Vista resources / Evidence directory

Which products support post-quantum cryptography?

OpenSSL and OpenSSH are two examples of products with documented post-quantum capabilities. Use the directory to compare the function and version each supplier documents, then check whether your installation enables and uses that capability.

Free to use · No registrationReviewed

The working edition / Excel workbook

Take the directory into your evaluation.

A sourced product baseline with space for installed versions, owners, review dates and your own evaluation notes.

12 sourced entries · Evaluation columns · Source links · Dashboard · Official checks

Download Excel workbook ↓
What’s inside & how to use it

Start on the “Start here” tab. Blue input cells are editable; gray columns calculate automatically. Filterable tables, frozen headings, dropdowns and date-based review flags help you work through the records. Examples are kept separate from your working data.

On “Official checks,” enter a CMVP certificate number to generate a link to the official NIST record, or use an HTTPS evidence URL. Open the source, review the actual scope and status, then record the result and review date. Status is not fetched automatically. No macros or automatic network requests are included.

Open in Excel or LibreOffice for formula recalculation. The prepared ranges contain up to 100 rows; extend formulas, validation and dashboard ranges for larger inventories. CSV alternatives below are plain data files without formatting or formulas.

Read each entry as a scoped claim

These twelve entries summarize vendor or project documentation reviewed on October 31, 2026. They are not independent product tests, endorsements, or a complete market survey. Versions identify documented introductions or release scope; verify the currently supported release and configuration before deployment.

Every entry below is documented available. A product’s presence here does not imply FIPS validation, government approval, or coverage of every cryptographic function. Use the questionnaire when documentation leaves an important gap.

Plain CSV directory ↓

Library · Documented available

OpenSSL

3.5

ML-KEM, ML-DSA and SLH-DSA primitives; hybrid TLS.

Configuration
X25519MLKEM768 leads the default TLS group list; applications can override configuration.
Boundary
Library availability does not prove an application uses it or establish module validation.
TLS configuration evidence ↗ · 3.5 release evidence ↗

Remote access · Documented available

OpenSSH

9.9 introduction; 10.0 preferred default

mlkem768x25519-sha256 key agreement.

Configuration
Compatible peers required.
Boundary
Key agreement does not establish PQ host or user signatures.
Read implementation evidence ↗

Browser · Documented available

Google Chrome

Desktop 131

ML-KEM768 + X25519 hybrid TLS.

Configuration
Compatible server required; enterprise policy can affect behavior.
Boundary
Final ML-KEM wire format differs from earlier experimental Kyber groups.
Read implementation evidence ↗

Browser · Documented available

Mozilla Firefox

Desktop 132

Hybrid ML-KEM TLS 1.3 key agreement.

Configuration
Compatible server required.
Boundary
This release note does not establish all protocol paths or managed configurations.
Read implementation evidence ↗

Library · Documented available

Go crypto/tls

1.24

X25519MLKEM768 hybrid TLS.

Configuration
Default when CurvePreferences is nil; GODEBUG can change behavior.
Boundary
Custom settings and network compatibility must be checked.
Read implementation evidence ↗

Operating system · Documented available

Apple system TLS APIs

OS 26 family

Hybrid PQ TLS through URLSession and Network frameworks.

Configuration
Enabled by default in these APIs with compatible servers.
Boundary
Legacy Secure Transport and custom networking stacks need separate review.
Read implementation evidence ↗

Messaging · Documented available

Apple iMessage

iOS/iPadOS 17.4; macOS 14.4; watchOS 10.4

PQ3 messaging protection and rekeying.

Configuration
Conversations between supporting devices.
Boundary
Does not cover SMS or every Apple service.
Read implementation evidence ↗

CDN · Documented available

Cloudflare edge TLS

Hosted service

Visitor-to-edge hybrid TLS 1.3 key agreement.

Configuration
Compatible client required.
Boundary
Origin-server connections require separate assessment.
Read implementation evidence ↗

Cloud service · Documented available

AWS KMS API

ML-KEM rollout announced April 7, 2025

Hybrid ML-KEM TLS to KMS API endpoints.

Configuration
Announcement covers non-FIPS endpoints in the aws partition; compatible client required.
Boundary
Transport support does not mean every KMS key is a PQ key.
Read implementation evidence ↗

Cloud service · Documented available

AWS Certificate Manager API

ML-KEM rollout announced April 7, 2025

Hybrid ML-KEM TLS to ACM API endpoints.

Configuration
Same announcement scope: non-FIPS endpoints, aws partition, compatible clients.
Boundary
API transport support does not establish PQ signatures on issued certificates.
Read implementation evidence ↗

Cloud service · Documented available

AWS Secrets Manager API

ML-KEM rollout announced April 7, 2025

Hybrid ML-KEM TLS to Secrets Manager.

Configuration
Same endpoint scope; the application TLS stack must offer ML-KEM.
Boundary
This entry covers the API connection, not every secret-consuming system.
Read implementation evidence ↗

Before you rely on an entry

  1. Match the exact product, edition, platform and version.
  2. Confirm defaults and any administrator or client requirements.
  3. Test the intended protocol path and preserve the observation.
  4. Record dependencies, exclusions, and a next review date.

Found a stale reference? Send the Vista team the product name, affected entry, and primary-source documentation. Corrections require editorial review.

Continue in Vista

Check the product you actually run

Use the directory to identify a capability worth investigating. In Vista, locate the relevant deployed assets and available software or cryptographic observations. Confirm the installed version and configuration through supported evidence sources, then track gaps in Remediation → Queue.

A vendor’s documented support is a starting point. Vista helps connect deployment evidence and follow-up work; this directory does not automatically synchronize into your inventory.