Neo4j now supports post-quantum hybrid key exchange (X25519MLKEM768) for SSL/TLS encrypted Bolt connections, starting with the 2025.01 release. This addresses the 'Harvest Now, Decrypt Later' (HNDL) threat, where adversaries capture encrypted traffic today to decrypt it once quantum computers become capable. The hybrid approach combines classical X25519 elliptic curve Diffie-Hellman with the NIST-standardized ML-KEM-768 post-quantum algorithm, ensuring connections remain secure as long as either component holds. The feature requires OpenSSL 3.5+ and the OpenSSL provider configuration in Neo4j Enterprise Edition. A Docker-based setup example is provided, along with verification steps using openssl s_client. Post-quantum certificate authentication (ML-DSA, Merkle Tree Certificates) is planned for a future release.
