rustls
rustls uses a CryptoProvider for cryptographic algorithms. Provider selection, build features, and configured key-exchange groups affect what an application can negotiate.
Evidence to collect
- Inspect the deployed dependency lockfile and CryptoProvider selection.
- Review the provider’s supported key-exchange groups for the exact version.
- Observe a connection made by the deployed application; dependency presence alone does not prove negotiation.
Record the scope and result
Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.
Official references
Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.