Why a shared terminology for hybrid cryptography is essential for cybersecurity teams.
When a crypto crisis occurs – a compromised key, a protocol flaw, or an urgent migration — every minute counts. The issue is that among network, PKI, SOC, vendor, and integrator teams, terms like “hybrid,” “certificate,” or “authentication” often mean different things. People think they agree, but they’re actually describing different realities — and may end up deploying controls that don’t protect what they believe they do.
RFC 9794 provides exactly what’s missing in those moments: a shared and precise vocabulary to describe how to combine, during the post-quantum transition, classical and post-quantum algorithms in protocols such as TLS, IKEv2, and X.509. It’s a foundation for writing clear requirements, comparing designs, and verifying that the achieved level of security truly matches the intended one.
Why this framework matters for cybersecurity teams
RFC 9794 doesn’t define new algorithms; it standardizes how we talk about them. This common language helps:
• foster understanding between vendors, integrators, and SOCs during migrations;
• enable comparison between architectures;
• and verify actual security properties (confidentiality, authentication, interoperability).
This document extends the work of the U.S. NIST, which in 2024 selected the first post-quantum cryptography standards:
• ML-KEM (formerly Kyber) for key exchange;
• ML-DSA (formerly Dilithium) and SLH-DSA (formerly SPHINCS+) for digital signatures.
RFC 9794 complements these standards: NIST defines the cryptographic building blocks, while the IETF defines how to use and name them consistently across Internet protocols (TLS, IKEv2, X.509, etc.).
Understanding “hybrid” schemes without confusion
During the transition, moving directly from classical to post-quantum algorithms would be risky. The new algorithms, though promising, still need long-term validation. Hybrid PQ/T (Post-Quantum / Traditional) schemes combine both worlds: a session is only compromised if all components are broken.
Two approaches exist:
• Composite – multiple keys or signatures are grouped into a single object, so the protocol (e.g. TLS) changes little.
• Non-composite – algorithms are used separately, and the protocol explicitly manages multiple messages or fields.
Both aim to maintain service continuity during migration, while preparing a full switch to post-quantum cryptography.
PKI and hybrid certificates: key takeaways
A PKI (Public Key Infrastructure) issues, verifies, and revokes certificates that authenticate servers, users, and devices. In a hybrid world, a certificate chain may contain both classical and post-quantum keys.
But having a hybrid certificate doesn’t automatically ensure end-to-end hybrid authentication. It depends on how the trust chain is built and signed (dual signatures, parallel or mixed chains). This is a critical concern for teams managing internal certificate authorities and critical infrastructures.
A real and present threat: cryptographically relevant quantum computers
RFC 9794 uses the term CRQC (Cryptographically Relevant Quantum Computer) to describe a quantum computer powerful enough to break today’s asymmetric algorithms (RSA, ECDH, ECDSA).
Even though such machines don’t exist yet, their future emergence already endangers data encrypted today — an adversary can store it now and decrypt it later once quantum capabilities become available.
Hybrid schemes are therefore a necessary safeguard during this decade-long transition.
Recommendations and migration timeline
Technical authorities such as the UK NCSC and NIST recommend a planned, progressive migration structured around three major milestones.
By 2028, map all cryptography use and plan the migration. Inventory services that rely on RSA/ECC, identify long-lived data, and prepare PQC compatibility.
By 2031, deploy the first hybrid schemes (TLS, IKEv2, PKI). Integrate ML-KEM/ML-DSA, and test coexistence as well as protections against downgrade.
By 2035, complete the migration to post-quantum cryptography. Remove dependencies on RSA/ECDSA and switch PKIs and critical systems to PQC.
This timeline reflects the estimated time needed for standards, hardware (HSM, TPM, IoT), and software to reach maturity. Beyond 2035, maintaining hybrid systems brings little benefit: classical algorithms will be obsolete in the face of a Cryptographically Relevant Quantum Computer (CRQC), yet will continue to increase attack surface and operational complexity.
Source:
RFC 9794 – Terminology for Post-Quantum/Traditional Hybrid Schemes (IETF, June 2025).
Available at: https://www.rfc-editor.org/rfc/rfc9794.html
