Python Adds NIST‑Standard Post‑Quantum Encryption to the Core Cryptography Library
What Happened — The Python cryptography package (pyca/cryptography) now ships with ML‑KEM (key‑establishment) and ML‑DSA (digital‑signature), the NIST‑selected post‑quantum primitives. The addition was funded by the Sovereign Tech Agency and is available via a single pip install.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 requires encryption of data in transit and at rest; adopting post‑quantum algorithms helps maintain that control as quantum‑capable adversaries emerge.
- Continuous‑compliance programs must demonstrate “crypto‑agility” – the ability to replace algorithms without service disruption – and the new library provides a documented, auditable path.
- Mapping the new primitives to your control inventory creates fresh evidence for audit readiness, showing you’re using industry‑standard, vetted cryptography.
Who Is Affected — All technology‑focused organizations that develop or run Python‑based services, especially SaaS, cloud‑infra, fintech, and health‑tech firms.
Recommended Actions
- Review your encryption policy and add ML‑KEM/ML‑DSA to the approved‑algorithm list.
- Update key‑management procedures to include post‑quantum key sizes and rotation schedules.
- Capture implementation evidence (e.g., CI/CD logs, library version attestations) for SOC 2 audit artifacts.
Technical Notes — The library implements the NIST‑selected ML‑KEM (key‑establishment) and ML‑DSA (signature) algorithms, both designed to resist attacks from quantum computers. No CVEs are associated; this is a proactive hardening measure.
Source: Schneier on Security – Python now has a post‑quantum encryption library