Post-Quantum Cryptography
The migration to quantum-safe encryption is underway, with regulatory deadlines moving faster than quantum computers themselves.
Six Traction · 2026-W43+1 this week
Why it's moving
- Cloudflare launched a post-quantum GeoKey Manager that protects geographically fenced decryption keys from harvest-now-decrypt-later collection while meeting data-sovereignty requirements.[Cloudflare]
- Momentum stayed Declining and Six Traction moved only slightly, from 58 to 59; weekly downloads of liboqs-python fell 11.7% week over week.[Measured data]
- Research interest kept climbing even as adoption signals stayed flat: arXiv papers on post-quantum cryptography rose from 12 to 16 in 30 days, while Hacker News attention held at 2 stories.[Measured data]
- GitHub star growth across Open Quantum Safe projects stayed minimal, around 0.5% week over week, consistent with compliance-paced infrastructure work rather than a fast-moving product category.[Measured data]
Text on this page is written by AI from the linked evidence and the measured data, checked automatically and approved by the publisher. Last updated 2026-10-25.
What changed this week
- Six Traction rose to 59 from 58 this week, a one-point move; momentum stayed Declining.
- liboqs-python's PyPI downloads fell 11.7% to 12,191; the theme's weekly downloads totaled 18,489.
- arXiv papers rose to 16 in the last 30 days, from 12.
Why you should care
Data captured today can be decrypted once quantum computers mature, so anything that must stay confidential for a decade is already exposed under this threat model. Standards are final, and browsers, CDNs and cloud services increasingly ship quantum-safe TLS by default, turning government deadlines into budgeted migration work. Adoption inside most enterprises is still early, and the pace of visible progress has been uneven: real but incremental, rather than a steady climb.
What is it?
Post-quantum cryptography (PQC) replaces today's public-key algorithms (RSA, elliptic curves) with ones believed secure against quantum computers. NIST finalised the first standards, ML-KEM for key exchange and ML-DSA for signatures, and migration is underway: browsers, TLS libraries, cloud providers and operating systems increasingly ship hybrid quantum-safe connections by default. The concern motivating urgency is harvest-now-decrypt-later: data encrypted and captured today could be decrypted once sufficiently capable quantum computers exist. Newer products, such as geography-aware key management services, are starting to build this threat model directly into their design.
What should you do?
For managers
What this could change
This is a multi-year infrastructure migration shaped by compliance deadlines, closer to Y2K than to a product trend. Any data that must stay confidential for ten or more years (health, financial, legal, IP) is already exposed to harvest-now-decrypt-later collection. The immediate action is inexpensive: inventory where your organisation uses public-key cryptography (a cryptographic bill of materials), ask vendors for their PQC roadmaps, and put migration into next year's budget planning. Progress across the open-source tooling ecosystem has been uneven lately, a reminder that finalised standards do not make the migration run itself. Organisations that wait for a quantum computer to exist will be years too late.
Bring to your next engineering conversation
Commission a cryptographic inventory now and ask vendors for their PQC roadmaps; being early is cheap, being late is not.
For developers
What to learn and build
You mostly will not implement PQC algorithms yourself; you will consume them through libraries and TLS. Learn the vocabulary (ML-KEM, ML-DSA, hybrid key exchange), understand where public-key cryptography lives in your systems, and check whether your TLS termination already negotiates hybrid PQC, as modern browsers and CDNs do. Practise crypto-agility: keep algorithm choices behind configuration so future swaps are cheap. Experiment with liboqs or your language's PQC bindings to demystify the primitives, and look at how products like Cloudflare's geography-aware key management build the harvest-now-decrypt-later threat model directly into their design.
This week's move
Learn the vocabulary (ML-KEM, hybrid key exchange) and check whether your TLS endpoints already negotiate it.
Learning path
No prior knowledge assumed — understand what it is and try it once.
Videos are chosen weekly from the last 90 days: filtered on age, length, reach and captions, rated by AI for relevance, accuracy and how inspiring they are, and approved with each edition. Docs and repositories marked “maintained” are link-checked every week.
- 1Understand the conceptNIST Post-Quantum Cryptography project — why migration is happeningNIST CSRC · maintained · 15 min
- 2Watch a practical videoPost Quantum Cryptography - ComputerphileComputerphile · maintained · 13 min
- 3Build something realCheck your connection — is your TLS already post-quantum?Cloudflare Research · maintained · 10 min
- 4Follow the ecosystemCloudflare →GitHub →
Why this scores 59
How is this calculated? →Repository usage, package downloads, stars, forks, contributors and enterprise implementations.
How quickly adoption indicators are changing over recent weeks.
Whether the trend appears across several independent sources — developers, open source, research, cloud providers, enterprises and media.
Potential relevance for organisations: productivity, infrastructure, security, cost and strategy.
Whether understanding the technology is likely to remain useful beyond the immediate news cycle.
Measured this week · 2026-W43
- GitHub stars (tracked repos)
- 3,615+17
- Package usage / week
- 18,489-1,615
- Source types reporting
- 4
- PyPI downloads / week
- 12,191
- crates.io downloads / week
- 6,298
- Packages depending on them
- 6,892
- Repositories depending on them
- 2,790
Collected automatically from GitHub, package registries (npm, PyPI, NuGet, crates.io, Docker Hub, VS Code Marketplace, Hugging Face) and ecosyste.ms and deps.dev; deltas compare against the previous week's collection. Usage adds different units (downloads, pulls, installs), so compare ecosystems separately.
Signals detected
The evidence behind this theme's score. Every entry links to its source.
2 sources across 2 categories
Cloudflare →GitHub →- CloudflarePost-quantum GeoKey Manager
Cloudflare launched a post-quantum GeoKey Manager that protects geographically fenced decryption keys from harvest-now, decrypt-later attacks while meeting data sovereignty requirements.
vendorProduct launch
- GitHubSteady contributor growth
Open Quantum Safe reference implementations see sustained cross-industry contribution.
open-sourceRepository activity
Six Traction over time
Measured by Tech Signal Six since 2026-08-17.
| Month | Six Traction |
|---|---|
| Aug | 62 |
| Oct | 59 |
Editorial baseline (illustrative, not measured)
An editor's estimate of how this theme developed before Tech Signal began measuring it, kept for context. It is deliberately not joined to the measured series above, and it never feeds a score.
| Month | Six Traction |
|---|---|
| Mar | 40 |
| Apr | 43 |
| May | 46 |
| Jun | 51 |
| Jul | 60 |
| Aug | 61 |
Related themes
Post-Quantum Cryptography connects to:
How this theme developed
October 2026
- Cloudflare launched a post-quantum GeoKey Manager to protect geographically fenced decryption keys from harvest-now-decrypt-later attacks.
August 2026
- Crypto-agility assessments become a standard item in enterprise security roadmaps.
July 2026
- Quantum-safe TLS reaches mainstream traffic share on major CDNs.
- Certificate and HSM ecosystem support continues to unblock enterprise adoption.
June 2026
- Theme entered the weekly top list: regulatory timelines plus shipping implementations moved PQC from research topic to active migration.