← Knowledge base

Go crypto/tls

Go 1.24 introduced X25519MLKEM768 and enabled it in the default TLS configuration. Go 1.23 used the older draft Kyber hybrid. Explicit CurvePreferences and runtime settings can change defaults.

Evidence to collect

  1. Identify the toolchain that built the deployed executable; the locally installed go command can be different.
  2. Review crypto/tls configuration and relevant GODEBUG settings.
  3. Record a connection made by the application; a supported group does not prove a particular peer selected it.

Read-only inventory

Run this in the environment used by the application. Missing commands mean the tool is unavailable. This output is inventory, not a negotiation result.

go version

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.