OpenPGP and post-quantum cryptography

Short answer: RFC 9980, a Proposed Standard published by the IETF and last updated on 30 June 2026, defines a post-quantum public key algorithm extension for OpenPGP. It specifies composite public key encryption based on ML-KEM and composite signatures based on ML-DSA, both combined with elliptic curve cryptography, and SLH-DSA as a standalone signature scheme. It is a protocol specification and says nothing about which OpenPGP software supports it.

The problem it addresses

The RFC's introduction says OpenPGP supports various traditional public key algorithms based on the factoring or discrete logarithm problem. It says the security of algorithms based on those problems is endangered by the advent of quantum computers, so there is a need to extend OpenPGP with algorithms that remain secure in the presence of a cryptographically relevant quantum computer (CRQC), meaning a quantum computer with sufficient capacity to break traditional public key cryptography. The abstract describes the CRQC as a generally assumed threat, and says the extension provides a basis for long-term secure OpenPGP signatures and ciphertexts.

What it defines

According to the abstract, the document extends RFC 9580 and defines:

• composite public key encryption based on ML-KEM (formerly CRYSTALS-Kyber), combined with elliptic curve cryptography;
• composite public key signatures based on ML-DSA (formerly CRYSTALS-Dilithium), combined with elliptic curve cryptography;
• SLH-DSA (formerly SPHINCS+) as a standalone public key signature scheme.

The draft's table of contents shows sections on ECDH KEMs, ML-KEM, composite encryption schemes with ML-KEM, a key combiner, key generation, encryption and decryption procedures, and packet specifications.

Where the algorithms come from

The earlier drafts say the algorithms were chosen for standardization by NIST in mid-2022 as the result of the NIST Post-Quantum Cryptography Standardization process begun in 2016. They identify ML-KEM as a key encapsulation mechanism, a modern building block for public key encryption, and ML-DSA and SLH-DSA as signature schemes, referring to FIPS 203, 204 and 205. FIPS 203, 204 and 205 were approved on 13 August 2024.

Draft history

The document began as draft-ietf-openpgp-pqc, an IETF working group draft, and was published as RFC 9980 with the status Proposed Standard. The sources show drafts numbered 08 and 17 along the way. A Proposed Standard is a stage on the IETF standards track, not a statement about adoption.

Who wrote it

The RFC page lists four authors and describes the document as part of the IETF stream, produced by the OpenPGP working group. Its page also offers the text in several formats and links to mailing list discussion.

What this does not tell you

This article summarises the RFC abstract, introduction and part of the draft's contents. It does not describe the packet formats or key combiner in detail, and it does not report which OpenPGP implementations support the extension. Read the RFC itself before implementing.

FAQ

What is RFC 9980?

A Proposed Standard from the IETF that defines a post-quantum public key algorithm extension for OpenPGP, extending RFC 9580.

Which algorithms does it use?

ML-KEM and ML-DSA, each combined with elliptic curve cryptography, plus SLH-DSA as a standalone signature scheme.

What is a CRQC?

A cryptographically relevant quantum computer: one with sufficient capacity to break traditional public key cryptography, per the RFC.

Why combine post-quantum and elliptic curve algorithms?

The abstract describes the encryption and ML-DSA signatures as composite, in combination with elliptic curve cryptography. It does not give a rationale in the text we read.

Do OpenPGP tools support it yet?

These sources do not say.