PQC Migration Roadmap

Understand what cryptography you have, where it is, and what is most at risk. Most organisations have no cryptographic inventory — this phase creates one.

• Conduct a cryptographic inventory: identify every system, service, certificate, and protocol using public-key cryptography (TLS certificates, SSH keys, VPN configs, code signing, API auth, database encryption).
• Classify by data sensitivity and secrecy period — data that must stay secret for 10+ years is highest priority.
• Assess cryptographic agility: for each system, can the algorithm be swapped via config (agile), requires code change (semi-agile), or requires redesign (brittle)?
• Prioritise: critical internet-facing TLS infrastructure first, then internal high-sensitivity systems, then lower-risk internal systems.
• Evaluate PQC-capable versions of your current tools: TLS libraries (OpenSSL 3.x), SSH (OpenSSH 9.0+), VPN (StrongSwan), certificate management.
• Identify vendor dependencies: which vendors/SaaS providers are on your PQC migration roadmap? Ask them for their timeline.
• Designate a cryptography migration owner — this cannot succeed without a named responsible person.
• Document current state as baseline for compliance and audit purposes.

Deploy hybrid classical+PQC algorithms for highest-priority systems. Hybrid provides quantum safety while maintaining backward compatibility with systems that don't yet support PQC.

• Enable X25519Kyber768 hybrid key exchange in TLS for all internet-facing web services — supported in Chrome, Firefox, Cloudflare, and AWS today.
• Enable PQC hybrid key exchange in OpenSSH 9.0+ for all SSH infrastructure (sntrup761x25519-sha512).
• Migrate high-priority VPN connections to PQC hybrid key exchange (StrongSwan, WireGuard PQ fork).
• Begin CA infrastructure upgrade — test hybrid X.509 certificates (classical + ML-DSA) using Let's Encrypt or internal CA.
• Update code signing infrastructure to support ML-DSA signatures (dual-sign with ECDSA during transition).
• Migrate key management systems (HSMs, KMS) to support ML-KEM — verify HSM vendor PQC roadmap.
• Replace AES-128 with AES-256 across all systems during this phase (separate from PQC but often done together).
• Update cryptographic libraries in all software to OQS-enabled versions (liboqs, BoringSSL, OpenSSL with OQS).

Remove hybrid classical algorithms. Operate entirely on NIST PQC algorithms. Decommission all quantum-vulnerable cryptographic infrastructure.

• Complete TLS certificate migration to pure ML-DSA or composite certificates — remove RSA/ECDSA from certificate chain.
• Decommission all RSA and ECC key pairs across PKI, SSH, VPN, and code signing infrastructure.
• Complete DNSSEC migration to ML-DSA signed zones.
• Achieve FIPS 203/204/205 compliance certification for systems requiring FIPS validation.
• Complete NSA CNSA 2.0 compliance for any systems processing classified or sensitive government data.
• Conduct post-migration cryptographic audit — verify no quantum-vulnerable algorithms remain in active use.
• Update cryptographic agility documentation — ensure future algorithm changes can be made without redesign.
• Establish ongoing cryptographic monitoring — detect any re-introduction of deprecated algorithms.