Top News
PQC – OpenPGP Standard Published as RFC 9980
Joint draft by MTG AG, BSI, and Proton AG for the future-proof securing of e-mail communication is now finalized and standardized in the IETF as RFC 9980 – Post-Quantum Cryptography in OpenPGP.
In a joint project, MTG AG, the Federal Office for Information Security (BSI), and Proton AG have developed a standard for securing the popular OpenPGP protocol using Post-Quantum Cryptography (PQC). The first version was published as an Internet Draft in December 2022, and the final version completed the publication process at the Internet Engineering Task Force (IETF) at the end of June 2026. The IETF is an international body that defines standards for the Internet; the standards for TCP/IP, TLS, and OpenPGP, among many others, originate from the IETF.
With the publication of RFC 9980, we have reached the milestone we set out for back in 2022. We hope there will be wide adoption in OpenPGP tools and E-Mail clients soon, so that users worldwide will be able to protect their data at rest and e-mail communication against attacks from future quantum computers.
Dr. Falko Strenzke, Project manager at MTG AG and one of the authors of the RFC.
What is RFC 9980?
RFC 9980 is an extension to RFC 9580, the current OpenPGP standard, which already modernized the protocol's cryptographic design in 2024 and adopted many best practices that have evolved in the cryptography community since the previous OpenPGP standard. Together, the two RFCs give OpenPGP a strong cryptographic foundation for the future: a modern baseline (RFC 9580) plus a defined path to quantum resistance (RFC 9980).
How does post-quantum OpenPGP work?
RFC 9980 defines new public-key algorithms for OpenPGP, combining post-quantum schemes with established elliptic-curve cryptography (ECC) in what's called a PQ/T hybrid (post-quantum/traditional) or composite construction. This means encryption or signatures are only broken if both the post-quantum and the classical component become vulnerable — giving a safety net during the transition to quantum-safe cryptography, without giving up the decades of scrutiny that classical algorithms have received.
Specifically, RFC 9980 introduces:
- Composite public-key encryption based on ML-KEM (formerly known as CRYSTALS-Kyber), combined with X25519 or X448
- Composite digital signatures based on ML-DSA (formerly CRYSTALS-Dilithium), combined with Ed25519 or Ed448
- SLH-DSA (formerly SPHINCS+) as a standalone, hash-based signature scheme, for use cases that call for a conservative, non-composite option
Why OpenPGP needs quantum-safe cryptography now
A cryptographically relevant quantum computer doesn't need to exist today for OpenPGP-encrypted data to be at risk. Encrypted e-mails, backups, and files captured today can be stored and decrypted later, once quantum computers become powerful enough — an attack pattern commonly known as "harvest now, decrypt later." For anything that needs to stay confidential for years, migrating to quantum-safe cryptography is a task for today, not for when quantum computers arrive.
What this means for Thunderbird, Linux, and Git
OpenPGP is best known for securing e-mail communication, but its role in modern IT infrastructure goes well beyond that. OpenPGP is also commonly used to sign Linux packages, secure files and backups, and sign Git commits — all of which benefit from the quantum-safe algorithms now standardized in RFC 9980.
The standard was created as part of the "Integration of Post-Quantum Cryptography in the Thunderbird e-mail client" project, funded by the Federal Office for Information Security (BSI), which aims to bring post-quantum cryptography into the OpenPGP protocol. As implementations adopt RFC 9980, OpenPGP-based tools across the e-mail, Linux, and developer-tooling ecosystems will be able to offer quantum-resistant protection by default.