How do I find which connections already use hybrid key exchange?

Look at the key-exchange group chosen in each TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake: X25519MLKEM768 means hybrid post-quantum; X25519, secp256r1 or an RSA key exchange mean classical only. For a single server you can test from outside: OpenSSL 3.5 and later, and tools built on it such as curl, can offer the hybrid group and show what the server chooses, and some online TLS checkers report it. Browser developer tools also show the negotiated group for a site you visit. For the whole network a one-off test is not enough, because what matters is what really happens between your clients and servers every day: old clients, appliances and internal applications often fall back to classical groups. NQCI, in preview, shows this per connection on monitored traffic. It is visible on every plan and active from the Pro plan, with the packet-capture sensor switched on for a Linux agent or a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor, because the basic macOS mode does not see handshakes. The result shows where updates have already done the migration and where it is still to do.

← All 33 questions on Post-quantum cryptographyAll topics