MITRE Reports Post-Quantum Signature Gaps Ahead of Federal Deadline

General-release support for post-quantum key establishment has reached five of six applicable technology categories, compared with two of eight for digital signatures, according to MITRE’s September report. The assessment uses evidence collected in July 2026.

The Post-Quantum Cryptography Coalition released MITRE’s PQC Capability Development Report, which rates the post-quantum readiness of eight categories of enterprise technology using public evidence collected in July 2026. None of the assessed categories reached Validated Integration, MITRE’s highest rating. The researchers also found no evidence of commercially available post-quantum hardware Trusted Platform Modules (TPMs) as of July 2026.

The timing matters for federal buyers. Civilian agencies must submit migration plans to the Office of Management and Budget (OMB) and the Office of the National Cyber Director (ONCD) by Oct. 22 under memorandum M-26-15, and each PQC migration plan must cover third-party coordination and hardware refresh schedules.

How MITRE Rated Eight Enterprise Technologies

MITRE scored each technology on two tracks. The confidentiality track measures support for post-quantum mechanisms that protect data secrecy, including key establishment for encrypted communications and key management for data at rest. The authentication track covers post-quantum digital signatures, which verify identity and integrity.

Each track runs from Blocked, where no standards exist, to Validated Integration. That top level requires a general-release product that performs its post-quantum functions through a FIPS 140-3 validated module.

Source: MITRE, PQC Capability Development Report, September 2026. Evidence collected July 2026.

MITRE assigned each category the highest level it found from any source. The report states that it relied on vendor claims and does not independently evaluate product security.

Signatures Trail Key Exchange Across Enterprise Products

The ratings split along the two tracks:

Key establishment: Five categories reached Integration: browsers, web servers, VPNs, public key infrastructure/certificate authority (PKI/CA) management, and cloud connectivity. Implementations vary: browsers and web servers commonly use hybrid X25519MLKEM768, while PKI/CA support includes issuing and managing certificates containing ML-KEM keys. Volume encryption is the only applicable category below Integration.

Signature issuance: Private CA products from Keyfactor, Microsoft, and DigiCert issue ML-DSA certificates, which puts PKI/CA management at general release on both tracks.

Signature verification: MITRE found no browser support for validating X.509 certificates signed with post-quantum algorithms. Web servers support post-quantum authentication only through custom builds.

Hardware roots of trust: ML-DSA is available in firmware-based TPMs, but MITRE found no post-quantum hardware TPM on sale as of July.

The gap matters because the federal deadlines for the two tracks sit a year apart. The June quantum executive orders give high-value federal systems until Dec. 31, 2030, for post-quantum key establishment and until Dec. 31, 2031, for signatures.

What eWeek Found: Validated Modules Are the Missing Link

For enterprise buyers, the key question is whether a product’s post-quantum signature support works with their existing systems and uses a module validated for those functions. Procurement teams should request the supported product version, relevant validation certificate, and evidence that the required operations run in the validated configuration.

NIST’s CMVP certificate #5523 lists a validated software module with approved ML-KEM and ML-DSA functions. That does not establish whether a particular enterprise product uses those functions in its validated configuration.

That distinction carries weight for federal buyers, who depend on FIPS 140-3 validated cryptography. A product that ships ML-DSA and a product that runs ML-DSA through a validated module are different purchases, and only the second reaches the top of MITRE’s scale.

The rating method also deserves a close reading. MITRE scored each category by its most advanced vendor, so one general release can lift an entire category to Integration. That is the supply-side mirror of the GAO audit of 24 federal agencies, which found only one agency had fully completed its inventory of priority systems during an audit completed in September 2025. A category rating shows that a capability exists on the market. An organization’s own post-quantum readiness still depends on whether it runs that version with the feature turned on.

Hardware refresh planning is another pressure point. M-26-15 requires agencies to incorporate PQC upgrades into hardware refresh schedules and separately calls for device attestation to migrate to post-quantum algorithms. MITRE’s July findings make current availability, upgrade support, and device service life important procurement questions, which is why hardware marketed as quantum-ready still needs verification.

A future MITRE update could show whether any signature category has reached Validated Integration. Another checkpoint is Dec. 19, 2026, the executive order’s deadline for NIST to revise its module-validation processes to accelerate validations. Buyers should track those developments alongside evidence that their own products and configurations meet migration requirements.

Read more: Google Cloud’s 2029 quantum-security roadmap explains why provider upgrades still leave enterprises with applications, certificates, and configurations to migrate.