Not yet. MySQL uses OpenSSL or wolfSSL for TLS connections with classical key exchange. Oracle has not announced PQC support for MySQL. Data at rest encryption (InnoDB tablespace encryption) uses AES-256, which is quantum-resistant.
Key Takeaway: MySQL is NOT quantum safe. Scan your MySQL infrastructure with QScout. Plan OpenSSL/wolfSSL upgrades to PQC-capable versions. Audit replication and proxy configurations for TLS dependencies.
MySQL is NOT quantum safe today. **Current State:** MySQL uses OpenSSL or wolfSSL for TLS connections. Client-to-server and replication connections use classical RSA/ECDH key exchange. InnoDB tablespace encryption and MySQL Enterprise TDE use AES-256 (quantum-resistant). **PQC Progress:** MySQL has not announced PQC migration plans: - **OpenSSL dependency**: Like PostgreSQL, MySQL can potentially inherit PQC from OpenSSL upgrades. - **MySQL HeatWave (Oracle Cloud)**: Uses OCI infrastructure TLS — no PQC announced. - **MySQL Enterprise Encryption**: Uses classical RSA and DSA functions. - **Group Replication**: Uses classical TLS between nodes. **HNDL Risk:** MySQL is the most widely deployed open-source database. Connections to MySQL carry application data, credentials, and queries. The sheer volume of MySQL deployments makes this a significant aggregate HNDL risk. **What Organizations Should Do:** Audit all MySQL connections, replication topologies, and ProxySQL/MaxScale configurations. Plan OpenSSL upgrades. Use QScout to discover all MySQL cryptographic dependencies across your infrastructure.
| Full Name | MySQL and MySQL HeatWave |
| Category | database |
| Quantum Vulnerability | MySQL TLS connections use classical key exchange via OpenSSL/wolfSSL, vulnerable to quantum attack. InnoDB encryption (AES-256) is quantum-resistant at rest. |
| NIST Status | MySQL/Oracle has not publicly announced NIST PQC standard adoption for MySQL. |
| Deprecation Timeline | Oracle has not published PQC migration timelines for MySQL. |
| Replaced By | MySQL TLS can migrate to ML-KEM via OpenSSL PQC provider upgrades |
Scan your MySQL infrastructure with QScout. Plan OpenSSL/wolfSSL upgrades to PQC-capable versions. Audit replication and proxy configurations for TLS dependencies.
QScout discovers every instance of MySQL across your infrastructure in 7 days — with zero operational disruption. 72-hour time to first findings.