How to Migrate to Post-Quantum Cryptography Before Q-Day: A CISO Guide
Post-Quantum Cryptography (PQC) migration is no longer optional. With NIST standards finalized and harvest-now-decrypt-later attacks active, every CISO needs a migration plan. This guide provides a step-by-step roadmap.
Introduction
Post-Quantum Cryptography (PQC) migration is no longer optional. With NIST standards finalized and harvest-now-decrypt-later attacks active, every CISO needs a migration plan. This guide provides a step-by-step roadmap.
Prerequisites
- ✓ Understanding of public key cryptography (RSA, ECC)
- ✓ Familiarity with TLS and X.509 certificates
- ✓ Knowledge of your organization's cryptographic infrastructure
Key Concepts
Step-by-Step Guide
- 1
Understand the Quantum Threat Timeline
Current estimates suggest cryptographically relevant quantum computers (CRQCs) capable of breaking RSA-2048 will arrive between 2030-2035. However, HNDL attacks mean data encrypted today is already at risk if its confidentiality requirement exceeds 10 years.
Warning: If you are encrypting data today that needs to remain confidential for 10+ years using RSA or ECC, that data is already effectively compromised. - 2
Learn the NIST PQC Standards
NIST has finalized four PQC standards: ML-KEM (FIPS 203) — key encapsulation for encryption. ML-DSA (FIPS 204) — digital signatures for general use. SLH-DSA (FIPS 205) — stateless hash-based signatures, conservative security. FN-DSA — lattice-based signatures, fast verification.
textNIST PQC Standards: FIPS 203: ML-KEM (Kyber) — Key Encapsulation FIPS 204: ML-DSA (Dilithium) — Digital Signatures FIPS 205: SLH-DSA (SPHINCS+) — Hash Signatures FN-DSA (Falcon) — Lattice Signatures - 3
Conduct a Cryptographic Asset Inventory
Map every instance of RSA, ECC, DH, and DSA in your infrastructure. Include: TLS certificates, SSH keys, VPN configurations, code signing certificates, API authentication tokens, encrypted data at rest, and third-party integrations. Classify each by data sensitivity and lifespan.
Tip: Use tools like Cryptography Discovery and Intelligence (CDI) platforms to automate discovery. Manual inventories miss 40-60% of cryptographic assets. - 4
Prioritize Based on Risk
Not all cryptographic assets need immediate migration. Prioritize: 1) Systems handling long-lived data (10+ year confidentiality), 2) External-facing systems (TLS, VPN), 3) Code signing infrastructure, 4) Internal communications, 5) Legacy systems with low data sensitivity.
Hardware Security Modules (HSMs) store cryptographic keys and must be upgraded to support PQC algorithms. - 5
Deploy Hybrid Cryptography
During the transition, use hybrid schemes that combine classical and PQC algorithms. This maintains backward compatibility while adding quantum resistance. For TLS, use X25519+ML-KEM hybrid key exchange. For signatures, use RSASSA-PSS + ML-DSA dual signatures.
python# Hybrid key exchange: classical + PQC def hybrid_keygen(): classical_key = x25519.generate_key() pqc_key = ml_kem.keygen() shared_classical = x25519.dh(classical_key, peer_classical) shared_pqc = ml_kem.decap(pqc_key, peer_ciphertext) shared_secret = kdf(shared_classical || shared_pqc) return shared_secret - 6
Update TLS Infrastructure
Enable PQC key exchange in your TLS termination. Cloudflare and AWS ALB support X25519+ML-KEM hybrid. For self-managed TLS, use OpenSSL 3.4+ or BoringSSL with PQC support. Update your certificate authority to issue PQC certificates.
Tip: Google Chrome has supported PQC key exchange since version 116. Your web traffic may already be using PQC without you knowing. - 7
Migrate Code Signing
Code signing is particularly critical because signatures persist for the lifetime of the software. Start using ML-DSA for new releases. Keep RSA signatures for backward compatibility during the transition. Update your HSMs to support PQC key storage and signing.
- 8
Update Application-Level Crypto
Beyond TLS, applications use cryptography for: JWT signing, API authentication, database encryption, message queues, and inter-service communication. Audit each application and replace RSA/ECC with PQC equivalents. Use abstraction layers to make the migration incremental.
- 9
Test for Performance Impact
PQC algorithms have different performance characteristics: ML-KEM keys are 1,568 bytes (vs 32 for X25519). ML-DSA signatures are 3,309 bytes (vs 64 for ECDSA). This impacts bandwidth, storage, and processing time. Benchmark your critical paths.
Warning: PQC key and signature sizes are 10-50x larger than classical equivalents. This can break protocols with fixed-size fields or MTU limits. - 10
Plan for Algorithm Agility
Design your cryptographic infrastructure to be algorithm-agnostic. Use crypto agility frameworks that allow swapping algorithms without rewriting applications. This future-proofs against potential weaknesses discovered in PQC algorithms.
Tip: Crypto agility is the most important architectural change you can make. If a PQC algorithm is broken, you need to switch quickly — not in 3 years. - 11
Train Your Team
PQC is new territory for most security teams. Provide training on: PQC algorithm fundamentals, hybrid deployment patterns, performance implications, and migration tooling. The Open Quantum Safe project provides open-source libraries and training materials.
- 12
Monitor and Iterate
PQC migration is not a one-time project. Monitor NIST for algorithm updates, track industry adoption, and maintain your crypto agility framework. Expect to migrate between PQC algorithms as the field matures and potential weaknesses are discovered.
Summary
PQC migration is a multi-year journey driven by the threat of quantum computers and harvest-now-decrypt-later attacks. The NIST standards (ML-KEM, ML-DSA, SLH-DSA) are finalized and ready for deployment. Start with a cryptographic asset inventory, prioritize by risk, deploy hybrid cryptography for the transition, and build crypto agility into your infrastructure. The NSA deadline for national security systems is 2035 — but if your data needs to be confidential beyond 2035, you need to start now.
Frequently Asked Questions
Now. If you have data with 10+ year confidentiality requirements protected by RSA or ECC, it is already at risk from HNDL attacks. The migration itself takes 5-7 years for large organizations.
Hybrid during the transition period. Hybrid maintains backward compatibility and protects against potential weaknesses in PQC algorithms. Once PQC is widely deployed and battle-tested, you can transition to pure PQC.
PQC algorithms have larger key and signature sizes (10-50x). Applications with fixed-size buffers or protocol fields may need updates. Crypto agility frameworks help isolate these changes.
Crypto agility is the ability to swap cryptographic algorithms without rewriting applications. It is achieved through abstraction layers, centralized crypto policy management, and protocol designs that negotiate algorithms dynamically.
Test Your Knowledge
1. What is the harvest-now-decrypt-later threat?
HNDL attacks involve adversaries capturing and storing encrypted communications today, betting that quantum computers will be available to decrypt them within 5-10 years.
2. Which NIST standard is used for key encapsulation (encryption)?
ML-KEM (Module-Lattice-based Key Encapsulation Mechanism) is the NIST standard for post-quantum key exchange and encryption.
3. Why is crypto agility important for PQC migration?
PQC algorithms are relatively new and could have undiscovered weaknesses. Crypto agility lets you quickly switch to a different algorithm without major infrastructure changes.