The road to post-quantum cryptography (PQC) has been long, but the end is nigh.

For the past nine months we’ve been working on technical debt issues in hockeypuck, resulting in the 2.3.x series of releases. This has included a major postgres schema redesign, in-place reloading, reindexing threads, configurable keyword search, and significant refactoring of hockeypuck’s internals. v2.3.3 is in final testing with the last of these improvements, and will be released soon.

But this is all just prep.

The goal is version 2.4, which will distribute v6 PGP keys, which support post-quantum algorithms for both encryption and signing. 2026 is the year of PQC in PGP, and the hockeypuck keyservers will be ready.

To enable the safe distribution of v6/PQC keys without breaking legacy software, we have developed an updated version of the venerable HKP API (for which HocKeyPuck is named). v1 and v2 HKP will be supported in parallel, but v6/PQC keys will only be distributed over v2.

HKPv2 is specified in datatracker.ietf.org/doc/html/… and server implementation is underway in github.com/hockeypuck/hockeypu… .

If you maintain PGP client software and wish to be PQC ready, now is the time to check out HKPv2 and what it means for your users. Join the discussion at groups.google.com/g/hockeypuck…

Hockeypuck v2.4 development is kindly supported by @NGIZero Core.

#openpgp #pgp #gnupg #pqc