How authentik is handling post-quantum cryptography

authentik outlines how post-quantum cryptography (PQC) affects identity providers, explaining that future quantum computers could break current public-key systems such as RSA, elliptic-curve cryptography, and Diffie-Hellman, while symmetric encryption generally remains viable, particularly with AES-256. It argues that organizations should begin migrating now because attackers can capture encrypted traffic for future decryption and because US, European, and national-security requirements increasingly set PQC transition targets between 2030 and 2035. Authentik already uses the hybrid X25519MLKEM768 TLS key exchange to protect against harvest-now, decrypt-later attacks, and version 2026.11 adds ML-DSA certificates, OIDC token signing and verification, passkey support, and AES-256-GCM defaults for new SAML and WS-Federation providers. Some capabilities remain dependent on evolving standards, including ML-DSA support for SAML signing, ML-KEM-based token and assertion encryption, composite hybrid certificates, and FIPS 140-3 validated modules that support ML-DSA. The post also reviews NIST’s standardized algorithms, identifying ML-KEM for key exchange and ML-DSA for signatures as the principal production-ready options, while positioning SLH-DSA as a conservative hash-based alternative and FN-DSA as a still-developing option for constrained environments.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.