France's ANSSI will stop certifying non-PQC products from 2027. The US Executive Order 14409 mandates PQC for all federal systems - key establishment by 2030, digital signatures by 2031.
Context
The project's own crypto.md acknowledges RSA-OAEP is "NOT quantum-resistant" and lists replacement candidates. However, the candidates listed (LMS, XMSS, McEliece) are hash-based signature schemes or legacy KEMs - not the NIST-standardized KEM.
The correct replacement for RSA-OAEP key encapsulation is ML-KEM-768 (FIPS 203), standardized by NIST in August 2024.
Proposal
Replace RSA-4096-OAEP with hybrid RSA-4096 + ML-KEM-768 for key encapsulation:
- Sealed secrets encrypted with both classical RSA and ML-KEM
- AES-256-GCM symmetric encryption unchanged (already quantum-safe)
- Backward compatibility: old sealed secrets remain decryptable
Go 1.24+ has crypto/mlkem in stdlib. filippo.io/mldsa provides ML-KEM as a bridge.
References
France's ANSSI will stop certifying non-PQC products from 2027. The US Executive Order 14409 mandates PQC for all federal systems - key establishment by 2030, digital signatures by 2031.
Context
The project's own crypto.md acknowledges RSA-OAEP is "NOT quantum-resistant" and lists replacement candidates. However, the candidates listed (LMS, XMSS, McEliece) are hash-based signature schemes or legacy KEMs - not the NIST-standardized KEM.
The correct replacement for RSA-OAEP key encapsulation is ML-KEM-768 (FIPS 203), standardized by NIST in August 2024.
Proposal
Replace RSA-4096-OAEP with hybrid RSA-4096 + ML-KEM-768 for key encapsulation:
Go 1.24+ has
crypto/mlkemin stdlib.filippo.io/mldsaprovides ML-KEM as a bridge.References