While all RHEL 10 post-quantum cryptography (PQC) algorithms that use official names (ML-KEM, ML-DSA, SLH-DSA) follow the NIST-published standards for their implementation (FIPS 203, 204, and 205), the National Institute of Standards and Technology (NIST) standards do not specify how the algorithms are used in other protocols or file formats.

A large set of possible ways to use them have been created, but only the ones that will be standardized by IETF might be supported in future releases of RHEL.

Red Hat Enterprise Linux 10.1

The post-quantum cryptography available in RHEL 10.1 is fully supported. The implementations use IETF-defined identifiers and file formats for those algorithms.

OpenSSL

The post-quantum algorithms in OpenSSL 3.5 in RHEL 10.1 are included in the default provider. They are not included in the fips provider; as such, only the hybrid key exchange algorithms that use the FIPS-approved curves are functional when the system works in FIPS mode: the SecP256r1MLKEM768 and SecP384r1MLKEM1024.

KEM Algorithms

Signing algorithms

GnuTLS

KEM algorithms

Signing algorithms

NSS

KEM algorithms

Signing algorithms

OpenSSH

KEM algorithms

Go

KEM algorithms

Red Hat Enterprise Linux 10.0

In RHEL 10.0 support for post-quantum cryptography is present as Technology Preview. In particular, the set of supported algorithms and the file formats used by those implementations are not standard.

OpenSSL oqsprovider

The post-quantum algorithms in OpenSSL in RHEL 10.0 are provided through the oqsprovider package. An installation of the oqsprovider package automatically enables the open quantum-safe provider for OpenSSL (oqsprovider) and the use of the PQC algorithms implemented in the provider.

The OQS provider (oqsprovider-0.8.0-5.el10) implements the ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) and ML-DSA (Module-Lattice-Based Digital Signature Algorithm) NIST standards. The package provides an early draft version of SLH-DSA (Stateless Hash-Based Digital Signature), the SPHINCS+ algorithm, which will not be supported in the future.

The OQS provider implements many algorithms, especially hybrids, that will not be supported in future RHEL releases.

KEM algorithms

Signing algorithms

GnuTLS

KEM algorithms

Signing algorithms

NSS

KEM algorithms

OpenSSH

KEM algorithms

Go

The Go toolset supports only one, very early, draft of post-quantum key exchange in TLS. It is not supported by any other library in RHEL 10, and it will not be supported in the future.

KEM algorithms

Additional resources

NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
NIST FIPS 204: Module-Lattice-Based Digital Signature Standard
NIST FIPS 205: Stateless Hash-Based Digital Signature Standard