Post-Quantum, In Practice
What migrating real systems to quantum-safe cryptography actually takes.
Dr. Lucas Fenn
Cryptography ResearcherMarch 3, 202616 min read
Why it matters now
Post-quantum migration is not a cryptography problem any more — the algorithms are standardised. It is an inventory problem, and most organisations discover they cannot answer the first question: where is cryptography actually used?
Harvest-now-decrypt-later makes the timeline concrete. Data with a long confidentiality horizon is already exposed, regardless of when a capable machine arrives.
How migration works in practice
Every team that finished this successfully followed roughly the same order.
The migration sequence
- Inventory. Find every certificate, key store, and hard-coded primitive. This takes longer than the migration itself.
- Prioritise. Rank by confidentiality lifetime, not by system importance. Long-lived secrets go first.
- Hybrid. Deploy classical and post-quantum together so a flaw in either does not break the channel.
- Rotate. Prove you can change algorithms under load. Crypto-agility is the actual deliverable.
Real-world examples
Certificate sprawl
One team found four times more active certificates than their asset register listed — most issued by services nobody owned.
Embedded firmware
Devices with ten-year field lifetimes could not be updated remotely, forcing a hardware refresh schedule.
Third-party edges
Vendor APIs became the long pole; contracts had no clause requiring algorithm agility.
Handshake overhead
Larger key sizes measurably affected latency budgets at the edge, changing capacity planning.
Frequently asked questions
Do we need to migrate everything?
No. Data with a short confidentiality lifetime can follow normal refresh cycles. Prioritise by how long a secret must stay secret.
Is hybrid mode a permanent state?
Treat it as a long transitional default. It costs little and removes the need to bet on a single algorithm.
What does this cost?
Overwhelmingly discovery and coordination, not compute. Budget for the inventory phase accordingly.
Conclusion
Crypto-agility is the real outcome. Teams that can rotate a primitive under production load are prepared for whatever standard follows this one.
Dr. Lucas Fenn
Cryptography Researcher · Cipher Collective
Working on post-quantum signatures, exploring homomorphic encryption, and able to help with protocol security.
VIEW PROFILE_
