VPQ Audit · PQ Front Door Check · 10/09/2026
2/2 measurable endpoints completed a post-quantum handshake.
We offered the post-quantum key exchange X25519MLKEM768 to
we ran it against our own front door, then recorded what the server actually chose. Nothing inferred
from configuration, nothing scanned beyond the names given to us.
Authorisation for this measurement: atkvn.com and www.atkvn.com are ATK New Technology's own domains. Nguyen Xuan Dong authorised this measurement and its publication, 10 September 2026.
Endpoint by endpoint
| endpoint | key exchange | what the server answered |
|---|
| atkvn.com:443 | X25519MLKEM768 | we offered post-quantum hybrid, the server ACCEPTED |
| www.atkvn.com:443 | X25519MLKEM768 | we offered post-quantum hybrid, the server ACCEPTED |
Where we stand against the published sample
100%
In Crypto Reality Index Vol.1 we measured 45 public endpoints:
21 accepted post-quantum hybrid, 20 returned classical ECDHE,
4 could not be measured. That sample sits at 51%
(21/41, the same convention as your own ratio: the four unmeasurable ones
count on neither side). We are at 100%, which is above the sample.
By sector: internet infrastructure 67%, security vendors 50%,
financial institutions 33%.
What this measurement does NOT tell you. We would rather write it down than let you assume:
· It touches the
public front door only. Internal services, VPN, SSH, queues, databases,
code signing certificates — none of them appear here.
· It is
one point in time. A load balancer can answer differently between two calls.
·
not measurable means the endpoint did not complete a handshake inside the timeout. It does
not mean "no post-quantum". Those are two different statements and we do not merge them.
· We sell this kind of assessment, so this report has a built-in bias. That is exactly why the
method is printed below rather than described.
·
A post-quantum answer here does not prove anyone decided anything. On 8 September 2026
Cloudflare wrote that
"hundreds of thousands of domains now have post-quantum origin connections
that nobody had to configure"
(
blog.cloudflare.com/automatic-key-exchange-for-origins).
A front door can therefore be post-quantum because a provider turned it on, not because the operator
migrated. This measurement cannot tell those two apart, and the difference matters: what a provider
switched on, a provider can switch back. If no change record on your side matches this result, the
handshake is someone else's decision showing up on your hostname.
Run it again and check us
Anyone who wants to argue can re-run it. Under a minute per endpoint:
openssl s_client -connect <host>:443 -groups X25519MLKEM768 -tls1_3 </dev/null 2>&1 | grep -i "negotiated\|group"
A server returning X25519MLKEM768 accepted it. A server returning a classical
curve was offered it and declined. A failed handshake is not measurable. Three states, not two.