Policy and regulation
Quantum is Coming…Quantum computing, QML and post-quantum cryptography. Policy and regulation
Quantum is Coming…

Powered by QiC Solutions
NewsAI

Policy and regulation · Quantum-Safe

UK’s NCSC publishes its post-quantum TLS profiles and urges a move to TLS 1.3 now

NCSC guidance sets out post-quantum TLS profiles with hybrid or pure ML-KEM and warns that TLS 1.2 will not get PQC. Authentication remains classical.

Redacción · · 3 min

Key points

  • For TLS 1.3 the NCSC recommends a hybrid profile (X25519MLKEM768 or SecP256r1MLKEM768) and another with ML-KEM-768 alone, both valid for OFFICIAL information.
  • TLS 1.3 is the only version that will get PQC: TLS 1.2 users should plan the upgrade, ideally together with enabling the post-quantum algorithms.
  • Authentication stays with ECDSA or RSA until there are standards; the NCSC asks for no certificates that expire after the planned migration date.

The UK’s National Cyber Security Centre (NCSC) has updated its guidance on configuring TLS with recommended profiles for post-quantum TLS. The new version, 1.2, is dated 15 October 2026 and, according to the agency, its configurations are suitable for general use and for protecting UK Government information classified as OFFICIAL, the level used for everyday business.

In the blog post that accompanies the guidance, its Principal Technical Director for Crypt and High Threat Technologies sums up the message: there are configurations that are standardised and implemented in mature libraries, so organisations should be “aiming to make this move now”.

What it recommends

The basis is RFC 10024, published by the IETF in August 2026, which standardises three hybrid key agreement mechanisms for TLS 1.3. Each one combines ML-KEM, the post-quantum algorithm, with a classical elliptic curve: X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024. The NCSC considers all three suitable and recommends the hybrids as a transitional measure.

  • Hybrid profile. Key exchange with X25519MLKEM768 or SecP256r1MLKEM768; authentication with ECDSA over P-256 or 2048-bit RSA-PSS; encryption with TLS_AES_128_GCM_SHA256.
  • Pure post-quantum profile. Key exchange with ML-KEM-768 alone, with the same authentication and the same encryption. Its TLS specification is not yet an RFC: the NCSC refers to “procedural delays”, but considers it acceptable because it is already in many implementations.
  • Clients. Where they can be configured, for example on a corporate network, it recommends offering key shares for X25519MLKEM768 and for the classical P-256 curve.

For servers running OpenSSL, the guidance proposes a group string that prefers the hybrids, then accepts pure ML-KEM and SecP384r1MLKEM1024, and leaves the classical curves for those that do not yet support post-quantum cryptography (PQC):

*X25519MLKEM768:SecP256r1MLKEM768:MLKEM768/SecP384r1MLKEM1024:MLKEM1024/*secp256r1:secp384r1

Note · what the guidance does not yet cover

Only the key exchange is post-quantum. The IETF has not yet standardised post-quantum authentication in TLS, so certificates remain ECDSA or RSA. The NCSC asks organisations not to issue them with a validity beyond the date by which they expect to complete their migration, and says it will add authentication once there are standards and mature implementations.

What changes for decision-makers

The most practical consequence is that TLS 1.2 is left out. According to the guidance, TLS 1.3 is the only version that will receive new features such as PQC, and TLS 1.2 will only get critical patches. Anyone still on TLS 1.2 needs to plan the upgrade, and the NCSC suggests doing both things in a single project: adopting TLS 1.3 and enabling the post-quantum algorithms at the same time. TLS 1.0, 1.1 and every version of SSL should be disabled.

The timetable is the one the NCSC had already set out in its migration timelines guidance: an inventory and a plan by 2028, priority migrations by 2031 and full migration by 2035. The agency says that, for many organisations, protecting data in transit will be one of those 2031 priorities. In the coming months it also plans to update its IPsec guidance.

The recommendation to combine classical and post-quantum algorithms matches that of the German guidance we have covered. For certificates, the IETF has already approved a hybrid version of ML-KEM, but it is for encryption, not for signing: authentication is still pending.

Keep reading

Share