← Back to Blog Research

Open-Source Post Quantum Cryptography Libraries: liboqs, oqs-provider, Botan, BoringSSL

8 min read
Open-Source Post Quantum Cryptography Libraries: liboqs, oqs-provider, Botan, BoringSSL - QNSQY post-quantum encryption guide

The Landscape

Several open-source cryptography libraries now ship Post Quantum Cryptography support. This review covers the major options as of April 2026.

liboqs (Open Quantum Safe)

  • Project origin: University of Waterloo, founded 2014 by Douglas Stebila and Michele Mosca.
  • License: MIT.
  • Governance: Post-Quantum Cryptography Alliance (Linux Foundation).
  • Algorithms: ML-KEM, ML-DSA, SLH-DSA, FN-DSA (draft), FrodoKEM, HQC, Classic McEliece, BIKE.
  • Status: reference implementation. Widely used for experimentation and interoperability testing.
  • Use case: research, prototyping, protocol testing.

oqs-provider

  • What: OpenSSL 3 provider integrating liboqs.
  • License: MIT.
  • Funding: NLnet/NGI Assure.
  • Status: production-experimental. Used for Chrome PQ tests, enterprise pilots.
  • Use case: drop-in PQC for OpenSSL 3-based stacks before native OpenSSL PQC arrives.

OpenSSL (Native)

  • Status: native ML-KEM and ML-DSA merged through 2025-2026. Stable in OpenSSL 3.5+.
  • License: Apache 2.0.
  • Use case: production-grade PQC in OpenSSL-based applications.

Botan 3.x

  • Origin: Botan C++ cryptographic library.
  • License: BSD.
  • Support: BSI-supported.
  • Algorithms: ML-KEM, ML-DSA, SLH-DSA, FrodoKEM, Classic McEliece.
  • Use case: C++ applications; enterprises preferring Botan over OpenSSL.

BoringSSL

  • Origin: Google.
  • License: OpenSSL-derived.
  • Status: ML-KEM since 2024. Used by Chrome.
  • Use case: Google-adjacent stacks.

AWS-LC

  • Origin: Amazon.
  • License: Apache 2.0.
  • Status: ML-KEM hybrid TLS. Used by AWS KMS, s2n-tls.
  • Use case: AWS-adjacent stacks.

WolfSSL

  • Origin: WolfSSL Inc.
  • License: GPL/commercial dual-licensed.
  • Status: ML-KEM, ML-DSA.
  • Use case: embedded, IoT.

mbedTLS

  • Origin: Arm.
  • License: Apache 2.0.
  • Status: ongoing PQC work as of April 2026.
  • Use case: embedded.

Feature Matrix

LibraryML-KEMML-DSASLH-DSAFN-DSAHybrid TLSLicense
liboqsYesYesYesDraftVia oqs-providerMIT
OpenSSL 3.5+YesYesIn progressIn progressYesApache 2.0
Botan 3YesYesYesDraftVia appBSD
BoringSSLYesYesLimitedNoYesOpenSSL-derived
AWS-LCYesYesYesIn progressYesApache 2.0
WolfSSLYesYesIn progressIn progressYesGPL/Commercial

Recommendation

  • Research/prototyping: liboqs + oqs-provider.
  • Production, OpenSSL-based: OpenSSL 3.5+ native.
  • Production, C++ custom: Botan 3.
  • Google stack: BoringSSL.
  • AWS stack: AWS-LC.
  • Embedded: WolfSSL or mbedTLS (monitor PQC support).

Frequently Asked Questions

Is liboqs production-grade?

For algorithm correctness, yes. For hardened production (side-channel resistance, FIPS validation), prefer OpenSSL/Botan/BoringSSL/AWS-LC.

Which library is FIPS-validated for PQC?

FIPS 140-3 validations are in progress for ML-KEM and ML-DSA modules through 2026-2027. Check the NIST CMVP database for current status.

Can I use oqs-provider in production?

For experimental deployments and pilots, yes. For hardened production, prefer OpenSSL 3.5+ native PQC or commercial FIPS-validated modules.

What about Rust?

The pqcrypto crate family (Rust) wraps liboqs. Mature wrappers exist for ML-KEM and ML-DSA.

Sources

  1. liboqs
  2. Botan
  3. AWS-LC

Related Articles

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/open-source-pqc-libraries-review.