{"resourceId":"redhat-blog-pqc-red-hat-ai-enterprise-20261103","versions":[{"version":"external-a51871d9f8dcbbd04627586ed3258dd35c70d7e8790a2effa9ee9a2e8b509f61","resource":{"id":"redhat-blog-pqc-red-hat-ai-enterprise-20261103","title":"Red Hat maps post-quantum cryptography onto Red Hat AI Enterprise, mostly as roadmap","organization":"Red Hat","sector":"AI platform software (Red Hat AI Enterprise / OpenShift AI)","geography":"Global vendor guidance; US SLED relevance through NIST-aligned state and campus security programs","publishedAt":"Blog displayed Nov. 3, 2026 (page metadata datePublished Oct. 29, 2026)","publicationDate":"2026-11-03","eventDate":null,"sourceName":"Red Hat Blog","sourceLabel":"Future-proofing enterprise AI: The impact of post-quantum cryptography on Red Hat AI Enterprise","sourceUrl":"https://www.redhat.com/en/blog/future-proofing-enterprise-ai-impact-post-quantum-cryptography-red-hat-ai-enterprise","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["infrastructure","data-security","governance-procurement"],"finding":"Vendor claim: Red Hat says Red Hat AI Enterprise inherits hybrid ML-KEM TLS from RHEL 10 and OpenShift to counter 'harvest now, decrypt later' interception of datasets and inference traffic. It describes planned ML-DSA signing of pipeline container images via Red Hat Advanced Developer Suite, with admission blocking of invalid signatures, PQC mutual TLS through the service mesh, and model-artifact signing in the model registry that it calls 'in process'. It notes larger PQC keys add handshake bandwidth overhead. Independent context: NIST IR 8547 plans to deprecate quantum-vulnerable public-key algorithms after 2030 and disallow them after 2035. Interpretation: useful as a planning map, with most AI-specific pieces still roadmap.","sledRelevance":"State agencies and universities holding long-lived sensitive data (health, benefits, student and research records) face the same harvest-now risk, and many follow NIST timelines. Teams planning on-premises AI platforms can use this to add PQC readiness questions to platform roadmaps and procurement.","evidence":"Read the Red Hat blog in full and the transition timeline sections of NIST IR 8547.","architectureImplications":"PQC readiness depends on the RHEL/CoreOS crypto libraries, OpenShift version, service mesh, signing toolchain and storage drivers, not on the AI layer alone. Hybrid key exchange keeps compatibility with older clients.","governanceImplications":"Agencies can fold AI platforms into existing cryptographic inventories and NIST-aligned migration plans rather than treating them separately.","securityPrivacyImplications":"Protects data in transit and artifact integrity over the long term; it does not address current exploitable flaws such as the Nov. 3 base-image CVEs.","caveats":"Vendor roadmap blog without dates, benchmarks or customer evidence; display date and metadata date differ; NIST deadlines are federal and not binding on SLED entities.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: a long-horizon planning conversation, not an urgent buy. For state CISOs and university research IT, Red Hat's blog offers a component-by-component PQC map for AI platforms that lines up with NIST's 2030 and 2035 transition dates. Use it to open a roadmap discussion. Interpretation only: most AI-specific capabilities described are planned, so do not present them as shipped or claim compliance with any state mandate.","engineering":"Engineering framing: separate shipped from planned. Hybrid ML-KEM TLS depends on RHEL 10-based CoreOS and the OpenShift version in use; ML-DSA image and model signing are described as forthcoming. Check which OpenShift release a site runs, whether storage drivers and Go components use PQC-capable libraries, and the bandwidth impact of larger handshakes in distributed training. Applicability is limited until Red Hat publishes dates.","delivery":"Delivery framing: add AI platforms to the cryptographic inventory now and stage upgrades. Map AI workload data flows (workbench to storage, pipelines, serving endpoints), record current algorithms, and plan OpenShift upgrades to versions that support hybrid TLS. The security architecture office owns the plan. Proposed acceptance: inventory complete and a dated upgrade path agreed. Interpretation, not an observed result."},"roleDetails":{"sales":{"customerProblem":"Long-lived sensitive data processed by AI platforms is exposed to future decryption of traffic captured today.","stakeholders":["State or campus CISO","Enterprise architect","Research data steward"],"discoveryQuestions":["Does your cryptographic inventory include AI platforms?","Which OpenShift and RHEL versions run your AI workloads?","Do procurement templates ask for PQC roadmaps?"],"valueHypothesis":"An early PQC inventory of AI platforms can reduce later migration disruption; benefit is unquantified.","potentialEngagement":"Bounded PQC readiness assessment of one AI platform's data flows.","unsupportedClaims":["Red Hat AI Enterprise is quantum-safe today","Compliance with any state mandate","Measured performance impact"]},"engineering":{"fit":"Sites planning OpenShift AI or Red Hat AI Enterprise upgrades over the next several years.","architectureIntegration":"Hybrid ML-KEM TLS through RHEL 10/CoreOS libraries; future ML-DSA signing integrated with admission control and model registry.","prerequisites":["Cryptographic inventory","OpenShift on RHEL 10-based CoreOS","PKI able to issue PQC certificates"],"constraints":["Most AI-specific PQC features are roadmap","Older clients need hybrid mode","Federal NIST dates not binding on SLED"],"security":"Hybrid key exchange for data in transit; planned post-quantum signatures for images and models.","proofOfValue":["Confirm hybrid ML-KEM negotiated on workbench-to-storage TLS","Measure handshake overhead on distributed training","Track Red Hat dates for ML-DSA signing"]},"delivery":{"work":"Inventory AI data flows and crypto, then stage platform upgrades toward PQC-capable releases.","dependencies":["OpenShift upgrade plan","PKI team","Vendor roadmap dates"],"ownership":"Security architecture office with the AI platform team.","skillsAdoption":"Build crypto-agility and PQC PKI skills in platform and security teams.","governanceCheckpoints":["Inventory review","Upgrade path approval","Annual roadmap check against NIST guidance"],"acceptanceCriteria":["Proposed: AI platforms included in the crypto inventory","Proposed: dated upgrade path to hybrid TLS","Proposed: procurement language requiring PQC roadmap disclosure"],"risks":["Vendor roadmap slips","Performance overhead at scale","Treating roadmap as shipped capability"]}},"retrievedAt":"2026-11-04T04:09:47Z","enrichedAt":"2026-11-04T04:12:29Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires crypto-agility and PKI skills that many state and campus teams lack.","procurementImplications":"RFPs for AI platforms can ask for PQC roadmaps, FIPS 203/204 support status and dates, separating shipped features from plans.","operatingModelImplications":"PQC migration is a multi-year platform upgrade program spanning OS, cluster and signing infrastructure.","sourceVerification":{"openedUrl":"https://www.redhat.com/en/blog/future-proofing-enterprise-ai-impact-post-quantum-cryptography-red-hat-ai-enterprise","referenceExcerpt":"PQC algorithms, particularly ML-KEM, have larger key sizes and ciphertext sizes compared to elliptic curves.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}