tldr.fail

What is the bug?

The Internet is currently beginning a migration to quantum-resistant cryptography. This migration is important because large-scale quantum computers will be powerful enough to break most public-key cryptosystems currently in use and compromise digital communications on the Internet and elsewhere. It is important to migrate to cryptography that cannot be broken by a quantum computer before quantum computers exist.

What is post-quantum-secure cryptography?

Modern public-key cryptography is secure in the face of a classical computer, but can be broken by a quantum computer. Luckily, quantum computers don't exist yet! Post-quantum-secure cryptography (also shortened to post-quantum cryptography) is cryptography that is resistant to quantum computers. Due to the power of math, we can design, build, and verify this cryptography using only classical (non-quantum) computers.

What is the status of post-quantum cryptography in browsers?

Post-quantum key exchange is rolling out in browsers. See Deployment.

What about authentication?

Quantum computers are capable of breaking the digital signature algorithms used for authenticating digital communications today. Post-quantum signature algorithms exist, but still have performance issues that make them difficult to integrate into existing authentication systems, such as HTTPS certificates (X.509).

Does this bug apply to classical cryptography?

Servers that are not prepared for a ClientHello may incorrectly reject any connection, especially if it split over two packets. This is less likely with classical cryptography, but can happen. You can test for this by sending "half" a ClientHello, and then waiting before sending the rest, and seeing if the server correctly handles the connection, or if it resets the connection.