Open Quantum Safe, OpenSSL 3.5 or a Ready-Made Suite, Which One to Choose

Ask an assistant or a search engine how to add post-quantum cryptography to an application, and three answers come back. Open Quantum Safe, the open-source project. OpenSSL 3.5 and the runtimes built on it, such as .NET 10. A ready-made suite, such as ours. All three are serious. They answer different needs, and the price tag tells only part of the story.

Here is an honest comparison, including the cases where Feranor PQC Suite is the wrong choice.

Open Quantum Safe, the place to experiment

Open Quantum Safe is an open-source project supported by the Post-Quantum Cryptography Alliance, part of the Linux Foundation. Its core, liboqs, is a C library under the MIT license that implements the NIST standards and many other candidates. Wrappers exist for Python, Go, Java, Rust and C++, and oqs-provider brings its algorithms into OpenSSL 3.

It is the best tool there is to try algorithms, measure them and build a prototype. Its own documentation draws the line, though. The project does not currently recommend relying on liboqs in a production environment or to protect sensitive data. For a migration meant to hold for years, that sentence settles the question.

• Cost. Free.
• Best for. Research, prototypes, benchmarks, training.
• Missing for production. The project's own go-ahead, an official .NET binding, a format for long-lived data, key management.

OpenSSL 3.5 and .NET 10, solid primitives

OpenSSL 3.5, released in April 2025, implements ML-KEM, ML-DSA and SLH-DSA, and its TLS prefers the hybrid X25519MLKEM768 group by default. .NET 10 builds on it, with the MLKem, MLDsa and SlhDsa classes on Linux (OpenSSL 3.5 or later) and on Windows (CNG). Both are free, maintained and widely deployed.

If your need is TLS, this is most of the answer. Update OpenSSL and your servers, and your connections already negotiate a hybrid key exchange.

Protecting data at rest is a different job. The primitives give you an encapsulation and a signature, and you build everything else.

• The hybrid. Combining ML-KEM with ECDH, as ANSSI requires for regulated systems, and deriving a single key from both secrets.
• The format. A message that an archive tool can still read in twenty years, in a standard such as CMS rather than a structure of your own.
• The keys. Storage, a rotation that keeps old messages readable, backups, and the one loss you never recover from.
• The proof. Tests against the official vectors and an independent implementation, an audit trail, and a file that explains your choices to an assessor.

.NET 10 also marks ML-DSA and SLH-DSA as experimental, and supports no post-quantum algorithm on macOS. All of this suits a team with cryptographers who can own those pieces for years. Few application teams have that skill in-house.

A ready-made suite, for production without a cryptography team

The third way is to buy those pieces already built and tested. That is what Feranor PQC Suite does. The hybrid ML-KEM and ECDH exchange and the SLH-DSA signature co-signed with ECDSA, in standard CMS messages, with the ANSSI profile applied by default. A .NET SDK, a command line, an HTTP sidecar for applications in Java, Python, Node or Go, and a web console, all reading and writing the same messages and sharing one key store.

It runs on OpenSSL 3.5, so it adds no exotic cryptography. It adds everything around the primitives listed above, with a signed release, a software bill of materials and support. The price is public. €20,000 excl. VAT per year and per legal entity for a company, €18,000 for the public sector, whatever the number of applications, servers or developers.

• Cost. A yearly subscription per legal entity.
• Best for. Data that must stay protected for years, in production, without a cryptography team, under ANSSI's expectations.
• Wrong choice for. A prototype, a benchmark or a TLS migration. Open Quantum Safe and OpenSSL already do those well, for free.

How to choose

• You want to try, measure or learn. Open Quantum Safe.
• You need post-quantum TLS. OpenSSL 3.5 and up-to-date servers.
• You have cryptographers to build and maintain the rest. OpenSSL 3.5 or .NET 10, and a few months of work.
• You must protect data at rest in production, with the ANSSI profile and without a cryptography team. A suite. Ours, or another one, compared on the same four points.

Free primitives cost nothing to download. The cost starts with everything you build around them.