Full Report
This is good: Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency, we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography. Remember, the reason to do this now is because there’s no emergency. And because you will make your systems crypto agile, which is always a good idea.
Analysis Summary
# Tool/Technique: Post-Quantum Cryptography (PQC) in pyca/cryptography
## Overview
This tool represents the integration of NIST-standardized Post-Quantum Cryptography (PQC) algorithms into the widely used `pyca/cryptography` library for Python. Its purpose is to provide "crypto agility" and protect data against future "harvest now, decrypt later" attacks by quantum computers.
## Technical Details
- **Type:** Cryptographic Tool / Defensive Library
- **Platform:** Cross-platform (Python ecosystem)
- **Capabilities:** Key-establishment (ML-KEM) and Digital Signatures (ML-DSA)
- **First Seen:** August 2026 (Integration announced/implemented)
## MITRE ATT&CK Mapping
*Note: As this is a defensive security tool, these mappings reflect how it counters specific adversary tactics or how an adversary might interact with encrypted data.*
- **[TA0009 - Collection]**
- **[T1005 - Data from Local System]**: PQC mitigates the impact of data collection if the data is stored encrypted with quantum-resistant algorithms.
- **[TA0011 - Command and Control]**
- **[T1573 - Encrypted Channel]**: Adversaries may attempt to use these same libraries to harden their own C2 communications against future decryption.
- **[TA0040 - Impact]**
- **[T1486 - Data Encrypted for Impact]**: While a defensive tool, these primitives could be utilized by advanced ransomware variants to ensure encryption cannot be broken even by quantum-assisted recovery efforts.
## Functionality
### Core Capabilities
- **ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism):** Formerly known as Kyber. Used for establishing shared secret keys over insecure channels, resistant to quantum computer attacks.
- **ML-DSA (Module-Lattice-Based Digital Signature Algorithm):** Formerly known as Dilithium. Used for verifying the authenticity and integrity of data and communications.
### Advanced Features
- **Crypto Agility:** Simplifies the transition from classical algorithms (like RSA or ECC) to PQC primitives within the Python ecosystem.
- **NIST Standard Compliance:** Implements the official Federal Information Processing Standards (FIPS) for post-quantum security.
## Indicators of Compromise
*As a legitimate security library, indicators are related to its presence in a development environment.*
- **File Names:** `cryptography` (installed via `pip install cryptography`)
- **Behavioral Indicators:** Python processes importing the `cryptography.hazmat.primitives.asymmetric` module to call ML-KEM or ML-DSA functions.
## Associated Threat Actors
- **N/A:** This is a defensive tool; however, nation-state actors (APTs) are the primary drivers for the adoption of PQC to protect sensitive long-term data from state-level quantum decryption capabilities.
## Detection Methods
- **Signature-based detection:** Monitoring for specific `pip` requirements files or `pyproject.toml` files containing `cryptography>=[PQC-supported-version]`.
- **Behavioral detection:** Identifying high-entropy data blobs in transit or at rest that do not conform to standard RSA/ECC structures, potentially indicating the use of PQC lattice-based keys.
## Mitigation Strategies
- **Proactive Implementation:** Organizations should begin transitioning sensitive data protection to use ML-KEM and ML-DSA to prevent "harvest now, decrypt later" scenarios.
- **Dependency Management:** Ensure the `pyca/cryptography` library is kept up to date to receive security patches for these new, complex implementations.
## Related Tools/Techniques
- **Open Quantum Safe (OQS):** A project providing a C library and integrations for quantum-resistant algorithms.
- **Classic McEliece:** Another post-quantum candidate (not part of this specific Python update but often compared).
- **Hybrid Cryptography:** The technique of using both classical (RSA/ECC) and PQC algorithms simultaneously for defense-in-depth.