(Post-Quantum) Cryptographic Right Answers

A concise, opinionated developer guide updating cryptographic “right answers” for 2026 with urgent post‑quantum context: the PQ transition must finish by 2029. Symmetric crypto remains safe (Grover is irrelevant), but practically every asymmetric recommendation changed since 2018/2024. Key, actionable prescriptions: use cloud KMS when available; otherwise use XAES-256-GCM or XChaCha20-Poly1305 with large (≥128-bit) random nonces, and Cobblestone-128 (STREAM) for large or streamed data. Prefer 256‑bit symmetric keys only when needed, HMAC‑SHA‑256 for message authentication, SHA‑2 (SHA‑512/256 preferred) for hashing, 32‑byte random IDs, and Argon2id (m=64MiB,t=2) or scrypt for passwords - but favor passkeys/SSO where possible. For post‑quantum readiness choose X25519+ML‑KEM‑768 or pure ML‑KEM‑768 in standard protocols; use HPKE (MLKEM768‑X25519, HKDF‑SHA256, AES‑128‑GCM) or age for asymmetric encryption and ML‑DSA‑44 for signatures.

Rationale and practical cautions emphasize using standard, well‑audited implementations (TLS, HPKE, age, rustls, BoringSSL, AWS‑LC), avoiding unauthenticated modes (CBC, CTR, raw stream ciphers), never rolling your own AEADs or multihash, and avoiding obsolete primitives (SHA‑1, MD5). Address large‑message authentication properly (STREAM/Cobblestone) to avoid plaintext exposure. Recognize harvest‑now‑decrypt‑later risk and deploy PQ hybrids or ML‑KEMs promptly. Finally, leverage strong code review - including high‑quality LLMs - and memory‑safe languages as part of modern cryptographic hygiene.