Conversation

Notices

1. Embed this notice
   Soatok Dreamseeker (soatok@furry.engineer)'s status on Monday, 27-Apr-2026 03:44:46 JST Soatok Dreamseeker

   Post-quantum cryptography landed in PHP before GnuPG

   https://news.ycombinator.com/item?id=47907018

   • prettygood likes this.
   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Monday, 27-Apr-2026 09:51:45 JST Soatok Dreamseeker

     in reply to

     See also:

     https://github.com/soatok/age-php

   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Monday, 27-Apr-2026 11:11:01 JST Soatok Dreamseeker

     in reply to

     • Marcus Adams

     @gerowen

     It makes me wonder if GnuPG has died, or if they'll adopt PQ at all.

     Linked story title:

     GnuPG – post-quantum crypto landing in mainline

   • Embed this notice
     Marcus Adams (gerowen@mastodon.social)'s status on Monday, 27-Apr-2026 11:11:02 JST Marcus Adams

     in reply to

     @soatok It makes me wonder if GnuPG has died, or if they'll adopt PQ at all. The standards are there and have existed for quite a while now, and the way modern solutions like AGE implement it doesn't break the protections offered by the classical algorithms if the PQ ones are compromised later. And nobody is saying they have to drop support for RSA-2048 or whatever, just "add" support for the newer things, like they've done in the past.

   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Monday, 27-Apr-2026 21:30:07 JST Soatok Dreamseeker

     in reply to

     • Sebastian Bergmann :phpunit:

     @sebastian I'm not sure I have the answers, but I do have opinions.

     I would kickoff the RFC discussions now but target the November 2028 PHP version for any changes, personally. (Whether that's 8.7 or 9.0.)

     This would give distros a full year to vet the changes, and it could land in LTS releases for some distros by 2030.

     While 2030 for those distros wouldn't hit the 2029 aspiration that e.g. Google committed to, the PHP language would be ready ahead of some 2035 goals. And those distros could always make an exception to their usual policies for the sake of security, so this musing might be too pessimistic.

     The key/ciphertext/signature sizes are mostly an issue for network-level cryptography, while application-layer uses tend to be more tolerant.

   • Embed this notice
     Sebastian Bergmann :phpunit: (sebastian@phpc.social)'s status on Monday, 27-Apr-2026 21:30:09 JST Sebastian Bergmann :phpunit:

     in reply to

     @soatok I recently asked about PQC support in PHP on the internals mailinglist (https://externals.io/message/130673).

     Can you answer my questions? Thank you!