Quantum Use Case #61: Migrating to post-quantum cryptography

Short answer: This use case involves replacing vulnerable public-key algorithms like RSA and ECC with post-quantum standards to protect data from future quantum attacks. It is a realistic and urgent operational priority, as cryptographically relevant quantum computers could enable retroactive decryption of currently captured ciphertext. Organizations are actively developing frameworks to manage this transition, though the complexity lies in coordinating changes across complex legacy systems rather than just swapping algorithms.

The Threat Model and Timing Risk

The primary driver for migrating to post-quantum cryptography is the anticipated capability of cryptographically relevant quantum computers (CRQCs). These machines would break widely deployed public-key cryptography, specifically RSA and Elliptic Curve Cryptography (ECC), using Shor’s algorithm. This capability creates a specific risk known as "harvest now, decrypt later," where an adversary captures encrypted data today and waits until quantum computing is available to decrypt it retroactively.

To address this, researchers have proposed enterprise-cloud transition frameworks that couple standards-based algorithm selection with quantitative timing-risk models. One such framework utilizes NIST’s post-quantum standards, specifically FIPS 203–205, for algorithm selection. It distinguishes between different types of risks, separating retroactive confidentiality loss from forward integrity and authentication risks. To manage the uncertainty of when quantum computers will become a practical threat, these frameworks employ a public expert-elicitation distribution for "Q-day" timing. This is combined with a reproducible Monte Carlo estimator to quantify the timing risk, grounding the decision-making process in a model based on Mosca’s inequality. This approach allows organizations to plan their migration based on probabilistic timing estimates rather than fixed dates.

Organizational Complexity and Migration Levels

While the cryptographic threat is clear, the operational challenge is significant. Senior leaders, such as CISOs and CTOs, face the difficulty of driving coordinated change across large, complex organizations. Asymmetric cryptography is embedded in every protocol, vendor dependency, and legacy system that handles key exchange or digital signatures. The most difficult part of the migration is not merely changing algorithms but managing the organizational inertia and technical debt associated with these deeply integrated systems.

To manage this complexity, industry practitioners have proposed the concept of "PQC Migration Levels." This framework helps teams within organizations manage the varying complexity of post-quantum migration for their specific use cases. By outlining an approach that moves from risk assessment and inventory through deployment and guardrails, organizations can contribute practical guidance to accelerate the broader community’s efforts. The goal is to navigate the transition effectively and efficiently, ensuring that resilience is strengthened as the industry moves toward post-quantum standards. This structured approach acknowledges that different systems have different risk profiles and migration timelines, requiring a tiered management strategy rather than a single global switch.

Published Guidance and Planning

Published guidance on post-quantum adoption now exists in many jurisdictions, and it gives senior leaders a planning reference for programmes that must also meet compliance deadlines while modernising the organization. That makes the transition a practical planning question as well as a research one.

However, the guidance emphasizes that the leadership challenge remains distinct from the technical task. Leaders must balance compliance deadlines with the practical realities of modernizing legacy infrastructure. The strategic focus is on coordinating change across the entire organization, ensuring that vendor dependencies are addressed, and that legacy systems are either upgraded or isolated appropriately. This supports the case for structured migration frameworks and for starting with a cryptographic inventory.

Research-Stage Considerations and Uncertainty

It is important to note that while the migration frameworks and standards are established, the actual deployment of post-quantum cryptography in all contexts is an ongoing process. The timing of "Q-day" remains uncertain, which is why probabilistic models and expert elicitation are used rather than definitive predictions. Organizations are in various stages of their migration, with some focusing on risk assessment and inventory, while others are working on deployment and guardrails.

The use of Monte Carlo estimators and expert-elicitation distributions highlights the inherent uncertainty in planning for quantum threats. These tools allow for reproducible and quantitative risk assessment, but they do not eliminate the uncertainty. Therefore, migration strategies must be flexible and adaptive, capable of responding to new information about quantum computing capabilities as they emerge. The focus remains on strengthening resilience and ensuring that the organization can withstand the transition without compromising security or operational continuity.

FAQ

What specific algorithms are targeted for replacement?

The migration targets widely deployed public-key cryptography, specifically RSA and Elliptic Curve Cryptography (ECC). These are replaced with algorithms based on NIST’s post-quantum standards, such as FIPS 203–205.

How is the timing of the quantum threat managed?

Timing is managed using a quantitative risk model grounded in Mosca’s inequality. This model utilizes a public expert-elicitation distribution for "Q-day" timing and a reproducible Monte Carlo estimator to calculate the probability of threat realization over time.

What is the "harvest now, decrypt later" risk?

This is a retroactive confidentiality risk where an adversary captures encrypted data today and stores it. Once cryptographically relevant quantum computers are available, the adversary can use Shor’s algorithm to break the public-key cryptography and decrypt the data.

How do organizations manage the complexity of migration?

Organizations use frameworks like "PQC Migration Levels" to manage complexity. This involves a phased approach starting with risk assessment and inventory, moving through deployment, and ending with guardrails. This allows teams to handle different use cases with varying levels of complexity and risk.

Is there published guidance on when to migrate?

Yes. Over a dozen major economies have published post-quantum cryptography adoption guidance, which leaders can use when planning migration around compliance deadlines. It is guidance to plan against, not a single global rule.