Code Lab (runnable)

Copy-paste PQC recipes you can run today. The OpenSSL examples below were executed on OpenSSL 3.6.1 (native ML-KEM / ML-DSA / SLH-DSA, available since 3.5) and the outputs shown are the real results — note how the sizes match the FIPS parameter sets documented elsewhere on this site.

0. Confirm PQC support

openssl version
openssl list -public-key-algorithms | grep -Ei 'ML-DSA|SLH-DSA|ML-KEM'
openssl list -kem-algorithms | grep -i mlkem
openssl list -signature-algorithms | grep -Ei 'ML-DSA|SLH-DSA'

OpenSSL 3.6.1 27 Jan 2026
  { ... id-alg-ml-kem-768, ML-KEM-768, MLKEM768 } @ default
  X25519MLKEM768 @ default          # hybrid group used by TLS 1.3
  { ... id-ml-dsa-65, ML-DSA-65, MLDSA65 } @ default
  { ... id-slh-dsa-sha2-128s, SLH-DSA-SHA2-128s } @ default

Different distributions, providers, and builds may display different aliases; rely on your own openssl list output as the source of truth.

1. ML-KEM-768 — key encapsulation

Establish a shared secret the post-quantum way: the recipient publishes an encapsulation key; the sender encapsulates a fresh 32-byte secret to it; the recipient decapsulates the same secret.

# recipient: keypair
openssl genpkey -algorithm ML-KEM-768 -out mlkem.key
openssl pkey -in mlkem.key -pubout -out mlkem.pub

# sender: encapsulate a shared secret to the public key
openssl pkeyutl -encap -inkey mlkem.pub -pubin -out ct.bin -secret ss_sender.bin

# recipient: decapsulate to recover the same secret
openssl pkeyutl -decap -inkey mlkem.key -in ct.bin -secret ss_recv.bin
cmp -s ss_sender.bin ss_recv.bin && echo "shared secrets MATCH"

ciphertext: 1088 bytes,  shared secret: 32 bytes
shared secrets MATCH        # ML-KEM-768 sizes per FIPS 203

2. ML-DSA-65 — sign & verify

openssl genpkey -algorithm ML-DSA-65 -out mldsa.key
openssl pkey -in mldsa.key -pubout -out mldsa.pub
echo "hello pqc world" > msg.txt
openssl pkeyutl -sign   -inkey mldsa.key -rawin -in msg.txt -out msg.sig
openssl pkeyutl -verify -pubin -inkey mldsa.pub -rawin -in msg.txt -sigfile msg.sig

3309 byte signature        # ML-DSA-65 per FIPS 204
Signature Verified Successfully

3. SLH-DSA — the conservative, large-signature option

openssl genpkey -algorithm SLH-DSA-SHA2-128s -out slh.key
echo hi > m.txt
openssl pkeyutl -sign -inkey slh.key -rawin -in m.txt -out slh.sig
wc -c slh.sig

7856 slh.sig               # SLH-DSA-128s signature per FIPS 205 — ~2.4x larger than ML-DSA-65 at this parameter set; other SLH-DSA parameter sets can be far larger,
                           # and signing is much slower. Use where hash-only assurance matters most.

4. Hybrid TLS 1.3 in the wild

Force the post-quantum hybrid group and confirm a real server negotiates it (Cloudflare supports it):

echo | openssl s_client -groups X25519MLKEM768 -connect cloudflare.com:443 \
  -servername cloudflare.com 2>/dev/null | grep -iE 'Negotiated TLS1.3 group|Protocol'

Negotiated TLS1.3 group: X25519MLKEM768
Protocol: TLSv1.3

Support status at real public endpoints varies with server configuration and middleboxes; a failed negotiation does not necessarily mean OpenSSL lacks support — the site may simply not offer that group, or a downgrading/intercepting device may sit on the path.

To inventory your own endpoints, use scan-tls.sh from the Discovery page.

5. A self-signed ML-DSA certificate

openssl req -x509 -new -newkey ML-DSA-65 -keyout ca.key -out ca.crt \
  -days 365 -nodes -subj "/CN=pqc-demo"
openssl x509 -in ca.crt -noout -text | grep -i 'Signature Algorithm' | head -1

Signature Algorithm: ML-DSA-65

This certificate is fine for local experiments; many clients, proxies, load balancers, and certificate-handling tools may still not accept an ML-DSA certificate chain. Test end-to-end before production.

6. liboqs (Python) — algorithm-level API

For experimenting across the full algorithm set (including HQC, Falcon, McEliece) the Open Quantum Safe binding is convenient. How liboqs-python installs varies by platform and version; if the pip install fails, follow the current liboqs-python README. Some environments need CMake, a compiler, and the liboqs C library installed first. The pip command below is just one possible install path, shown for illustration.

pip install liboqs-python

import oqs

with oqs.KeyEncapsulation("ML-KEM-768") as kem:
    pk = kem.generate_keypair()
    ct, ss_sender = kem.encap_secret(pk)
    ss_recv = kem.decap_secret(ct)
    assert ss_sender == ss_recv

with oqs.Signature("ML-DSA-65") as sig:
    pk = sig.generate_keypair()
    s = sig.sign(b"hello pqc world")
    assert sig.verify(b"hello pqc world", s, pk)

print(oqs.get_enabled_kem_mechanisms()[:5])
print(oqs.get_enabled_sig_mechanisms()[:5])

Standards & references

• OpenSSL — 3.5+ ships native ML-KEM/ML-DSA/SLH-DSA; see OpenSSL Provider.
• Open Quantum Safe — liboqs & bindings; see liboqs.
• Sizes verified here match FIPS 203 / 204 / 205; full table in Comparison.
• Resources — full standards register