Quantum-Safe Encryption: A Security Engineer's Transition Field Guide

Scope

This guide outlines the technical and strategic steps your team needs to take when transitioning from current public-key cryptography to post-quantum cryptography (PQC). It covers cryptographic asset inventory, risk-based prioritization, implementation timelines, and common failure modes.

Use this guide when:

• Building your organization's PQC migration roadmap
• Conducting cryptographic asset discovery
• Prioritizing systems for quantum-safe upgrades
• Evaluating vendor products for PQC support
• Addressing procurement or compliance questions about quantum readiness

This guide does not cover quantum key distribution (QKD) or quantum random number generation.

Key Concepts and Definitions

Post-Quantum Cryptography (PQC): Algorithms designed to resist attacks from both classical and quantum computers. Unlike current methods like RSA, ECDSA, and ECDH, PQC relies on mathematical problems that remain difficult for quantum systems.

Cryptographic Agility: Your system's ability to change cryptographic components without redesigning core architecture. If you've hardcoded RSA-2048 into multiple microservices, you lack agility.

Harvest Now, Decrypt Later (HNDL): A threat model where adversaries capture encrypted traffic now and store it until quantum computers can break the encryption. Your data's confidentiality timeline may exceed the timeline to quantum capability.

Cryptographic Asset: Any component that performs encryption, signing, key exchange, or hashing. This includes TLS configurations, code signing certificates, API authentication tokens, database encryption keys, and PKI hierarchies.

Requirements Breakdown

The G7 call to action, published September 3 and signed by national cybersecurity agencies from Canada, France, Germany, Italy, Japan, the UK, and the US, with support from ENISA, establishes a framework treating quantum risk as a near-term threat requiring action across all sectors.

Timeline Requirements

ANSSI will stop vetting products lacking quantum-safe encryption starting in 2027. By 2030, post-quantum security becomes mandatory for some security product procurement in France. Treat these as immediate priorities, not distant deadlines.

Risk-Based Prioritization Requirements

The G7 document specifies that you must:

1. Identify critical systems first: Prioritize systems holding the most critical data and assets in your transition plan.
2. Act proactively: Don't wait for confirmed quantum capability to break current algorithms.
3. Adopt a phased approach: Inventory assets, map dependencies, and develop transition plans in stages.

Integration Requirements

The G7's fifth priority calls for integrating PQC into cybersecurity requirements. In practice, this means:

• Update your security baselines to require PQC support for new systems.
• Modify RFP templates to ask vendors about quantum-safe roadmaps.
• Revise your cryptographic standards documentation.

Implementation Guidance

Phase 1: Cryptographic Asset Inventory

Start with a complete inventory. You can't migrate what you can't see.

What to catalog:

• TLS endpoints (web servers, load balancers, API gateways)
• Certificate authorities and signing certificates
• VPN concentrators and IPsec tunnels
• SSH key pairs and host keys
• Database encryption (transparent data encryption, column-level encryption)
• Application-level encryption (field encryption, tokenization systems)
• Hardware security modules (HSMs) and their firmware versions
• Key management systems and their supported algorithms
• Code signing infrastructure
• Document signing and S/MIME certificates

For each asset, record:

• Algorithm in use (RSA-2048, ECDSA P-256, etc.)
• Key length and parameters
• Certificate expiration dates
• System dependencies (what breaks if this component goes offline?)
• Data sensitivity classification
• Vendor and product version

Phase 2: Risk-Based Ranking

Not everything needs to migrate simultaneously. Build your priority matrix using these factors:

High Priority (migrate first):

• Systems protecting data with confidentiality requirements exceeding 10 years
• Root certificate authorities (their keys have the longest lifetime)
• External-facing authentication systems
• Systems handling regulated data with specific cryptographic requirements
• Long-term archive encryption

Medium Priority:

• Internal TLS configurations
• Short-lived session keys
• Systems with planned hardware refresh in the next 24 months

Lower Priority:

• Ephemeral keys with sub-hour lifetimes
• Systems scheduled for decommissioning
• Development and test environments (migrate these last, but use them for testing your migration procedures)

Phase 3: Vendor Assessment and Product Selection

The G7 document recommends purchasing products that already integrate PQC. When evaluating vendors:

Questions to ask:

• Which NIST-standardized PQC algorithms do you support? (CRYSTALS-Kyber for Key Wrapping, CRYSTALS-Dilithium and SPHINCS+ for signatures)
• What's your timeline for PQC support in production releases?
• Do you support hybrid modes (PQC + classical algorithms during transition)?
• Can your product negotiate algorithm choice dynamically?
• What's your cryptographic agility story?

Red flags:

• Vendor claims "quantum-resistant" without specifying algorithms
• No published roadmap for PQC support
• Proprietary "quantum-safe" schemes not based on NIST standards
• Inability to support hybrid configurations

Phase 4: Cost Management

The G7 document emphasizes limiting transition costs by aligning PQC adoption with standard renewal schedules.

Strategies that work:

• Replace expiring certificates with quantum-safe alternatives rather than running a separate migration project.
• Time hardware refresh cycles to coincide with PQC availability.
• Negotiate PQC support into enterprise license agreements now (even if you won't use it immediately).
• Start the transition early (the document notes this reduces overall migration costs).

Budget for:

• Increased certificate sizes (PQC signatures and keys are larger)
• Potential performance impact (some PQC algorithms are more computationally expensive)
• Testing and validation time
• Staff training on new algorithms

Common Pitfalls

Waiting for "certainty" about quantum timelines: The exact timeline for cryptographically-relevant quantum computers is uncertain, but the G7 position is clear: act now. Organizations that wait will face compressed timelines and higher costs.

Ignoring hybrid configurations: During transition, support both classical and PQC algorithms. A pure PQC deployment may break compatibility with systems not yet upgraded.

Overlooking embedded systems: IoT devices, industrial controllers, and firmware-based cryptography often can't be patched easily. Identify these early.

Underestimating certificate size impact: PQC certificates can be 10-100x larger than RSA certificates. This affects:

• TLS handshake times
• Certificate chain validation
• Storage in hardware tokens
• Network MTU considerations

Treating this as a one-time project: Cryptographic transitions are ongoing. Build processes and tools that support algorithm agility.

Focusing only on encryption: Digital signatures and key exchange mechanisms are equally vulnerable. Your migration plan needs to cover all three.

Quick Reference Table

Asset Type	Current Algorithm	PQC Replacement	Priority Level	Notes
TLS server certificates	RSA-2048, ECDSA P-256	Hybrid (classical + ML-KEM-768)	High	External-facing first
Root CA keys	RSA-4096	ML-DSA-87 (Dilithium5)	Critical	Longest lifetime exposure
Code signing	RSA-3072, ECDSA P-384	SLH-DSA (SPHINCS+)	High	Long verification timeline
VPN/IPsec	ECDH P-256	Hybrid (ECDH + ML-KEM-768)	Medium	Depends on data sensitivity
SSH host keys	Ed25519, RSA-2048	Hybrid mode in OpenSSH 9.x+	Medium	Wait for client support
Database TDE	AES-256 with RSA key wrap	AES-256 with ML-KEM key wrap	High	Symmetric encryption is quantum-safe; focus on Key Wrapping
Document signing	RSA-2048	ML-DSA-65 (Dilithium3)	Medium	Balance signature size vs. security
API tokens (short-lived)	ECDSA P-256	Lower priority	Low	Sub-hour lifetime reduces HNDL risk

Algorithm abbreviations:

• ML-KEM: Module-Lattice-Based Key Wrapping Mechanism (CRYSTALS-Kyber)
• ML-DSA: Module-Lattice-Based Digital Signature Algorithm (CRYSTALS-Dilithium)
• SLH-DSA: Stateless Hash-Based Digital Signature Algorithm (SPHINCS+)

Start your inventory this quarter. Organizations that treat quantum risk as a near-term operational concern will control their migration timeline and costs. Those that wait will be forced into reactive, expensive crash programs.