Future-Proofing the Internet: Akamai Achieves End-to-End PQC

The motivation for this transition is a clear and present danger known as “harvest now, decrypt later.”  Today, capable adversaries are collecting encrypted data with the intent to decrypt them once cryptographically relevant quantum computers become a reality.

Traditional asymmetric encryption, such as used by RSA and Elliptic-Curve Diffie–Hellman, is vulnerable to Shor’s algorithm, which could allow a quantum computer to factor large prime numbers exponentially faster than classical systems. While Q-Day — the point at which quantum computers can break these standards — may still be years away, any data with a long shelf life is at risk right now. By implementing PQC today, we ensure that the key exchanges that are protecting current sessions remain secure for decades to come.

Akamai has aligned with National Institute of Standards and Technology (NIST) and Internet Engineering Task Force (IETF) standards by deploying a hybrid post-quantum key agreement. Specifically, we use the X25519MLKEM768 hybrid mechanism as defined in this draft (which is in the IETF publishing preparation phase).

• Hybrid strength: This strength comes from a combination of the classical X25519 Elliptic Curve exchange with the NIST-standardized Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM).

• Backward compatibility: This approach ensures that clients or origins not yet capable of PQC can still negotiate a secure classical TLS 1.3 connection without interruption.

• FIPS compliance: By uplifting our infrastructure to the Federal Information Processing Standards (FIPS) 140-3 standard, we have enabled our mid-tier (G2G) traffic to be simultaneously FIPS-compliant and quantum-resistant.

Achieving end-to-end resistance required upgrading three distinct transport segments of the Akamai delivery path (Table).
 

_{The three distinct transport segments of the Akamai delivery path that were upgraded to achieve end-to-end resistance} 

While transport security is a massive win, we are not slowing down. Our roadmap for the remainder of 2026 and beyond includes:

• Post-quantum authentication: We are moving toward the next frontier: securing digital signatures. We are actively targeting ML-DSA and Merkel Tree Certificates to reduce certificate size while maintaining quantum resistance.

• A 2030 deadline: We are committed to ensuring that our platform is quantum safe as global regulatory expectations accelerate toward a 2030 deadline for quantum-safe signatures.

The transition to a quantum-safe internet is a marathon, not a sprint. We are proud to lead the industry in making these advanced protections a default reality for our enterprise, government, and financial sector customers.

For more information on how to enable PQC, please contact your Akamai account team or visit our technical documentation.  Also, be sure to check out the most recent blog post in our PQC series.

If you’ve missed any of our other technical deep dives or policy updates, we invite you to explore the journey toward quantum readiness through our full series of blog posts.

• Post-Quantum Cryptography Beyond TLS: Remain Quantum Safe (March 2, 2026)

• Digital Signatures: Traditional Vs. Post-Quantum Cryptographic Mechanisms (December 3, 2025)

• A Guide to International Post-Quantum Cryptography Standards (October 8, 2025)

• Akamai Enables Post-Quantum Cryptography on the Edge (September 3, 2025)

• Post-Quantum Cryptography Implementation Considerations in TLS (August 6, 2025)

• Building a Quantum-Safe Internet: The IETF’s Plan for TLS (June 18, 2025)

• Taking Steps to Prepare for Quantum Advantage (August 12, 2024)

• Akamai and the Adoption of Post-Quantum Cryptography (April 27, 2023)