A cryptographic migration is a systems project. Software, certificates, libraries, devices, and external services need to change in a coordinated way, so preparation starts well before every deployment can switch algorithms.
The threat concerns particular mathematics
NIST's introduction to post-quantum cryptography explains why sufficiently capable quantum computers would threaten widely used public-key systems.
Post-quantum cryptography aims to provide algorithms resistant to such attacks while running on conventional computers. It is not the same thing as communicating through a quantum network.
The issue also includes long-lived information: encrypted material captured now could remain valuable if an attacker can decrypt it in the future.
Standards are a foundation for implementation
NIST published its first three finalized post-quantum standards in 2024. Its post-quantum project page distinguishes key-establishment and digital-signature standards.
That distinction matters because encryption-related key establishment and signing are different jobs. A migration plan needs to identify where each is used rather than treating cryptography as a single switch.
Inventory before replacement
The NCCoE migration project emphasises discovering quantum-vulnerable public-key uses and planning the transition.
Our suggested first worksheet has fields for the system, cryptographic function, responsible team, library or service provider, data lifetime, and available upgrade path.
For a hypothetical web service, this could uncover separate dependencies in TLS termination, identity tokens, software signing, and a third-party integration. Knowing who controls each one is more actionable than adding “quantum safe” to a roadmap.
Test the entire relationship
An algorithm choice becomes a deployment only when the surrounding systems interoperate. Our proposed test plan includes client compatibility, failure handling, performance measurements, and a documented rollback path.
For example, do not measure only one successful request from a current browser. Include the clients and services actually supported by the product. A migration that silently excludes an important integration has not met its operational goal.
Preserve precise claims
Avoid promising that a product is protected merely because one dependency added a new algorithm. Describe the protocol, component, version, and configuration that were verified.
The practical first step is therefore a readable inventory and an owned migration plan. Standards make implementation possible; careful engineering makes the resulting system usable.
For related account-security context, see Passkeys Change Login.
Cover: original AI-generated conceptual illustration.