(Post-Quantum) Cryptographic Right Answers

In 2009, Colin Percival initiated the tradition of providing "Cryptographic Right Answers" for developers. This practice continued with Thomas Ptacek in 2015 and Latacora in 2018 and 2024. Recently, the timeline for transitioning to post-quantum cryptography shifted dramatically in early 2026, resulting in consensus that the transition must be completed by 2029. While symmetric cryptography is expected to remain unaffected, there have been significant changes to the asymmetric answers since 2018 and even more since 2024.

The primary recommendation is to avoid using unauthenticated modes like CBC, CTR, or raw stream ciphers. Instead, use AEAD (Authenticated Encryption with Associated Data) such as XAES-256-GCM or XChaCha20Poly1305 with random nonces of at least 128 bits. For large messages, employ STREAM (a method that uses AEADs on a stream), and Cobblestone-128 is a recommended choice due to its efficient composition and availability in multiple programming languages.

Key management systems (KMS) remain a solid choice for encryption, but locally, specifically use AEADs like XAES-256-GCM or XChaCha20Poly1305. AES-GCM or ChaCha20Poly1305 with random nonces can also be used for locally encrypted data. Regardless of the chosen encryption method, it is crucial to handle large messages correctly and to use constant-time functions for tag comparisons.