Post-quantum cryptography migration

Current PQC posture

DarkCoders CISO platform is PQC-ready as of Z.296:

• All TLS endpoints support Kyber768 + X25519 hybrid key exchange (NIST FIPS 203)
• All audit chain signatures use ML-DSA (Dilithium3, NIST FIPS 204)
• Vault uses Kyber for transit encryption (hybrid mode)
• mTLS between droplets uses hybrid CA chains

Migration timeline

Phase	Status
Z.296 hybrid key exchange	Live
Customer-facing PQC option	Live (default)
Pure PQC (no classical fallback)	2027 Q1
HQC additional KEM	2027 Q4

How to verify

openssl s_client -connect api.darkcoders.io:443 -groups X25519MLKEM768

Look for: Negotiated TLS 1.3 cipher suite + group X25519MLKEM768

Customer migration

No action needed - all new sessions negotiate hybrid by default.