Post-Quantum Cryptography and Quantum Readiness

Key Control Areas

When to Use

Any organisation handling data with long-term confidentiality requirements (government, financial services, healthcare, legal, IP-intensive industries). Organisations subject to CNSA 2.0 (US government contractors, defense), NCSC guidance (UK regulated entities), or BSI recommendations (German/EU regulated entities). Organisations operating critical infrastructure with long equipment lifecycles.

When NOT to Use

Organisations with exclusively short-lived data and no regulatory cryptographic requirements may defer migration planning, though crypto agility investment still provides value against classical algorithm compromises. Organisations with no asymmetric cryptography usage (extremely rare).

Typical Challenges

Incomplete cryptographic inventory across a heterogeneous estate. Hard-coded algorithm choices in legacy applications. OT/ICS and embedded systems with non-upgradeable firmware and 15-30 year lifecycles. HSM vendors not yet achieving combined FIPS 140-3 Level 3 with PQC algorithm validation. Larger PQC key and signature sizes impacting constrained devices, certificate transparency logs, and bandwidth-limited channels. Multi-jurisdictional regulatory requirements (CNSA 2.0, NCSC, BSI, ETSI) with differing algorithm preferences and timelines. Fewer than 5% of enterprises currently have a formal quantum-transition plan.

Threat Resistance

Addresses the Harvest Now Decrypt Later threat by deploying hybrid PQC key exchange on all encrypted channels. Protects against CRQC emergence through phased algorithm migration. Crypto agility architecture provides resilience against both quantum and classical algorithm compromises. Algorithm diversity (lattice + hash-based + code-based) prevents single-point cryptographic failure. Supply chain assurance prevents migration being blocked by vendor dependencies.

Assumptions

The organisation uses standard cryptographic protocols (TLS, SSH, IPsec) and has a PKI infrastructure. Hardware security modules are in use for key management. The organisation has data with confidentiality requirements exceeding 10 years. Symmetric encryption (AES) is already deployed for data at rest.

Developing Areas

• NIST PQC standards are finalised (FIPS 203/204/205) but the migration ecosystem remains immature. HSM vendors are still working toward combined FIPS 140-3 Level 3 validation with PQC algorithm support, certificate authorities are piloting hybrid certificates without production SLA commitments, and TLS library support varies across implementations. The gap between standard availability and production-ready tooling means that organisations starting migration in 2026 face significant integration engineering that will diminish as the ecosystem matures over 2-3 years.
• Hybrid certificates combining classical and PQC signatures are the recommended transitional approach but introduce practical challenges. An ML-DSA-65 certificate chain adds approximately 10KB compared to 1.5KB for ECDSA, impacting TLS handshake latency, certificate transparency log storage, and bandwidth-constrained channels. The IETF LAMPS working group is still finalising composite certificate formats, meaning early adopters face potential format changes. Negotiation of hybrid versus classical-only connections adds protocol complexity that load balancers and API gateways must handle correctly.
• Crypto agility in legacy systems is the hardest practical migration challenge. Many enterprise applications have hard-coded algorithm choices, use proprietary cryptographic libraries, or depend on middleware that does not support PQC algorithms. The CBOM (Cryptographic Bill of Materials) concept is sound but discovery tooling is immature -- automated scanning covers network protocols well but misses application-layer cryptography, data-at-rest encryption configurations, and embedded firmware crypto. Fewer than 5% of enterprises have completed a comprehensive cryptographic inventory.
• Harvest-now-decrypt-later (HNDL) threat urgency assessment is contested among practitioners. The timeline to cryptographically relevant quantum computers (CRQCs) remains uncertain, with estimates ranging from 10 to 30+ years. Organisations with long-lived sensitive data (government classified, patient records, trade secrets) face immediate HNDL risk, while those with shorter data sensitivity windows must balance migration investment against uncertain threat timelines. The Mosher equation (data shelf life + migration time versus time to CRQC) provides a framework but depends on unknowable inputs.
• PQC performance impact on constrained devices -- IoT sensors, embedded controllers, smartcards, and mobile devices -- is a significant deployment concern. ML-KEM key encapsulation is computationally efficient, but ML-DSA signature verification requires substantially more processing and memory than ECDSA. Devices with limited compute budgets may need hardware upgrades or alternative lightweight PQC schemes (currently under NIST evaluation as additional standards) that are not yet standardised. This creates a multi-year gap where constrained device populations cannot participate in PQC migration.

Related Patterns

Patterns that operate within or alongside this one. Click any to view.