Cryptographic Right Answers Updated for 2026: Post-Quantum Deadline Set at 2029

The 2026 Update to a Crypto Tradition

Filippo Valsorda has published a new edition of "Cryptographic Right Answers," updating a series that began with Colin Percival in 2009, continued with Thomas Ptacek in 2015, and was carried on by Latacora in 2018 and 2024. The 2026 revision reflects a dramatically shifted timeline for the post-quantum transition, with consensus now forming around a 2029 completion deadline. Symmetric cryptography remains largely unaffected because Grover's algorithm does not materially change security requirements, but nearly every asymmetric recommendation has changed compared to prior editions.

The update also acknowledges a major shift in development practice: LLMs are now effective enough at finding bugs that getting a review from the best available model has become a Cryptographic Right Answer alongside the long-standing advice to use a memory-safe language.

Symmetric Recommendations Remain Stable

For data encryption, the guidance is to use a cloud KMS when available, otherwise XAES-256-GCM or XChaCha20Poly1305 with random nonces of at least 128 bits. For large messages exceeding a few megabytes, Cobblestone-128, a STREAM variant derived from TLS, is recommended over passing one large message to an AEAD. Symmetric key length advice is unchanged: use 256-bit keys without stressing over it, as Grover does not matter and 256 bits rule out multi-target attacks. HMAC-SHA-256 remains the symmetric signature choice, and SHA-2 is still fine for hashing, with SHA-512/256 preferred where available due to its immunity to length-extension attacks. Random IDs should be 32 random bytes from the operating system CSPRNG.

Asymmetric Cryptography Undergoes Major Changes

Key exchange now recommends X25519 combined with ML-KEM-768 inside a standard protocol such as TLS, SSH, or HPKE. Non-post-quantum key exchange is described as an active, urgent liability due to harvest-now-decrypt-later attacks. For asymmetric encryption, HPKE with the MLKEM768-X25519 (X-Wing) combiner, HKDF-SHA256, and AES-128-GCM is the primary recommendation, or age with its new age1pq-prefixed keys. Asymmetric signatures should use ML-DSA-44 rather than any classical algorithm, including Ed25519, RSA, or ECDSA. Hybrid signature schemes are explicitly discouraged for most use cases, though SSH keys are noted as an exception where OpenSSH 10.6 ships ssh-mldsa44-ed25519.

Transport Security and Backups

For website and client-server application security, the recommendation is to use a cloud ALB/NLB when in the cloud, otherwise rustls, Go's crypto/tls, BoringSSL, AWS-LC, or s2n-tls with a well-maintained ACME client. OpenSSL is advised against when possible, with the author citing consistently puzzling choices over several years. All TLS deployments should prioritize the X25519MLKEM768 key exchange, which requires TLS 1.3. For online backups, restic with a long random password is recommended over Tarsnap, whose RSA-based asymmetric layer is flagged as a footgun with quantum computers approaching, despite its otherwise sound 2008 design.

Sources: Lobsters