Post-quantum VPN

How to Verify Your VPN Uses Post-Quantum Key Exchange

By ALight Technology And Services Limited · 2 November 2026

Quick answer

Look for the selected SecP384r1MLKEM1024 group in diagnostics for a successful VPN tunnel handshake. A supported-group list, profile setting, IP-address change or browser padlock alone cannot prove which group your VPN negotiated. If the selected group is not visible, the result is inconclusive.

Record the client you actually run

Before connecting, note your ALightVPN package version, operating system, OpenVPN executable and profile issue date. Use the version information reported by that executable. Installing a newer standalone OpenSSL command does not establish which library the VPN process loads.

Where the installed OpenVPN build supports them, these read-only commands report its version and available groups. Run them against the same binary your client uses:

openvpn --version
openvpn --show-groups

On Windows, use openvpn.exe from the selected installation; PowerShell requires the call operator & before a quoted executable path. Group availability is a prerequisite, not a record of negotiation.

Inspect one successful connection

Connect with the official client and issued profile. Record the connection time so you can separate this attempt from previous logs.
Open the client's connection log or diagnostic output. In the Windows OpenVPN client, OpenVPN process output is displayed in the application's log area.
Find the handshake or control-channel summary for that attempt. Check the selected group, not merely a line listing configured or supported groups.
Confirm that the tunnel finished connecting. A group name in a failed attempt does not prove an established tunnel.
Record the selected group alongside the client version and connection time. Recheck after changing the profile, executable, server or dependencies.

Log labels differ between OpenVPN and library builds. A redacted three-run diagnostic case study now shows the actual selected-group output, timings and status counters for one Windows client/profile in route-isolated dev-null mode. It does not demonstrate routed user traffic. Do not assume that every build prints a particular field at its default diagnostic level.

Interpret what you found

Evidence and interpretation
Observation	Conclusion
The completed session explicitly identifies `SecP384r1MLKEM1024` as the selected key-agreement group.	Evidence of the intended hybrid key agreement for that session.
The group occurs only in a supported-group list or profile.	Shows capability or configuration; session negotiation remains unverified.
Only a TLS version, symmetric cipher or certificate key type is visible.	Insufficient information to identify the selected hybrid group.
A different group is selected, or the connection fails.	Investigate configuration and compatibility before relying on the intended policy.

A data-channel cipher such as AES-256-GCM answers a different question. Likewise, a browser's TLS test checks the website connection, not the VPN control channel.

Get help without exposing credentials

If the selected group is not visible, ask support which diagnostic procedure applies to your exact build. Share only the minimal redacted excerpt and version details. Remove API keys, access tokens, private keys, full profiles, customer identifiers and sensitive addresses before sharing.

Keep certificate validation and the issued group policy intact while investigating. Use the safe-support checklist and the fallback guide to identify the next check.

Common questions

Does an IP-address change prove post-quantum protection?

No. It can help confirm routing through a VPN, but it does not reveal the negotiated key-agreement group.

Does --show-groups prove my current session uses that group?

No. It lists groups available to that executable. Session diagnostics are needed to identify the selected group.

What if my log omits the selected group?

Treat the result as inconclusive and request the diagnostic procedure for your exact build. Do not infer the group from a symmetric cipher name.

Sources and product references

Reviewed 2 November 2026. Release configuration and platform availability are distinct from live-session test evidence.