France's ANSSI will stop certifying security products without post-quantum cryptography starting in 2027. The US White House issued Executive Order 14409 mandating PQC for all federal systems - key establishment by 2030 and digital signatures by 2031, affecting every federal contractor and vendor.
Context
psycopg2 delegates all TLS to libpq, which uses OpenSSL. When libpq is linked against OpenSSL 3.5+, hybrid post-quantum key exchange (X25519MLKEM768) works transparently — no psycopg2 code changes needed.
However, psycopg2 has:
- No documentation on PQC TLS for PostgreSQL connections
- No guidance on verifying PQC key exchange is active
- No tests validating PQC TLS behavior
Proposal
Add PQC TLS documentation covering:
- Prerequisites (OpenSSL 3.5+, PostgreSQL 18+ for
ssl_groups)
- How to verify PQC via
pg_stat_ssl
- Client-side
ssl_groups parameter forwarding
- Troubleshooting guide
Plus test infrastructure for PQC TLS validation.
References
France's ANSSI will stop certifying security products without post-quantum cryptography starting in 2027. The US White House issued Executive Order 14409 mandating PQC for all federal systems - key establishment by 2030 and digital signatures by 2031, affecting every federal contractor and vendor.
Context
psycopg2 delegates all TLS to libpq, which uses OpenSSL. When libpq is linked against OpenSSL 3.5+, hybrid post-quantum key exchange (
X25519MLKEM768) works transparently — no psycopg2 code changes needed.However, psycopg2 has:
Proposal
Add PQC TLS documentation covering:
ssl_groups)pg_stat_sslssl_groupsparameter forwardingPlus test infrastructure for PQC TLS validation.
References