Red Hat’s strategy for post-quantum cryptography

Traditional encryption faces a hard deadline. Cryptographically relevant quantum computers (CRQCs) are moving from theory to reality. When they arrive, they will break the public-key cryptography that protects nearly every modern digital asset, process, hardware or software system, and network identity. 

Security relies on 3 core pillars: confidentiality, integrity, and availability. A quantum computer powerful enough to run advanced decryption algorithms puts all 3 at risk. For IT leaders, this means the daunting task of identifying and replacing outdated encryption across systems must start today. 

“Q-Day” is the day when a CRQC becomes available. While estimates for Q-Day vary, it is becoming clearer that it is arriving sooner than expected. Quantum information science and technology (QIST) continues to mature with newer, larger quantum computers, advancements beyond Shor's algorithm, and more reliable error correction in ever-larger ensembles of Qubits. 

Cryptography is woven into many modern systems, but Red Hat has spent years planning for Q-Day. Post-quantum cryptography (PQC) relies on complex mathematical algorithms that run on classical hardware but can successfully resist both classical and quantum attacks. Transitioning to quantum-resistant security is a long-term strategy, not a quick patch. Red Hat can help you build an operational roadmap.

Early industry conversations focused almost entirely on harvest now, decrypt later (HNDL) attacks. In an HNDL scenario, an adversary intercepts and archives encrypted enterprise traffic today, waiting to decrypt it once they gain access to a quantum computer. 

HNDL remains a serious threat, but it is not the only one. As Q-Day approaches, you must account for a much wider circle of vulnerabilities. 

Figure 1. Potential vulnerabilities associated with Q-Day.

Red Hat uses a 3-step strategy to help enterprises establish operational resilience before classical encryption fails.

Step  1: PQC modernization

We are building standard, quantum-resistant algorithms (QRAs) directly into the core of our platform ecosystem. Red Hat® Enterprise Linux® 10 includes default hybrid-PQC capabilities for secure sockets layers (SSL), alongside National Institute of Standards and Technology’s (NIST) standardized algorithms: 

• FIPS 203: (ML-KEM, formerly Crystals-Kyber) for secure key encapsulation.  
• FIPS 204: (ML-DSA, formerly Crystals-Dilithium) for digital signatures.  
• FIPS 205: (SLH-DSA, formerly SPHINCS+) for stateless hash-based signatures.

Deploying these algorithms is difficult due to complex open source dependencies. Red Hat is using its leadership in upstream communities to help prepare core standards like SSL and X.509 for the quantum era. To accommodate what is expected to be a complex transition period, hybrid protocols and mixed-mode operations are provided whenever they support such modes.

Quantum safety is not merely about having algorithms present; it's about effectively using them to protect your assets. Red Hat is driving PQC adoption across its layered portfolio to provide libraries, applications, and tools that are quantum-resistant.

• Red Hat Enterprise Linux 10 has already been released with NIST-standard QRAs, default hybrid-PQC for SSL, and other core capabilities.
• Red Hat OpenShift® serves as a self-contained, hybrid cloud foundation that lets you consistently run and protect your most critical workloads.
• Red Hat is supporting PQC in key application libraries and runtimes, including Python, Go, and Java.
• Red Hat Advanced Developer Suite is preparing to deliver PQC for key components of the software supply chain, including trusted artifacts, signing, and verification.
• Red Hat is investing and accelerating PQC for Red Hat identity platforms—including Identity Management in Red Hat Enterprise Linux, Red Hat Certificate System, and Red Hat Directory Server—to build a quantum-ready trust basis.

As Red Hat makes quantum resistance available, it will inform customers through product tagging, individual component tagging, and cryptographic bills of materials (CBOMs). A CBOM is an inventory of all cryptographic assets and dependencies within an application, helping security teams track what needs to be modernized.

Figure 2. Q-Day preparation roadmap.

Yesterday	Today	Tomorrow	Future
Traditional cryptography; no quantum-resistant algorithms available.	Includes available QRAs and PQC functions. Not available for all applications. Classical by default with configurable use of available QRAs.	QRAs and PQC functions by default where available, configurable classical where needed.	Classical algorithms and functions will be marked as deprecated with eventual removal. Capabilities and mechanisms to be resistant to downgrade attacks.
Classical	PQ-capable	PQ-ready	Deprecation and removal

Step 2: Cryptographic agility

PQC migration is qualitatively different from either past cryptographic updates or IT modernizations: It’s a must-succeed, novel synthesis of both. Achieving the necessary agility requires organizations to map how platforms exchange cryptographic keys. 

This process begins with a clear inventory of your software assets. It starts with the basics: inventory and risk management. Once inventory information is complete and checked for accuracy, optimization and management work can begin.

Red Hat tools can help automate this process: Red Hat Lightspeed telemetry platforms are integrating cryptographic discovery and Red Hat Ansible® Automation Platform can apply general-purpose system automation to the discovery process. This facilitates modernization and builds the foundation for future enterprise agility.

Adopting PQC may motivate organizations to focus on fundamental enterprise agility, but there are many other reasons to do so:

• Artificial intelligence and agentic systems will rely on nonhuman identity and specialized authentication and authorization systems.
• Software-defined IT systems with a higher dynamic nature require frequent use of independent cryptographic trust and trust anchor systems.
• Cybersecurity risks, particularly in supply chains, are rapidly increasing and the industry is responding with wider use of cryptographically secured or organized digital assets.

Step 3: Cryptographic posture management

Enterprise governance is at the heart of cryptographic posture, assessing the state and actively managing the use of cryptography within an organization. Assessment and management needs to outlast PQC migration and remain relevant even after migration to QRAs is complete. CBOMs will provide an invaluable tool for exchanging posture information across applications, teams, and vendor ecosystems—and to your Chief Information Security Officer (CISO) for effective policy definition and management.

Figure 3: Example cryptographic discovery scan results from Red Hat Ansible Automation Platform over a set of hosts.

It’s a governance challenge, and well-defined policies are critical to success. Red Hat has provided specialized cryptographic policies in Red Hat Enterprise Linux since version 8, and is providing policies to support the transition process and prepare for a future, policy-managed state. Equally critical to managing your own assets is applying the same CPM rigor to all dependencies in your enterprise: external managed services, supply chain and vendors, and hardware and network providers.

Because the risk landscape extends beyond simple data harvesting, your immediate steps should focus on establishing a strong foundation.

Early analysis suggests some basic steps to prioritize for Linux users, in the near term.

Figure 4. Prioritized steps for Linux users.

As Q-Day gets closer and eventually arrives, the range of risks will increase and threats and threat actors will materialize.

The transition to post-quantum cryptography has been compared to Y2K—but this comparison downplays the organizational changes that will be required to meet this challenge.

Figure 5. Change management and alignment to goals.

Cultural change	Policy development	Collaboration	Roadmap
PQC forces us to move past the "padlock fallacy"—the habit of setting up encryption once and never checking it again.  Instead of treating security as a static compliance checklist, teams must view cryptography as a dynamic system requiring continuous, active management.	Align cryptographic strategies with international best practices. Implement policies that track the threat clock across your global presence, so you can take calculated steps to resilience and sovereignty.	Work within the global community to ensure open, neutral standards. Red Hat works to maintain interoperability with global upstream communities, like those around Linux, OpenSSL, and Sigstore.	Plan to implement a transition while maintaining operations and resiliency of high-value assets and impacted  business workflows. Prioritize the most sensitive global assets while automating to systematically reduce migration time.

While your organization matures, Red Hat can help with early, high-value activities, such as:

• PQC assessment: Create a maturity roadmap to guide your journey. Red Hat Consulting can help you deploy cryptographic scanning tools and methods, and put you on a path to understanding your current usage and encoding CBOMs.
• Crypto agility foundation: Start implementing supply chain oversight, crafting policies, and deploying continuous cryptographic monitoring.
• Compliance maintenance: Integrate your cryptographic posture data into your enterprise compliance to ensure you meet your jurisdiction's requirements and address emerging threats and risks.
• Zero trust architectures: During the PQC transition period, many existing and low-priority enterprise resources will lag in quantum readiness. Red Hat can help by using best practices to mitigate risk with layered defenses.
• Build standard operating environments (SOE): Use Red Hat Enterprise Linux, Red Hat Satellite, Red Hat OpenShift, Red Hat Ansible Automation Platform, and others to build environments with well-known post-quantum readiness and roadmaps for the future.

Build a foundation for modern, policy-managed crypto functions

Use Red Hat Enterprise Linux 10.1 (or later) and Red Hat OpenShift to bring quantum-safe TLS to the connections carrying critical data today, with emerging PQC certificate and signature support to harden identity and access systems.

Take an automated approach to PQC modernization

Discover how Red Hat Ansible Automation Platform helps provide enterprise coverage and repeatable processes for cryptographic discovery and remediation.

Engage with Red Hat Consulting for practiced expertise

Work with Red Hat specialists to audit your systems, develop a migration roadmap, and implement quantum-resistant security measures step by step.