PQC Migration: From Standards To Quantum Resilience

In the previous blog post on the topic, we explored how quantum computers threaten today’s security protocols and how post-quantum cryptography (PQC) provides a new foundation for protecting digital systems.

The publication of PQC standards is an important milestone. But it does not mean that organizations can simply select a new algorithm, update a configuration file, and consider themselves quantum resilient.

In this post, we examine why transitioning to PQC is much more than replacing one cryptographic algorithm with another.

Before looking at the transition itself, we first need to consider a few realities about how organizations operate. Most of these challenges are not specific to PQC or quantum computing. They are rooted in the way modern systems are built and managed. Understanding them helps explain the true scope and complexity of the transition.

our organization handles many types of data, from public and internal information to confidential or even secret data.

Depending on its sensitivity and business value, not all data, and not all systems protecting it, face the same level of urgency when it comes to the quantum threat. The lifecycle of the cryptographic mechanism or system also matters. A public website certificate may be renewed every few months, while a signature mechanism embedded in long-lived hardware could remain in use for more than ten years.

Finally, organizations must consider the required protection period of the data itself. Medical records, government secrets, biometric data, or intellectual property may need to remain confidential for decades. Such data may already be exposed to the «harvest now, decrypt later (HNDL)» threat.

To understand where action is most urgent, organizations should ask the following questions:

• Which systems and business processes are critical to the organization?

• What is your critical data? How long must it remain confidential or trustworthy?

• If this data were subject to theft and later illegal publication, what would the impact be?

• How long will the system remain in operation? How long would it take to migrate it?

Public-key cryptography, which is affected by the quantum threat, does not live in one place. It is embedded across applications and infrastructure, including TLS connections, VPNs, APIs, certificates and PKI, code-signing pipelines, identity systems, cloud services, HSMs, smart cards, IoT devices, third-party libraries, and vendor products.

Much of it operates quietly in the background and may be managed by different teams or external providers. As a result, most organizations do not have a complete picture of where cryptography is used, what it protects, or who controls it.

This is why the first step towards PQC is not migration, but discovery: identifying where and for what purpose cryptography is used, which algorithms and parameters are involved, which data or process it protects, and who controls the component.

The result of this discovery is a Cryptographic Bill of Materials (CBOM): a structured inventory of where and how an organization uses cryptography. A useful CBOM goes beyond listing algorithms: it connects cryptographic usage to systems, data flows, dependencies, and suppliers. It provides the visibility needed to plan and prioritize the transition.

Classical public-key cryptography, particularly elliptic-curve cryptography, offers compact keys and signatures. Post-quantum algorithms come with different trade-offs. For example, ML-KEM and ML-DSA use larger keys, ciphertexts, or signatures than comparable elliptic-curve schemes but have similar to better time performances. This can mean more data per handshake, larger certificates, and certificate chains, as well as greater pressure on bandwidth, storage, memory, and processing capacity. These implications need to be reflected on across the technology landscape.

However, these challenges do not make large-scale deployment impossible. Cloudflare, one of the early adopters of PQC, reports that more than 70% of the traffic passing through its network is already protected using quantum-resilient cryptography.

Another important aspect of the transition is the use of hybrid approaches, which combine classical and post-quantum mechanisms. Most large-scale PQC deployments currently rely on this model. The objective is to benefit from the established security of classical cryptography while adding protection against future quantum attacks.

This approach also recognizes that post-quantum algorithms are relatively new and have not yet undergone the same level of long-term scrutiny as established classical algorithms. During the PQC standardization process, several candidate algorithms were found to be vulnerable, including some that had progressed to relatively advanced stages of evaluation (https://eprint.iacr.org/2022/975 , https://www.anthropic.com/news/discovering-cryptographic-weaknesses). Hybrid mechanisms therefore provide an additional layer of assurance during the transition period. 

During the migration, the goal is to understand how different cryptographic characteristics affect each system, test the new setup, and adapt software and infrastructure without disrupting interoperability or operations.

But even when the technical migration path is understood, organizations may not control every component that needs to change.

Few organizations control their entire technology stack, and even fewer develop all the cryptographic components on which they rely. Cryptography is everywhere and, as a result, the pace of a PQC transition may be determined by the slowest dependency.

This makes the transition as much a supply-chain and vendor-management exercise as a technical one. Organizations depend on software vendors, cloud and SaaS providers, hardware manufacturers, managed service providers, and business partners.

Organizations therefore need to distinguish between three categories: components they control and can migrate directly, components that a provider will migrate for them, and components that cannot be migrated within the required timeframe and may need to be modernized or replaced.

These dependencies also introduce important procurement and contractual considerations. Organizations should engage with suppliers now to understand their PQC roadmaps. New technology investments should avoid creating additional quantum-vulnerable dependencies that will remain in service for many years.

PQC is also an organizational challenge

A PQC transition crosses traditional organizational boundaries. It involves executive management, risk and data owners, security specialists, architects, development and infrastructure teams, PKI and identity experts, procurement, legal and compliance.

Without clear ownership, each team may assume that another team or a technology provider is handling the transition. Organizations therefore need governance that defines who owns the quantum-resilience program, which systems are prioritized, which cryptographic standards are permitted, and how supplier readiness, exceptions, migration progress, and remaining risks are managed. PQC should thus not be treated as an isolated cryptography project, but as an enterprise-wide risk and technology transformation program.

Taken together, these realities show that the journey towards quantum resilience requires a structured and coordinated approach:

The journey does not end when the first post-quantum algorithms are deployed. The processes and governance established during the transition should enable the organization to respond more effectively to future cryptographic change.

Crypto-agility is the ability to change cryptographic algorithms and parameters without repeatedly redesigning the applications and infrastructure around them.

Cryptographic standards will continue to evolve. Algorithms will be refined, protocols and implementations will change. Today's recommendations may no longer apply in a couple of years or may need to be adjusted tomorrow. Organizations that treat the PQC transition as a one-time replacement risk having to repeat the same complex work in the future.

Cryptography should be decoupled from application logic, avoiding hardcoded dependencies on specific algorithms and parameters. Well-defined interfaces and centrally managed policies should allow cryptographic mechanisms to be upgraded, deprecated, or replaced without redesigning the complete application. Crypto-agility also requires maintaining an up-to-date inventory of what is deployed and where and establishing governance to approve and enforce changes when required.

Why does crypto-agility matter?

The payoff from crypto-agility isn't only technical. Every future cryptographic change, quantum-driven or not, becomes cheaper, faster, and lower-risk. The best outcome of the PQC transition is therefore not a one-time algorithm replacement, but an organization capable of managing cryptographic change continuously.

Quantum resilience is a journey. It starts with understanding where you stand and, with the guidance of an experienced partner, leads you confidently to your goal − from initial assessment through to migration.

Previous post in this series: Post-Quantum Cryptography: The Solution To A Challenge That Began In 1994