Navigating Post-Quantum Cryptography in Practice: Lessons from OpenSSL and Enterprise Deployment

The migration to Post-Quantum Cryptography (PQC) is transitioning rapidly from theoretical standardization to real-world software integration. For enterprise engineering teams and CISOs, understanding how foundational cryptographic libraries implement PQC—and how these changes impact network performance—is critical to building a secure, quantum-safe roadmap.

A big thank you to Nalini Elkins from the Industry Network Technology Council (INTC) for organizing an insightful technical session, and to Rich Salz from Akamai for sharing his vast expertise on OpenSSL and practical PQC deployment.

Key Technical Takeaways from OpenSSL and PQC Integration

1. OpenSSL 3.5+ and Hybrid Key Exchange

• Default Preference: In modern OpenSSL releases (3.5+), hybrid (composite) key exchange mechanisms—such as combining ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) with classical elliptic curves like X25519 or P-256—are enabled and preferred by default.

• Passive vs. Active Protection: Hybrid key exchange protects against “Store Now, Decrypt Later” passive eavesdropping attacks. Even if a future quantum computer breaks the classical elliptic curve component, the ML-KEM layer ensures confidentiality.

2. Provider Architecture and FIPS 140-3

• OpenSSL’s modern architecture relies heavily on Providers to dynamic fetch cryptographic implementations (e.g., Default Provider vs. FIPS Provider vs. Legacy Provider).

• Enterprise developers should transition away from hardcoded algorithm API calls to dynamic fetching (EVP_* fetch mechanisms) to facilitate seamless, crypto-agile transitions between algorithms and certified modules.

3. The Impact of Signature & Key Sizes on Networks

• Moving from classical algorithms to post-quantum signature schemes like ML-DSA (Module-Lattice-Based Digital Signature Algorithm) involves significant increases in public key and signature sizes.

• For instance, an ML-DSA-44 public key and signature are substantially larger than classical P-256 equivalents, which can force TLS handshake certificates to fragment across multiple TCP segments (e.g., expanding handshake packet counts and introducing 150–300 ms of potential latency depending on network conditions).

• While high-frequency trading platforms may look toward complex solutions like Merkle Tree Certificates (MTC) to minimize bandwidth, standard enterprise environments will often prioritize direct ML-DSA deployment over the operational complexity of MTC.

How Qubit Guard Helps Customers Navigate the PQC Transition

Transitioning complex enterprise systems to PQC requires far more than updating a single library; it demands continuous visibility, auditability, and dynamic policy enforcement across all applications and infrastructure.

Here is how Qubit Guard empowers organizations:

1. Automated Cryptographic Discovery & CBOM Generation: Qubit Guard scans enterprise codebases, networks, and TLS endpoints to discover legacy cryptographic primitives and construct a comprehensive Cryptographic Bill of Materials (CBOM).

1. Crypto-Agility Architecture & Orchestration: By decoupling core business logic from specific cryptographic algorithms, Qubit Guard enables seamless configuration-driven swaps between post-quantum candidates (like ML-KEM and ML-DSA) without breaking enterprise applications or requiring massive code rewrites.

1. PQC Performance & Packet Optimization: Qubit Guard evaluates network performance impacts—such as TCP fragmentation and handshake latency caused by large post-quantum signatures—helping teams select optimal hybrid configurations tailored to their network topology and SLAs.

1. Policy Enforcement & Migration Governance: Qubit Guard continuously monitors fallback behavior (ensuring systems do not silently downgrade to insecure classical algorithms in failover environments) and aligns migration roadmaps with NIST standards and federal compliance frameworks.

Join the Discussion

How is your organization preparing its TLS stack and enterprise applications for post-quantum migration? Let us know in the comments below!

Watch the Rich’s Presentation here

PQC & OpenSSL

#PostQuantumCryptography #PQC #OpenSSL #Cybersecurity #CryptoAgility #TLS #NIST #Akamai #INTC #QubitGuard #InformationSecurity #CISO