Enable Post‑Quantum Cryptography (PQC) Support in IBM MQ for TLS Communications

As quantum computing evolves, current public‑key cryptographic algorithms such as RSA and ECC face increasing vulnerability because quantum algorithms (e.g., Shor’s algorithm) can theoretically break these classical methods once sufficiently powerful quantum computers exist. IBM MQ today relies on standard TLS mechanisms that use these classical algorithms for key exchange and authentication. While IBM MQ supports strong symmetric cryptography (including modern AES and SHA‑2‑based CipherSpecs) and TLS 1.3, the product does not yet offer options to use quantum‑resistant (post‑quantum) key‑establishment methods.

IBM has already published quantum‑safety guidance indicating that symmetric algorithms (like AES‑256 and SHA‑384) are already resilient against quantum attacks, but asymmetric cryptography remains the main weakness in TLS handshakes. Other IBM security products have begun introducing or experimenting with post‑quantum or hybrid (classical + PQC) key‑agreement modes, demonstrating that IBM is moving in this direction.

Because IBM MQ is a mission‑critical transport layer for sensitive enterprise messaging data, it is strategically important that it, too, begins adopting post‑quantum‑ready mechanisms. Many industries — especially finance, government, and regulated sectors — are preparing for long‑term compliance and “store now, decrypt later” risk mitigation. Introducing PQC support early enables customers to plan their migration and modernization roadmaps.