The PQC Migration Is Not a Software Update

Post-quantum migration is not a patch cycle. Here's what it actually requires architecturally — inventory, hardware, sequencing, and accreditation.

Encryption has a limited lifespan. The quantum threat is real, NIST standards are finalized, and the need to begin migration is clear. Most programs now face the question of what migration entails.

The answer is more complex than anticipated. Post-quantum migration is not a simple patch or library update. It requires a thorough cryptographic inventory followed by a multi-year, sequenced replacement program. Programs often underestimate the scope by confusing these distinct processes.

Cryptographic Inventories

The one thing I don’t miss about my time in the service was inventory. Be it computers or some sort of asset. To be fair, I enjoyed it even less when I worked retail. It seems like knowing what assets you have must be important, and cryptography is no different.

Cryptography cannot be migrated unless it is fully mapped. While this may seem obvious, it is often overlooked. Again, we tend to think of inventories as physical assets or maybe licensing.

Cryptography is embedded in systems beyond what network scans, application inventories reveal, or what a bar code can tell us. Crypto exists in TLS configurations, authentication flows, certificate authorities, signing operations, key management systems, hardware security modules, and third-party dependencies with cryptographic libraries that may not have been reviewed. It also resides in firmware, automation scripts, and API credentials generated years ago that in some cases have likely never been rotated.

Organizations conduct regular inventories on hardware, licenses, heck even seating. Organizations that also perform cryptographic inventories consistently tend to have more accurate records of their environment. Inventories are living documents and should not be treated as a single event. Programs relying on a first-pass inventory often encounter overlooked assets during migration, resulting in costly discoveries.

Hardware Implementations

There are several cryptographic implementations that reside in hardware. Many of these contain components such as HSMs, smartcards, or network appliances with cryptographic accelerators that do not support post-quantum algorithms. The math is too much, and these devices lack a software upgrade path. This touches the hardware recap that must be considered.  This can be tricky for budgets as the physical replacement schedule will be the vendor's production timeline rather than the program's schedule. Or, more practically speaking, hopefully before an adversary breaks your encryption.

Hardware with a five-year lifecycle purchased in 2023 is running out of runway. While we could reasonably expect these devices to remain in service through 2028, that only holds if they support PQC today (unlikely) or they have an upgrade path (also unlikely). The unfortunate situation is that budgets will get hammered - from both the rising costs of hardware and the fact that we will need to recap before hardware is out of service life.

Sequencing the execution

Cryptographic uses vary in migration priority. Key exchange for synchronous sessions presents a different risk profile than signatures on long-lived certificates or encryption for archived data. Will certificates be issued for more than a day in the future? Will a 24-hour certificate even suffice? Migration sequencing should be based on data sensitivity and operational dependencies. This sequence can only be derived after the inventory and risk assessment is complete.

Sequencing the solution by workload (i.e easiest first) is ineffective for migrations where risk is concentrated in such specific algorithms protecting critical data. Proper sequencing begins with cryptographic uses that pose the highest collection and exposure risk. Convenience only comes into play when risks have been mitigated.

Dependency sequencing should be done carefully and deliberately. I would go as far as to say that dependencies should be mapped out as a byproduct of a crypto inventory. System A may require System B to support PQC key exchange before migration can proceed. If System B's vendor roadmap is delayed, then the migration sequence is at risk.

Regulation and Accreditation

Considering highly sensitive systems with formal security authorizations that operate in tightly regulated environments, the authorization boundary is defined by the cryptographic baseline. Any change in the configuration triggers a reaccreditation; a PQC migration changes the configuration. The review process for cryptographic changes of this scope differs significantly from routine software updates and may take months in some frameworks. Algorithm selections, key lengths, and protocol configurations all require documentation, review, and authorization.

Could you imagine the challenge if organizations are reacting to a quantum threat that can break pre-quantum encryption? The authorization conversation should happen at the beginning of migration planning, not after engineering design is finalized.

A well-structured migration plan should contain four elements:

• a comprehensive cryptographic inventory

• a hardware assessment identifying components needing physical replacement and considering if the budget and schedule leave room for those recaps within the migration timeline

• a sequencing analysis prioritizing risk and dependency

• an early engagement with the authorization authority regarding the review process for required cryptographic changes.

These steps are pre-migration activities and do not require migration to have begun. They determine whether the migration will be a managed program or an unstructured discovery process.

When I speak with my colleagues who work with vendors, there is a significant discussion around what PQC looks like. New hardware, new math, and more frequent certificate issuances. What once seemed science fiction is coming sooner than will be comfortable.  Artificial Intelligence is already proving that.

Cybaris Consulting guides infrastructure security architecture and modernization sequencing, including pre-migration planning to ensure PQC migration is managed rather than costly and reactive. Start a conversation at cybarisconsulting.com.