Post-Quantum Cryptography: A Practical Migration Checklist for IT Teams
By Karnelius Sindhu
Quantum computers that can break today’s encryption don’t exist yet. So why are security teams being told to start migrating now? Because the data you encrypt today can be stolen today and decrypted later, and because replacing cryptography across an entire organization takes years, not months.
This post explains the post-quantum threat in plain terms, walks through the standards and deadlines that matter, and gives IT teams a practical checklist to get started.
The Threat: Harvest Now, Decrypt Later
Most of the encryption protecting the internet relies on public-key algorithms like RSA and elliptic-curve cryptography (ECC). They secure TLS connections, VPNs, SSH, code signing, and certificates. Their security depends on math problems that are extremely hard for classical computers, but a large enough quantum computer running Shor’s algorithm could solve them.
Nobody knows exactly when that machine will arrive. But attackers don’t need to wait. They can capture encrypted traffic now and store it until quantum decryption becomes possible. This is called “harvest now, decrypt later.”
That turns the question around. It’s not “when will quantum computers arrive?” It’s “how long does my data need to stay secret?” If you handle medical records, government data, financial information, or trade secrets that must stay confidential for 10+ years, you’re already exposed.
Figure 1: Data captured today can be decrypted years from now.
The New Standards
After an eight-year public process, NIST finalized its first three post-quantum cryptography standards on August 13, 2024:
- FIPS 203 (ML-KEM): a key-encapsulation mechanism for establishing shared keys. It’s the replacement for key exchange uses of RSA and ECDH, for example in TLS.
- FIPS 204 (ML-DSA): the primary digital signature algorithm, replacing RSA and ECDSA signatures.
- FIPS 205 (SLH-DSA): a hash-based signature scheme. It rests on different math than the lattice-based options, so it serves as a conservative backup if a weakness is ever found in lattices.
NIST is also preparing FN-DSA (based on Falcon) as a future standard with smaller signatures, and in March 2025 selected HQC as an additional, non-lattice key-encapsulation algorithm.
The Deadlines That Matter
NIST’s draft report IR 8547, “Transition to Post-Quantum Cryptography Standards,” lays out the expected timeline for retiring quantum-vulnerable algorithms:
- After 2030: algorithms with about 112 bits of security, such as RSA-2048 and ECC P-256, are deprecated. They’re discouraged and shouldn’t be used for new deployments.
- After 2035: all quantum-vulnerable public-key algorithms, including RSA, ECDSA, EdDSA, ECDH, and classic Diffie-Hellman, are disallowed in NIST standards.
IR 8547 is still a draft and its details may be refined, but the direction is clear. For national security systems, the NSA’s CNSA 2.0 guidance sets its own, earlier migration milestones. If you support federal customers or contractors, expect these dates to show up in contracts and audits.
Get Karnelius Sindhu’s stories in your inbox
Join Medium for free to get updates from this writer.
Hybrid approaches, which combine a classical algorithm with a post-quantum one, are a common transition strategy. Major browsers and CDNs already use hybrid key exchange for TLS, so a lot of your web traffic may already be partly protected without you noticing.
Figure 2: A phased approach to post-quantum migration.
A Practical Migration Checklist
You don’t need a quantum physicist to start. You need the same skills you already use for asset management and change control.
1. Build a cryptographic inventory. Find where public-key cryptography is used: TLS certificates, VPN gateways, SSH keys, code signing, S/MIME email, Active Directory Certificate Services, IoT devices, and third-party SaaS. This inventory, sometimes called a cryptographic bill of materials, is the foundation for everything else.
2. Rank by data lifetime and exposure. Prioritize systems that protect long-lived sensitive data or traffic that crosses the internet. A VPN carrying patient data ranks far above an internal test server.
3. Talk to your vendors. Much of your cryptography lives inside products you don’t control: firewalls, load balancers, HSMs, cloud services. Ask each vendor for their post-quantum roadmap and put PQC support into procurement requirements.
4. Build crypto-agility. Avoid hard-coding a single algorithm into applications and scripts. Systems that can swap algorithms through configuration make this migration, and the next one, much easier.
5. Pilot hybrid modes. Test hybrid key exchange on non-critical services first. Watch for larger key and signature sizes, which can cause packet fragmentation, slower handshakes, and compatibility problems with older middleboxes.
6. Plan your PKI refresh. Certificates and trust anchors will need re-issuing with new algorithms. Start mapping your certificate authority hierarchy and certificate lifecycles now.
7. Retire legacy algorithms on schedule. Use the 2030 and 2035 milestones as hard project dates, and track progress the same way you’d track any other compliance effort.
Mapping It to Frameworks
If you work with the NIST Cybersecurity Framework, post-quantum readiness fits naturally. Asset inventory belongs under Identify, algorithm replacement and crypto-agility under Protect, and supplier requirements under supply chain risk management. For RMF environments, expect cryptographic controls in SC-12 and SC-13 to evolve as the standards mature.
Final Thoughts
Post-quantum migration isn’t a single upgrade. It’s a multi-year program, and the organizations that start with a solid inventory will be the ones that finish on time. The best time to begin was yesterday. The second-best time is this quarter.
Has your organization started a cryptographic inventory yet? Let me know where you’re stuck in the comments.
Sources and References
- NIST, FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard — https://csrc.nist.gov/pubs/fips/203/final
- NIST, FIPS 204: Module-Lattice-Based Digital Signature Standard — https://csrc.nist.gov/pubs/fips/204/final
- NIST, FIPS 205: Stateless Hash-Based Digital Signature Standard — https://csrc.nist.gov/pubs/fips/205/final
- NIST, IR 8547 (Initial Public Draft): Transition to Post-Quantum Cryptography Standards — https://csrc.nist.gov/pubs/ir/8547/ipd
- Encryption Consulting, “NIST IR 8547 and SP 800–131A: The Algorithm Transition Timeline” — https://www.encryptionconsulting.com/education-center/nist-ir-8547-sp-800-131a-algorithm-transitions/
- PostQuantum.com, “NIST IR 8547: A Roadmap for Transitioning to Post-Quantum Cryptography” — https://postquantum.com/security-pqc/nist-ir-8547-ipd/
- CISA, NSA & NIST, “Quantum-Readiness: Migration to Post-Quantum Cryptography” — https://www.cisa.gov/resources-tools/resources/quantum-readiness-migration-post-quantum-cryptography
