本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

(Post-Quantum) Cryptographic Right Answers

12 Oct 2026 (Post-Quantum) Cryptographic Right Answers Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. It might feel too soon for an update, but so much has changed. The timeline of the post-quantum transition dramatically shifted in early 2026, and there is now consensus that it needs to complete by 2029. 2029! We have three years!

2026年10月12日（后量子）密码学正确答案。为开发者发布“密码学正确答案”现已成为一种传统。Colin Percival 于 2009 年开启了这一先河，Thomas Ptacek 在 2015 年跟进，随后 Latacora 在 2018 年和 2024 年继续传承。虽然现在更新可能感觉为时过早，但情况已经发生了巨大变化。后量子过渡的时间表在 2026 年初发生了剧烈变动，目前各方已达成共识，必须在 2029 年前完成过渡。2029 年！我们只有三年时间了！

The good news is that, despite what you might have heard, symmetric cryptography is going to be fine, because Grover does not matter. The bad news is that all asymmetric answers changed compared to 2018 and most even compared to 2024. The answers below assume you are not constrained by any specific compliance regime, although they are mostly compatible with FIPS 140. If you need to follow something stricter like CNSA 2.0, you’ll know. Just substitute as appropriate.

好消息是，尽管你可能听过一些传言，但对称密码学不会受到影响，因为 Grover 算法并不构成威胁。坏消息是，所有非对称密码学的答案与 2018 年相比都发生了变化，大多数甚至与 2024 年相比也已不同。以下答案假设你未受到任何特定合规制度的约束，尽管它们大多与 FIPS 140 兼容。如果你需要遵循更严格的标准（如 CNSA 2.0），你应该会知晓。只需根据需要进行替换即可。

Finally, remember the other big change of 2026: LLMs are very good at finding bugs now. “Get a review from the best model you can afford” is now firmly a Cryptographic Right Answer, along with the long-time classic “use a memory-safe language.” If you’re in a rush, here’s the cheat sheet: Encrypting data: If you’re in the cloud, KMS. Otherwise, XAES-256-GCM or XChaCha20Poly1305 with random nonces. If you’re encrypting more than a few MB, use Cobblestone-128.

最后，请记住 2026 年的另一个重大变化：大语言模型（LLM）现在非常擅长发现漏洞。“从你能负担得起的最佳模型中获取审查”现在已稳固地成为“密码学正确答案”之一，与长期以来的经典建议“使用内存安全语言”并列。如果你时间紧迫，这里是速查表：数据加密：如果在云端，使用 KMS。否则，使用带有随机随机数（nonce）的 XAES-256-GCM 或 XChaCha20Poly1305。如果加密数据超过几 MB，请使用 Cobblestone-128。

Symmetric key length: Don’t stress it. 256-bit keys if you need to pick. Symmetric “signatures”: HMAC-SHA-256. Hash algorithm: SHA-2 is still fine, but use a real multihash (SequenceHash) if needed. Random IDs: 32 random bytes, a.k.a. 256-bit random numbers. Password handling: Argon2id or scrypt. But have you considered passkeys instead? Key exchange: X25519+ML-KEM-768 in a secure, standard protocol. Asymmetric encryption: HPKE with (MLKEM768-X25519 a.k.a. X-Wing, HKDF-SHA256, AES-128-GCM), or age with PQ keys.

对称密钥长度：不必纠结。如果需要选择，使用 256 位密钥。对称“签名”：HMAC-SHA-256。哈希算法：SHA-2 仍然适用，但如果需要，请使用真正的多重哈希（SequenceHash）。随机 ID：32 个随机字节，即 256 位随机数。密码处理：Argon2id 或 scrypt。但你是否考虑过改用通行密钥（passkeys）？密钥交换：在安全、标准的协议中使用 X25519+ML-KEM-768。非对称加密：使用 HPKE（配合 MLKEM768-X25519 即 X-Wing、HKDF-SHA256、AES-128-GCM）或带有 PQ 密钥的 age。

Asymmetric signatures: ML-DSA-44. Website or client-server application security: If you’re in the cloud, use its ALB/NLB. Otherwise, rustls, Go’s crypto/tls, BoringSSL, AWS-LC, or s2n-tls with a popular, updated ACME client. Online backups: restic with a long random password. Now let’s dive in. Encrypting data If you’re in the cloud, KMS. Otherwise, XAES-256-GCM or XChaCha20Poly1305 with random nonces. If you’re encrypting more than a few MB, use Cobblestone-128.

非对称签名：ML-DSA-44。网站或客户端-服务器应用程序安全：如果在云端，使用其 ALB/NLB。否则，使用 rustls、Go 的 crypto/tls、BoringSSL、AWS-LC 或 s2n-tls，并配合一个流行且已更新的 ACME 客户端。在线备份：使用带有长随机密码的 restic。现在让我们深入探讨。数据加密：如果在云端，使用 KMS。否则，使用带有随机随机数的 XAES-256-GCM 或 XChaCha20Poly1305。如果加密数据超过几 MB，请使用 Cobblestone-128。