November 2026 Summaries

authentik outlines how post-quantum cryptography (PQC) affects identity providers, explaining that future quantum computers could break current public-key systems such as RSA, elliptic-curve cryptography, and Diffie-Hellman, while symmetric encryption generally remains viable, particularly with AES-256. It argues that organizations should begin migrating now because attackers can capture encrypted traffic for future decryption and because US, European, and national-security requirements increasingly set PQC transition targets between 2030 and 2035. Authentik already uses the hybrid X25519MLKEM768 TLS key exchange to protect against harvest-now, decrypt-later attacks, and version 2026.11 adds ML-DSA certificates, OIDC token signing and verification, passkey support, and AES-256-GCM defaults for new SAML and WS-Federation providers. Some capabilities remain dependent on evolving standards, including ML-DSA support for SAML signing, ML-KEM-based token and assertion encryption, composite hybrid certificates, and FIPS 140-3 validated modules that support ML-DSA. The post also reviews NIST’s standardized algorithms, identifying ML-KEM for key exchange and ML-DSA for signatures as the principal production-ready options, while positioning SLH-DSA as a conservative hash-based alternative and FN-DSA as a still-developing option for constrained environments.