Post-Quantum · Palo Alto Networks IT-Infra

Quantum-safe from handshake to tunnel

This server is protected end to end with NIST post-quantum cryptography: an ML-DSA-44 certificate, hybrid ML-KEM key exchange over TLS 1.3, and an IPsec tunnel using ML-KEM and FrodoKEM key exchange rounds.

See your connection Crypto stack
Autoplays muted · click for sound

The crypto stack

Every layer between FC-HQ and this server uses quantum-resistant algorithms.

K

TLS 1.3 + ML-KEM key exchange

TLS 1.3 only, with hybrid ML-KEM (FIPS 203) + X25519 key agreement. The shared secret is quantum-safe, and traffic is encrypted with AES-256-GCM with forward secrecy for every session.

X25519MLKEM768 TLS_AES_256_GCM_SHA384
S

ML-DSA certificate

Server identity signed with the lattice-based Module-Lattice Digital Signature Algorithm (FIPS 204), issued by the ML-DSA-44 Root CA.

mldsa44
V

PQC IPsec tunnel

IKEv2 with three additional key exchange rounds (RFC 9370) between PAN-VM-FW and FC-HQ-FW1-5440.

ML-KEM-1024 · ML-KEM-768 · FrodoKEM-976

Your connection, right now

Rendered live by the server for this request.

https on
protocol (none)
cipher (none)
server time Thursday, 05-Nov-2026 02:38:59 UTC
user agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
# verify the PQC handshake yourself (OpenSSL 3.5+)
$ openssl s_client -connect test-pqc.paloaltonetworks.local:443 \
  -groups X25519MLKEM768 -CAfile PQC_CA.crt </dev/null \
  | grep -E "group|signature type|Verify"

Negotiated TLS1.3 group: X25519MLKEM768
Peer signature type: mldsa44
Verify return code: 0 (ok)

Path

FC-HQ to GCP over the post-quantum IPsec tunnel.

User laptopFC-HQ client
LAN
FC-HQ-FW1-5440PAN-OS HW
IPsec tunnelIKEv2 · ML-KEM-1024
ML-KEM-768 · FrodoKEM-976
PAN-VM-FWPAN-OS VM
TLS 1.3 · ML-KEM + ML-DSA
Web server10.98.233.70