Cryptography in 2026: Moving from curves to lattices (and the engineering challenges)

The finalisation of FIPS 203 (ML-KEM) has triggered maybe the largest cryptographic migration in history. But for engineers, practitioners and researchers, the challenge isn't just the maths—it's the physical size of these keys. ML-KEM keys are orders of magnitude larger than the ECC keys we’ve spent a decade optimizing for. And not every sever understands them. So whats happening to address this?

Briefly introduced will be current cryptography such as TLS1.3, X25519 curve, use in modern day cryptography and then will progress to the "Harvest Now, Decrypt Later" threat model, and the need for PQC.

This session covers not only the why of PQC-based cryptographic schemes being necessary, but dives into the "cost" of ML-KEM. It will analyse the computational cost across server-class vs. ARM-Cortex-M hardware, and address the "Fragmentation Gap": why quantum-safe handshakes can cause packet drops and latency spikes in real-world networks. 

It will conclude with a look at the state-of-the-art in 2026, including hybrid key exchange patterns and the emerging side-channel vulnerabilities that software-only implementations must now defend against. The talk will also cover, that, despite the rigorous NIST standardisation process, the cryptographic community remains cautious about "Lattice Doubt"—the possibility that a breakthrough in classical mathematics could simplify the Shortest Vector Problem (SVP) that ML-KEM relies on. To mitigate this, state-of-the-art deployments do not use ML-KEM alone. Instead, they combine it with a classical scheme like X25519. The two keys are cryptographically combined (concatenated or hashed together) such that an attacker would have to break both the classical elliptic curve math and the new lattice math to decrypt the session.

This in turn means that each TLS handshake carries the weight of two public keys and two ciphertexts, pushing the total payload even further past the standard message limit. This creates a complex optimization problem for network architects: how to maintain a hybrid posture for maximum security without triggering the fragmentation issues and "first-byte latency" spikes that degrade the user experience.

The talk also covers the fact that some servers are not capable of understanding PQC-based algorithms, and the approach for this. Hybrid Deployment Patterns also allow servers to continue communication, by allowing us to offer 'Best Effort' quantum resistance. If both the client and server support ML-KEM, they use it; if the server is part of a legacy stack, the handshake automatically 'downgrades' to a classical-only exchange. This prevents a 'Security Denial of Service' where high-security requirements break connectivity for older, yet essential, business systems. 

The state-of-the-art approach in 2026 is 'Dual-Stack Cryptography': maintaining the classical standard for connectivity while layering ML-KEM on top for long-term data protection, ensuring no server is left behind during the migration.

The talk concludes with a look at the state-of-the-art in 2026, exploring side-channel vulnerabilities in software-only implementations, and a comparison of competing global quantum-safe schemes, and how they compare to Australia's PQC Roadmap.