The “why” slide arrived four minutes in, and it was short by design. Tomáš's bullet list distilled into a single sentence the project could have stuck on the cover of the release: NIST finalised FIPS 203, 204 and 205 earlier than expected; most browser vendors have already switched; more than 80% of the traffic is already using ML-KEM; and OpenSSL's users must not be left behind. That last clause is the one Tomáš kept circling back to. The mission, he said plainly, is “security and privacy for everyone” — and everyone now has to include a world in which large quantum computers exist.

I.

Industry demand

Governments, customers, and the industry as a whole are looking to upgrade to cryptographic systems that can withstand post-quantum cryptanalysis — inside a 5-to-20-year window.

II.

Long-term signatures

Artefacts that need to stay signed for a long time — firmware among them — need signature algorithms that will still mean something in the year they are verified, not the year they were issued.

III.

Protect key agreement

The highest priority is to replace Diffie-Hellman in key agreement, because a record-now-decrypt-later adversary only has to record once. That happens today.

More than 80% of the traffic is already using ML-KEM. We don't want our users left behind.
Tomáš Vávra · on why OpenSSL added PQC · 04:33 into the session
04The algorithms, named and numbered

Three standards, three problem shapes.

Slide eleven put five families of post-quantum approach on a single board — lattice, hash-based, code-based, multivariate, isogeny — which is the polite version of the story. The blunt version is: NIST standardised three of them, and those three are what OpenSSL 3.5 shipped. Lattice for the fast cases. Hash-based as the conservative fallback.

Key encapsulation
FIPS 203

ML-KEMModule-Lattice KEM

Establishing a shared secret — a traffic encryption key — between two communicating parties, resistant to post-quantum attack. Replaces Diffie-Hellman where record-now-decrypt-later is a plausible threat.
Lattice · 512 · 768 · 1024
Digital signature
FIPS 204

ML-DSAModule-Lattice DSA

Quantum-resistant signatures: certificate signing, peer authentication, code signing. Fast, small enough, and in 4.0 the external-µ variant makes it workable for HSMs that can't see the whole message.
Lattice · 44 · 65 · 87
Digital signature
FIPS 205

SLH-DSAStateless Hash-Based DSA

The conservative fallback. Hash-functions only — so it survives if lattices ever don't. Tomáš's one-line review: “significantly slower, so if you want to have a pain, use it.” A backup, valued precisely for being one.
Hash-based · 16 parameter sets

The FIPS 140-3 provider shipped in 3.5 supports all variants of ML-KEM, and the pure (non-Hash) variants of ML-DSA and SLH-DSA. The Hash variants — HashML-DSA and HashSLH-DSA — are on the list for upcoming releases. This is the detail buried at the bottom of slide seventeen that a procurement officer will want to photograph.

05What it costs, on a laptop

The lattice is faster than the curve.

Slide thirteen was the kind of slide that gets quiet attention: the output of openssl speed -kem-algorithms, in a simple table. The headline is a sentence most of the room had been waiting a decade to be able to say out loud: ML-KEM-768 is within shouting distance of ECP-256 on key generation — and it is materially faster on encapsulation and decapsulation than every classical curve listed.

Fig. 14 KEM algorithms, operations per second — log scale
keygen encaps decaps
ECP-256NIST P-256 · classical
154,436
21,232
28,045
ECP-384P-384 · classical
2,454
1,211
2,422
ECP-521P-521 · classical
972
483
960
RSA-2048classical · still ubiquitous
33.4
84,938
2,610
ML-KEM-512FIPS 203 · lattice · NIST-1
99,889
155,557
104,308
ML-KEM-768FIPS 203 · lattice · NIST-3 · TLS hybrid default
61,649
104,544
72,163
ML-KEM-1024FIPS 203 · lattice · NIST-5
39,818
74,836
52,137
2,990×
ML-KEM-512 keygen vs RSA-2048
5×
ML-KEM-768 encaps vs ECP-256
20×
ML-KEM-1024 decaps vs RSA-2048

Note the shape of the RSA-2048 row: encaps is fast, keygen and decaps are orders of magnitude slower. That asymmetry is why nobody generates RSA keypairs on the hot path. ML-KEM flattens it — keygen, encaps, and decaps all land in the same bracket, within a factor of two of each other. From a performance standpoint, lattice KEMs are not a concession. They are a simplification.

faster
ML-KEM-768 encapsulation vs. ECP-256 ECDH encapsulation. The classical baseline — the thing we've been doing since 2005 — loses on the metric PQC was supposed to be expensive on.

The point of the slide is not to win an argument. It is to take the “PQC is slow” objection off the table before it gets raised. On this particular CPU, with this particular build, the objection is approximately untrue. Hand-tuning per platform changes the numbers. The shape of the answer does not.

06Hands on, from the command line

A root CA, in six lines.

Slide twenty was the reason the room leaned in. The project's long-held conviction is that the CLI is the interface most users actually meet, and so the demonstration started there. An ML-DSA-65 root CA, entirely from openssl(1), no plugin required, no OQS provider, no “experimental” branch.

# 1. Generate the ML-DSA private key $ openssl genpkey -algorithm ml-dsa-65 \ -out ml-dsa-cakey.pem # 2. Create the CA certificate using ML-DSA $ openssl req -new -x509 -days 36524 \ -key ml-dsa-cakey.pem -out ml-dsa-cacert.pem \ -subj "/CN=Root CA" \ -addext "basicConstraints=critical,CA:true" \ -addext "keyUsage=critical,keyCertSign,cRLSign"

After that: an ML-DSA-65 end-entity certificate, an ML-KEM-768 key pair whose certificate is signed by the ML-DSA CA, and a CMS detached signature over a Fedora kernel binary. All ordinary openssl subcommands. Nothing custom. And then — the shot of the morning — the round-trip TLS session:

s_server + s_client, post-quantum all the way downTLSv1.3 · mldsa65 · X25519MLKEM768
# Server $ openssl s_server -brief -accept 127.0.0.1:12345 \ -cert "ml-dsa-cert.pem" -key "ml-dsa-key.pem" # Client $ openssl s_client -connect 127.0.0.1:12345 -brief \ -CAfile "ml-dsa-cacert.pem" \ -servername "ml-dsa.ee.example" CONNECTION ESTABLISHED Protocol version: TLSv1.3 Signature type: mldsa65 Verification: OK Negotiated TLS1.3 group: X25519MLKEM768
One side sets up an ML-DSA-signed cert. The other side reads it. The handshake ends in X25519MLKEM768. Not a demo build. Not a branch. Just openssl.
Reading the demo output · s_servers_client · Salon 1–3
07An interop sanity check

Three ports. Three variants. One server.

A lab result is not a network. To close the “yes, but against another implementation” loop, slide twenty-six connected the new CLI to Open Quantum Safe's public test endpoints. Three ports, three ML-DSA parameter sizes, one HTTP response:

OQS interop — three ports, three ML-DSA variants, one live serverML-DSA-44 · ML-DSA-65 · ML-DSA-87
# ================================================ # ML-DSA OQS Interoperability Test # ================================================ # ----- ML-DSA-44 — port 6182 ----- $ openssl s_client -connect \ test.openquantumsafe.org:6182 \ -sigalgs mldsa44 --brief CONNECTION ESTABLISHED Protocol version: TLSv1.3 Peer certificate: CN=test.openquantumsafe.org Signature type: mldsa44 Negotiated TLS1.3 group: X25519MLKEM768 HEAD / HTTP/1.0 HTTP/1.1 200 OK Server: nginx/1.27.4 Connection: close # ----- ML-DSA-65 — port 6195 ----- $ openssl s_client -connect \ test.openquantumsafe.org:6195 \ -sigalgs mldsa65 --brief CONNECTION ESTABLISHED Protocol version: TLSv1.3 Peer certificate: CN=test.openquantumsafe.org Signature type: mldsa65 Negotiated TLS1.3 group: X25519MLKEM768 HEAD / HTTP/1.0 HTTP/1.1 200 OK Connection: close # ----- ML-DSA-87 — port 6210 ----- $ openssl s_client -connect \ test.openquantumsafe.org:6210 \ -sigalgs mldsa87 --brief CONNECTION ESTABLISHED Protocol version: TLSv1.3 Peer certificate: CN=test.openquantumsafe.org Signature type: mldsa87 Negotiated TLS1.3 group: X25519MLKEM768 HEAD / HTTP/1.0 HTTP/1.1 200 OK Connection: close
Tomáš at Booth 4, in conversation with an attendee, the OpenSSL Library technical-work slide on the screen behind.
Booth 4 · 16:38 · post-session · the OpenSSL Library technical-work slide — “We believe everyone should have access to security and privacy tools.”
08The IETF Hackathon · Round 5

Fifteen providers. One question.

The final third of the talk was the part that does not appear in release notes. Interoperability — the question of whether one implementation's certificates and keys are legible to another's — is the thing a lab result cannot answer, and which the IETF PQC Hackathon exists specifically to measure. Round 5 dropped on 15 April, one day after 4.0 shipped. In Tomáš's words: “it is a volunteer activity. Fifteen companies. Automated. If your company wants to participate, have a look at the link.”

15
Providers
submitted in R5, Apr 2026
100%
ML-DSA cert pass rate
all variants, all providers
16
SLH-DSA param sets
SHA2 + SHAKE, 128/192/256 s/f
3/3
Verifiers pass
bc · composite-ref-impl · ossl35

The fifteen, in one glance

Bouncy Castlebc · composite primary
✓ full
Entrustentrust
CryptoNextcryptonext
Crypto4Ac4a
OpenJDKopenjdk
SafeLogicsafelogic
Carl-Redhoundcrh
CHTcht
Corey-DigiCertdigicert
LeanCryptoleancrypto
Entrust-PKIHubpkihub
Composite-KEM-refcomposite-kem-ref
Composite-Sigs-refcomposite-sigs-ref
Seventhsense.ai7sense
✗ priv
09OpenSSL 3.5 and Bouncy Castle, side by side

Two reference points. One ecosystem.

Tomáš spent a slide not on a comparison-as-competition, but on a comparison-as-complement. The two projects reached R5 with different strengths. You can read that as rivalry or you can read it as a working division of labour.

OpenSSL 3.5ossl35 · LTS to Apr 2030

  • Standalone PQC — no OQS plugin needed. The algorithms are in the library.
  • Universal private-key verifier — ML-DSA seed, expanded, both, consistent.
  • Hybrid TLS out of the box: X25519MLKEM768.
  • Active as both producer and verifier in R5.
  • 100% ML-DSA certificate pass rate across every R5 provider.
  • Not yet a verifier for composite X.509 certs. That's the 2026 gap.
vs.

Bouncy Castlebc · composite primary

  • Primary verifier for composite certificates — MLDSA+RSA, MLDSA+ECDSA, MLDSA+Ed25519.
  • Full PKCS#8 support — seed, expanded, both, as defined by the IETF draft.
  • Supports Chameleon & Delta draft certificate formats.
  • 100% ML-DSA certificate pass rate in R5.
  • Private-key verifier role still in progress for R5.
  • Producer-only for private-key formats this round.

Read as a map of scope, not a scoreboard. Each vendor chose what to submit to R5.

10What is still missing

Five gaps, named out loud.

Post-quantum is not a finished subject. Tomáš closed the interop section with a slide that the project — openly — has on its list. Naming the gap is more useful than pretending it isn't there.

Composite certificates — OpenSSL gap

OpenSSL 3.5 has no R5 entries as a verifier for composite certificates (e.g. MLDSA44+RSA2048). Only Bouncy Castle and composite-ref-impl parse them today. On the roadmap.

Seventhsense.ai — scope, not failure

Consistent 0/1 on ML-DSA private-key formats, but — as Tomáš put it — “they do composite, and they don't do other things. They know what they are doing.” Read the R5 table as a map of what each vendor chose to submit, not a scorecard.

SLH-DSA seed / expanded key formats

Only seventhsense.ai has submitted seed and expanded-key format artifacts for SLH-DSA. Broader participation needed to validate cross-vendor support.

PQC signatures in TLS still pending

TLS authentication with PQC X.509 certificate chains is still pending RFC finalisation — draft-ietf-lamps-dilithium-certificates and the composite-sigs RFCs.

Composite OIDs not yet IANA-registered

Composite algorithm OIDs have no permanent IANA assignment yet. Implementations use temporary OIDs, creating forward-compatibility risk for artefacts shipped today.

Once it is standardized, we will quickly add it. We are working on it — it is just not in the library yet.
Tomáš Vávra · on composite certificates · 27:28 into the session
Coming up · Thursday

Find us on the floor, one more day.

Thursday
Dispatch № 029

The conversations, continued.

Wednesday was our last day exhibiting — back-to-back meetings with clients, partners, cryptographers, senior leaders from large businesses, government representatives. Friends, too. Thursday we are still here, no booth this time, just the floor. If you are still around, find us. OpenSSL Corporation would like to know what you do with the OpenSSL Library, and how we can help.