Post-Quantum Cryptography Migration
We are building long-lived digital infrastructure on cryptography that future quantum computers could break, but migration is slow and inventory is incomplete.
The Stakes
This is future-proofing trust. If today’s encrypted data is harvested now and decrypted later, we lose confidentiality retroactively: state secrets, health records, financial data, and private communications. Migration takes years because systems are embedded everywhere. Starting late is how civilizations get blindsided.
Headline evidence
- •In Aug 2024, NIST approved the first three Federal Information Processing Standards (FIPS) for post-quantum cryptography (PQC), finalizing standardized algorithms for transition【8†L930-L939】.
- •NIST’s PQC standardization timeline shows FIPS 203/204/205 published in 2024, with additional standards in development, setting the migration framework【8†L930-L939】.
- •The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a 2024 strategy recommending automated cryptography discovery and inventory tools for PQC, highlighting that unknown crypto usage is the migration bottleneck【8†L930-L939】.
Neglectedness
Why it stays neglected
The quantum threat is real but timeline uncertain, so incentives drift. Migration is tedious, costly, and easy to postpone. Many organizations don’t know where or how crypto is used, especially in third-party software and embedded devices. Security teams often lack mandate and tools to inventory at scale.
Tractability
Tractable because standards now exist and inventory automation is feasible. The hard part is scope: replacing crypto touches everything and any mistake is catastrophic. The smart approach is staged: discovery, prioritization, test harnesses to prevent outages. Tools must ensure interoperability and rollback if needed.
Startup surfaces
- •Automated cryptography discovery across codebases, networks, and devices with risk scoring
- •Migration copilots generating prioritized remediation plans and compatibility tests
- •PQC-ready key management systems and certificate infrastructure for hybrid crypto
- •Testing/verification harnesses catching performance, interoperability, and security regressions
- •Compliance reporting platforms for regulators tracking PQC progress
Source Stack (5)
- [1] National Institute of Standards and Technology. “NIST releases first finalized PQC standards” (news release). Aug 2024. (Announces FIPS 203-205)【8†L930-L939】.
- [2] NIST Cryptographic Standards Portal: Post-Quantum Cryptography. (Standards timeline FIPS 203–205)【8†L930-L939】.
- [3] Cybersecurity & Infrastructure Security Agency (CISA). “Strategy for PQC Discovery and Inventory Tools.” Sep 2024. (Federal guidance on PQC readiness)【8†L930-L939】.
- [4] NIST. FIPS 203, 204, 205 official publications. 2024. (Standards documents)【8†L930-L939】.
- [5] Industry groups (e.g. Cloudflare’s PQC rollout blog). (Practical experiences)【8†L930-L939】.
Builder Proof-of-Work
Community submitted artifacts, notes, and implementations for this idea.