Description
Over 35 countries want their vendors to be post-quantum ready by 2030. Large companies are trying to be PQC ready by 2029. This can be seen in blogs by:
Google: https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/#:~:text=Google%27s%20introducing,%28PQC%29%20migration
Microsoft: https://www.microsoft.com/en-us/security/blog/2026/06/30/microsoft-advances-quantum-safe-security-as-the-risk-timeline-shifts/
Cloudflare: https://blog.cloudflare.com/post-quantum-roadmap/
DigiCert: https://www.digicert.com/blog/digicert-post-quantum-infrastructure-migration-plan
In order for a company based on PHP to meet government requirements for post-quantum cryptography by 2030, PHP needs to have native support with enough time left over for developers to both perform a major PHP version upgrade and then also have time to write, test, and ship their PQC features on the new PHP version by 2030. Therefore, the work to add PQC support to PHP needs to start now.
Support for post-quantum cryptography (PQC) was added in OpenSSL 3.5: https://openssl.foundation/news/the-features-of-3-5-post-quantum-cryptography
A third-party vendor has developed PQC modules as an option: https://paragonie.com/blog/2026/04/post-quantum-cryptography-for-php-community . However, PHP should have native support for PQC for the same reasons that PHP already has support for traditional cryptography. The existing algorithms that PHP supports will be deprecated in 2030 and disallowed by governments by 2035.
There are more PQC algorithms in development and will likely be added to OpenSSL in the future. Therefore, it is recommended that PHP support for new PQC algorithms be added in a cryptographically agile way to streamline the addition of future algorithms.
Description
Over 35 countries want their vendors to be post-quantum ready by 2030. Large companies are trying to be PQC ready by 2029. This can be seen in blogs by:
Google: https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/#:~:text=Google%27s%20introducing,%28PQC%29%20migration
Microsoft: https://www.microsoft.com/en-us/security/blog/2026/06/30/microsoft-advances-quantum-safe-security-as-the-risk-timeline-shifts/
Cloudflare: https://blog.cloudflare.com/post-quantum-roadmap/
DigiCert: https://www.digicert.com/blog/digicert-post-quantum-infrastructure-migration-plan
In order for a company based on PHP to meet government requirements for post-quantum cryptography by 2030, PHP needs to have native support with enough time left over for developers to both perform a major PHP version upgrade and then also have time to write, test, and ship their PQC features on the new PHP version by 2030. Therefore, the work to add PQC support to PHP needs to start now.
Support for post-quantum cryptography (PQC) was added in OpenSSL 3.5: https://openssl.foundation/news/the-features-of-3-5-post-quantum-cryptography
A third-party vendor has developed PQC modules as an option: https://paragonie.com/blog/2026/04/post-quantum-cryptography-for-php-community . However, PHP should have native support for PQC for the same reasons that PHP already has support for traditional cryptography. The existing algorithms that PHP supports will be deprecated in 2030 and disallowed by governments by 2035.
There are more PQC algorithms in development and will likely be added to OpenSSL in the future. Therefore, it is recommended that PHP support for new PQC algorithms be added in a cryptographically agile way to streamline the addition of future algorithms.