Filling because I could not find any meta-issue about this
Google published a threat model for post-quantum cryptography with a 2029 migration deadline.
IIUC the near-term risk is store-now-decrypt-later (SNDL): adversaries capturing encrypted traffic today for future decryption. This makes upgrading connection-layer forward secrecy urgent even before quantum computers exist.
NIST has finalized three post-quantum standards relevant to Kubo dependencies (libp2p and IPNS):
| Algorithm |
Role |
Standard |
| ML-KEM |
Key encapsulation |
FIPS 203 |
| ML-DSA |
Digital signatures |
FIPS 204 |
| SLH-DSA |
Hash-based signatures |
FIPS 205 |
Multicodec code points for all three are registered or in review:
Ongoing spec and implementation discussions:
The goal is not to change the default key type away from Ed25519; that is a separate decision.
The goal is working, opt-in PQ support well ahead of any forced migration. Large public and private swarms need multi-year upgrade lead time before a new key type can be broadly relied upon. Starting late means the option to migrate gracefully disappears.
What needs to happen:
Kubo does not need to wait for libp2p to fix IPNS, we should decouple anyway.
Google published a threat model for post-quantum cryptography with a 2029 migration deadline.
IIUC the near-term risk is store-now-decrypt-later (SNDL): adversaries capturing encrypted traffic today for future decryption. This makes upgrading connection-layer forward secrecy urgent even before quantum computers exist.
NIST has finalized three post-quantum standards relevant to Kubo dependencies (libp2p and IPNS):
Multicodec code points for all three are registered or in review:
Ongoing spec and implementation discussions:
libp2p-keyand things that enable decoupling fromlibp2p-keyThe goal is not to change the default key type away from
Ed25519; that is a separate decision.The goal is working, opt-in PQ support well ahead of any forced migration. Large public and private swarms need multi-year upgrade lead time before a new key type can be broadly relied upon. Starting late means the option to migrate gracefully disappears.
What needs to happen:
go-libp2pipfs keycommandslibp2p-keyprotobuf wrapper?ctxboxo/gatewayandboxo/ipnsandboxo/namesysipfs namecommandsKubo does not need to wait for libp2p to fix IPNS, we should decouple anyway.