Go 1.26: New Crypto Packages Security Built for the Post-Quantum Era

Go has always taken a conservative, batteries included approach to cryptography. Go 1.26 doubles down on that philosophy by shipping three new crypto related packages that bring modern, standards aligned encryption primitives directly into the standard library, no third-party dependencies required.

crypto/hpke:Hybrid Public Key Encryption, Finally Standard

The headline addition is crypto/hpke, a full implementation of Hybrid Public Key Encryption (HPKE) as defined in RFC 9180. HPKE is the modern answer to the question: "How should I encrypt something to a public key?" It combines a Key Encapsulation Mechanism (KEM), a Key Derivation Function (KDF), and an Authenticated Encryption with Associated Data (AEAD) cipher into a clean, composable ciphersuite.

If you’ve heard of [age](https://age-encryption.org/) or TLS Encrypted Client Hello, you've already benefited from HPKE under the hood. Go itself was already using an internal HPKE implementation for ECH,crypto/hpke graduates that to a stable, public API.

The API follows RFC 9180 naming closely: a Sender seals messages, a Recipient opens them.

import "crypto/hpke"

kem := hpke.MLKEM768X25519() // Post-quantum hybrid KEM

// Recipient generates a key pair
privKey, err := kem.GenerateKey(rand.Reader)
pubKey := privKey.PublicKey()

// Sender encrypts
enc, sender, err := hpke.SetupSender(kem, hpke.HKDF_SHA256, hpke.AES_256_GCM, pubKey, []byte("app context"))
ciphertext, err := sender.Seal([]byte("associated data"), []byte("hello, secure world"))

// Recipient decrypts
recipient, err := hpke.SetupRecipient(kem, hpke.HKDF_SHA256, hpke.AES_256_GCM, privKey, []byte("app context"), enc)
plaintext, err := recipient.Open([]byte("associated data"), ciphertext)

What makes this especially significant is the post-quantum KEM support. Go 1.26 ships ML-KEM-768, ML-KEM-1024, MLKEM768-X25519 (X-Wing), and MLKEM768-P256 all hybrid schemes that combine classical elliptic-curve cryptography with lattice-based post-quantum algorithms. This directly defends against “harvest now, decrypt later” attacks, where adversaries collect today’s encrypted traffic to decrypt it once quantum computers mature.

Supported KEMs at a glance:

Classical KEMs • DHKEM(X25519, HKDF-SHA256) • DHKEM(P-256, HKDF-SHA256) • DHKEM(P-384, HKDF-SHA384) • DHKEM(P-521, HKDF-SHA512)

Post-Quantum KEMs • MLKEM768 • MLKEM1024

Hybrid PQ + Classical (Recommended) • MLKEM768X25519 (X-Wing) • MLKEM768P256 • MLKEM1024P384

crypto/mlkem/mlkemtest:Deterministic Testing for ML-KEM

Cryptographic testing is notoriously tricky, randomness makes results non-reproducible, making known-answer tests (KATs) hard to write. The new crypto/mlkem/mlkemtest package solves this with Encapsulate768 and Encapsulate1024 functions that implement derandomized ML-KEM encapsulation.

This is purely a testing utility you won’t use it in production but it’s exactly what you need to validate your crypto code against official test vectors or audit your key encapsulation logic deterministically.

import "crypto/mlkem/mlkemtest"

// Deterministic encapsulation for testing - no randomness
sharedKey, ciphertext := mlkemtest.Encapsulate768(pubKey, seed)

testing/cryptotest:Deterministic Randomness for Crypto Tests

Related, and equally practical, is the new testing/cryptotest package. Its centerpiece is SetGlobalRandom, which replaces the cryptographic randomness source for the duration of a test with a deterministic one.

import "testing/cryptotest"

func TestMyEncryption(t *testing.T) {
    cryptotest.SetGlobalRandom(t, deterministicSeed)
    // All crypto/rand usage and implicit randomness in crypto/... packages
    // is now deterministic - perfect for reproducible test vectors
}

This affects crypto/rand and all implicit randomness used throughout the crypto/* packages. Previously, testing crypto code that depended on internal randomness required awkward mocking or accepting non-reproducible output. Now there's a first-class, safe way to do it.

Bonus: runtime/secret (Experimental)

Not technically a crypto package, but deeply relevant: the experimental runtime/secret package (enabled with GOEXPERIMENT=runtimesecret) provides a facility for securely erasing sensitive data from memory registers, stack, and heap after use.

This is defense-in-depth for code that handles cryptographic keys or tokens, ensuring that secrets don't linger in memory where they could be extracted by side channel attacks or memory-inspection tools.

Currently supported on AMD64 and ARM64 Linux.

Why This Matters

Go’s standard library crypto has historically been excellent but deliberately minimal. Developers needing HPKE had to reach for third-party libraries, which introduced supply chain risk and inconsistent APIs.

With Go 1.26:

• HPKE is now standard: one less dependency, audited by the Go team, RFC-compliant by design.
• Post-quantum readiness is built in: ML-KEM hybrid KEMs are available out of the box, not bolted on.
• Testing is finally first-class: deterministic randomness for crypto tests removes a longstanding pain point.
• Forward secrecy is easier to achieve: runtime/secret makes it practical to ensure keys are truly gone after use.

If you’re building anything that touches encryption messaging, file storage, APIs, or TLS-adjacent protocols, Go 1.26 gives you a significantly better, more future-proof toolkit without leaving the standard library.

Released February, 2026. Upgrade with

*go install golang.org/dl/go1.26@latest && go1.26 download.*