Vista resources / Selected milestones

PQC standards and implementation timeline

Use this curated timeline to see when selected PQC standards and product capabilities were announced. Follow each dated source, then check whether the change applies to the version you run or the requirement you track.

Free to use · No registrationReviewed

A curated timeline

This first edition collects selected milestones, reviewed October 31, 2026. It is an editorial snapshot, not a live feed or exhaustive news service. Dates below describe the underlying event; the review date describes when this selection was checked. Historical release notes establish what was announced then, not the complete current feature set.

· Government

NSA CSfC key-management annex updates

The capability-package page lists version 3.0.0 key-management annexes.

Who should act: CSfC teams: review the current annex and its applicability to the exact architecture. Symmetric pre-shared-key approaches should not be relabeled as ML-KEM.

Read the primary source ↗

· Implementation

OpenSSL 3.5 release

A major library release adds native PQ algorithms and hybrid TLS capabilities.

Who should act: Application owners: identify linked libraries and plan compatibility tests for supported upgrades.

Read the primary source ↗

· Implementation

AWS announces ML-KEM API transport support

KMS, ACM and Secrets Manager announce hybrid TLS for the specified non-FIPS endpoint scope.

Who should act: Cloud teams: check endpoint partition, client TLS capability and application configuration.

Read the primary source ↗

· Standards

NIST selects HQC for standardization

A further KEM is selected to diversify the portfolio. Selection is not publication of a final standard.

Who should act: Architects: track standards development while continuing inventory and planning.

Read the primary source ↗

· Implementation

Firefox 132 hybrid TLS support

Desktop release notes document ML-KEM-based hybrid TLS 1.3 support.

Who should act: Web teams: test compatible endpoints and network devices with intended clients.

Read the primary source ↗

· Standards

NIST publishes the first three PQC standards

FIPS 203, 204 and 205 provide finalized ML-KEM, ML-DSA and SLH-DSA references.

Who should act: Procurement teams: request exact standardized algorithms and product versions from suppliers.

Read the primary source ↗

Use changes to review your inventory

When a relevant product ships support, identify installed versions and affected services before scheduling a change. When guidance changes, record the applicable scope and have the responsible owner review it. Use the supplier tracker to follow up on new claims and the playbooks to prepare a pilot.

A milestone can trigger investigation without implying an immediate production change. Capture your decision and the next review date.