Post-Quantum Check
See whether a site, a certificate or an SSH, PGP or JWK key would resist a quantum computer, when NIST retires its algorithms and what replaces them
| Part | Algorithm | Quantum | NIST |
|---|
What to do
How it works
- The threat
- A large enough quantum computer would break RSA and elliptic curves (Shor's algorithm): every key exchange, certificate and signature of today. AES and SHA-2 hold
- Encryption first
- Traffic or a message recorded today can be decrypted the day such a computer exists ("harvest now, decrypt later"): key exchange and encryption keys come first. A signature can only be forged from then on, so certificates and signing keys can wait
- The dates
- NIST (IR 8547) deprecates the 112-bit ones (RSA 2048) after 2030 and disallows them all after 2035. Their replacements: ML-KEM for key exchange (FIPS 203), ML-DSA and SLH-DSA for signatures (FIPS 204, 205), first paired with X25519 or ECDSA (hybrid), so a flaw in the new one alone breaks nothing
- A domain
- This server sends the site the greeting a browser sends (TLS 1.3, offering X25519MLKEM768 and X25519) and reads the group it picks, then asks for the hybrid alone and the other post-quantum groups if it didn't. The handshake stops there: nothing is decrypted. Its certificates are read like pasted ones
A certificate, a key or a file is read in your browser and never leaves this page; paste public keys only, a private key isn't needed. A domain goes to this server, which connects to the site on port 443.