TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESS
Britain's National Cyber Security Centre (NCSC) published recommended post-quantum settings for TLS Thursday and told organizations still running TLS 1.2 or older to move to TLS 1.3 as soon as possible. TLS, short for Transport Layer Security, is the protocol that encrypts most traffic between browsers, apps and servers. The update turns a long-range migration into settings security teams can switch on now, and it marks TLS 1.2-only systems as a dead end.
What Happened
The NCSC announced the change in a blog post by its principal technical director for cryptography and high-threat technologies. It follows the Internet Engineering Task Force's publication of RFC 10024, the standard for combining post-quantum and traditional key agreement in TLS 1.3.
The revised guidance, "Using TLS to Protect Data," now at version 1.2, recommends three "hybrid" key-exchange options: X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024. Key exchange is the step in which two machines agree on a secret key for a session. A hybrid scheme pairs ML-KEM, a post-quantum algorithm, with a traditional elliptic-curve method. The NCSC calls hybrids an interim measure during migration and also accepts pure ML-KEM options, which it says several major libraries already offer.
RelatedThe guidance includes ready-made profiles and a recommended OpenSSL configuration string for servers, and it advises keeping traditional key exchange enabled for compatibility. The NCSC says the settings suit general use and the protection of government information classified OFFICIAL.
Why It Matters
The guidance says a cryptographically relevant quantum computer would threaten the key exchange and signature algorithms TLS uses today. Because key exchange protects data in transit, encrypted traffic recorded now could become readable later unless the exchange is upgraded.
The version point is the one that will land on IT budgets. Only TLS 1.3 can provide quantum resistance, and it is the only version that will get new features. TLS 1.2 remains strong against conventional attacks with the recommended settings but will receive only critical security fixes. TLS 1.0, TLS 1.1 and all versions of SSL, its predecessor, must be disabled.
The NCSC ties the update to its migration timeline, which asks organizations to finish their highest-priority post-quantum work by 2031. It says protecting data in transit is high priority for many organizations and urges them to start now. Boards should expect older applications, embedded devices and third-party services that cannot speak TLS 1.3 to surface as migration and procurement problems.
Authentication Stays Traditional
Post-quantum key exchange does not finish the job. Standards for post-quantum authentication, which proves a server is who it claims to be, are still being developed for TLS and the public web's certificate system. Until they are final, the NCSC recommends ECDSA certificates on the P-256 curve or 2048-bit RSA. It also advises against certificates whose validity runs past the date an organization expects to finish moving away from traditional cryptography. Certificate lifetimes are already shrinking across the web: Let's Encrypt plans to cut its default from 90 days to 64 in February.
What to Watch
The NCSC says updated IPsec guidance, covering the protocol behind many virtual private networks, will follow as its standards are finalized in the coming months, along with post-quantum authentication recommendations for TLS. In the U.S., federal agencies' post-quantum migration plans are due by the end of October, and watch for U.S. agencies to issue comparable configuration guidance.
