Feature Overview (aka. Goal Summary)  

Make Installer PQC-capable for secure connections by integrating PQC hybrid key exchange (ML-KEM) capabilities provided by the underlying RHEL platform and the Go 1.24+ toolset to meet the following outcome: Making Core OpenShift 4.22 & Layered OpenShift 4.23 PQC-Capable (opt-in) for secure connections by integrating PQC hybrid key exchange (ML-KEM) capabilities provided by the underlying RHEL platform and the Go 1.24+ toolset. 

The 2026 NIST requirements are:

• Support and prefer PQC algorithms for software/firmware signing (2025)
• Support and prefer PQC algorithms for Web browser, Web servers and cloud services (2025)
• Support for networking equipment - including software, VPNs, IPsec... (2026) --> impact on IPsec usage in OCP

This includes ensuring Installer offers a PQC method for digital signing, web-based transactions can use end-to-end PQC algorithms, and Red Hat cloud services also support PQC algorithms & OpenShift networking protocols also support PQC algorithms.

To understand Post Quantum Cryptography and see a Kubernetes-based demo, please watch this IBM session from Kubecon NAM 2024: https://www.youtube.com/watch?v=6eQA15r6IHY (36 minutes)

• Red Hat Links:
  https://www.redhat.com/en/blog/red-hats-path-post-quantum-cryptography
  https://www.redhat.com/en/blog/how-red-hat-integrating-post-quantum-cryptography-our-products

Expectations & Goals

Goals (aka. expected user outcomes)

Success means:

1. Our customers can use PQC algorithms to check the  digital signature of OCP & Layered bits
2. Our customers can run PQC enabled web-based sessions, from their browser to the OCP application (and anything in between)
3. Red Hat cloud services supports PQC algorithms (jjung@redhat.com will clarify this requirement in Q1 2026, lacking info as of OCT 2025)
4. OpenShift’s internal CAs and PKI are PQC-capable, and the platform can be configured to use PQC algorithms for its own communications.
5. The necessary upstream changes in Kubernetes have been contributed and merged.

Requirements (aka. Acceptance Criteria):

• This is NIST roadmap to support PQC, and not following it creates risks:

1. 1. Failure to comply would jeopardize our NAM Public Sector customers, who must obey the NIST roadmap.
   2. We already have customer inquiries, meaning we need to provide a roadmap and progress to support PQC or risk letting competitors occupy the space we don't fill.
   3. Quantum Computer progress is dynamic, and the roadmap NIST provides (full PQC support by 2030-2032) is based on the current estimated progress of the technology. A breakthrough might require switching to PQC algorithms sooner than planned, and we cannot fall behind the NIST timeline.
      This outcome aligns with the company's strategic goals of enhancing security measures and ensuring systems remain secure even as quantum computing advances. This is a must-do, not an optional functionality.

Questions to Answer (Optional):

Out of Scope

Background

• “If large-scale quantum computers are ever built, they will be able to break many of the public-key cryptosystems currently in use. This would seriously compromise the confidentiality and integrity of digital communications on the Internet and elsewhere.  The goal of post-quantum cryptography (also called quantum-resistant cryptography) is to develop cryptographic systems that are secure against both quantum and classical computers, and can interoperate with existing communications protocols and networks.”  ([Source|https://csrc.nist.gov/Projects/post-quantum-cryptography)]