New edition of the ‘Cryptographic Right Answers’ series for developers, following Colin Percival (2009), Thomas Ptacek (2015), and Latacora (2018, 2024). The post-quantum transition timeline has moved up, with consensus that it must complete by 2029: symmetric cryptography is unaffected (the author argues Grover’s algorithm does not matter in practice), while all asymmetric recommendations change. Cheat sheet: KMS or XAES-256-GCM / XChaCha20Poly1305 with random nonces for encryption (Cobblestone-128 for large messages), HMAC-SHA-256, SHA-2, 256-bit random IDs, Argon2id or scrypt (or passkeys instead of passwords), X25519+ML-KEM-768 key exchange, HPKE with X-Wing or age with PQ keys for encryption, ML-DSA-44 for signatures, rustls / Go crypto/tls / BoringSSL / AWS-LC / s2n-tls instead of OpenSSL, and restic for online backups. Each section compares the new answer with previous editions. The author discloses having designed some of the recommended primitives (XAES-256-GCM, Cobblestone-128) and co-maintaining Go’s crypto/tls. https://words.filippo.io/right-answers/