About Post-Quantum Cryptography

Ansible Automation Platform 2.7 supports Post-Quantum Cryptography (PQC) to future-proof your automation infrastructure against emerging quantum computing threats.

AAP leverages PQC capabilities from underlying RHEL platforms, providing an opt-in model that maintains backward compatibility with existing RSA/ECDSA configurations.

Important: PQC in AAP is strictly additive and requires explicit customer action to activate. Existing deployments continue to function unchanged unless you explicitly enable PQC features.

Post-Quantum Cryptography refers to cryptographic algorithms designed to resist attacks from quantum computers. As quantum computing advances, traditional RSA and ECDSA algorithms may become vulnerable. PQC algorithms, particularly ML-DSA (Module-Lattice Digital Signature Algorithm) and ML-KEM (Module-Lattice Key Encapsulation Mechanism), provide quantum-resistant protection.

What is supported in this release
Copy link

Feature Support Status
Containerized AAP 2.7 on RHEL 9.7+ ✓ Supported
PQC TLS (customer to gateway) ✓ Supported (Path A and Path B)
PQC SSH (control plane to managed nodes on RHEL 9.8+) ✓ Supported
Opt-in activation model ✓ Supported
Backward compatibility with RSA/ECDSA ✓ Supported

What is not supported
Copy link

The following features are not supported for this PQC release. See Releated Links for more information.

  • Ansible Automation Platform on OpenShift Container Platform (OCP)
  • Internal Envoy mesh/mTLS connections
  • Receptor mesh peer connections
  • Inbound Event-Driven Ansible (EDA) rulebook activations
  • Collections and content
  • Content signing with PQC algorithms
  • PQC enforcement (mandatory PQC mode)
  • Strict TLS 1.3-only enforcement
  • JWT with PQC algorithms (pending IETF standardization)
  • AAP upgrade and migration paths for PQC deployments
  • SaaS deployments
  • PQC-capable PostgreSQL (customer must provide)

Prerequisites
Copy link

Platform Requirements

  • Platform hosts: Red Hat Enterprise Linux 9.7 or later
    • Required for OpenSSL 3.5 and DEFAULT:PQ crypto policy support
  • Managed nodes (for PQC SSH): Red Hat Enterprise Linux 9.8 or later

External Dependencies

  • PostgreSQL: Ansible Automation Platform does not provide PQC-capable PostgreSQL in this initial release.
    • Customers must provide their own PQC-capable PostgreSQL instance if required.