Unlocking the Quantum Era: Essential Steps for Post-Quantum Cryptography Readiness

Quantum computing is a field of study that focuses on the development of computer-based technologies centered around quantum theory principles. Quantum computing leverages the quantum mechanics idea of superposition, where something like a bit is in two states at once. This means that quantum bits, or qubits, can be in the state of both 1 and 0 at the same time, which provides much of the quantum computer’s processing power. Some mathematical problems solvable much faster by quantum computers are the basis for widely used cryptographic algorithms, such as factoring large numbers and solving discrete logarithms. Post-quantum cryptography (PQC) readiness means completing a cryptographic asset inventory, understanding which algorithms are quantum-vulnerable, tracking the NIST PQC standards finalized in August 2024, and executing a phased migration that addresses Harvest Now, Decrypt Later exposure. The recommended action: begin with a cryptographic inventory today, because migration cannot be planned or scoped without one. For a deeper explanation of how quantum computers actually threaten RSA and ECC, see What Is Quantum Computing and Why Does It Threaten Encryption.

Quick Answer: What Does PQC Readiness Actually Require?

PQC readiness requires four things in sequence: a complete cryptographic asset inventory identifying every quantum-vulnerable algorithm in use; a risk prioritization that identifies which systems carry Harvest Now, Decrypt Later (HNDL) exposure and must be migrated earliest; a migration plan aligned to NIST FIPS 203, 204, and 205 standards and CNSA 2.0 deadlines; and a crypto-agile architecture that can absorb future algorithm transitions without rewriting applications. NIST has set its sights on PQC standardization, and the standards are now finalized. The remaining work is entirely on the enterprise side.

The NIST PQC Standards: What Was Finalized and When

NIST finalized its first three PQC standards in August 2024, after an eight-year standardization effort. Understanding what was standardized and when matters because migration planning must target the finalized standards, not candidate algorithms that may still change:

Standard	Algorithm	Derived from	Use	Status
FIPS 203	ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)	CRYSTALS-Kyber	Replacement for RSA key transport and ECDH in key exchange	Finalized August 2024
FIPS 204	ML-DSA (Module-Lattice-Based Digital Signature Algorithm)	CRYSTALS-Dilithium	Primary replacement for ECDSA and RSA signatures	Finalized August 2024
FIPS 205	SLH-DSA (Stateless Hash-Based Digital Signature Algorithm)	SPHINCS+	Alternative signature algorithm; security based on hash hardness, not lattices	Finalized August 2024
FIPS 206	FN-DSA (Fast-Fourier Transform over NTRU-Lattice-Based Digital Signature Algorithm)	FALCON	Efficient lattice-based signature; smaller signatures than ML-DSA	Initial Public Draft late 2025; finalization expected 2026-2027
HQC (future standard)	HQC	Error-correcting codes	Second KEM; non-lattice backup to ML-KEM	Selected March 2025; not yet finalized as FIPS

But Which Algorithms Are Safe and Which Are Not?

Several robust cryptography techniques may be vulnerable to attacks by quantum computers. If we list out the algorithms that could be susceptible to quantum attack, we get the list below:

• RSA (Rivest-Shamir-Adleman)

  This algorithm exploits the fact that large semiprime numbers are difficult to factor. Shor’s algorithm breaks RSA because it is a quantum algorithm that factors large numbers in polynomial time.

• DSA (Digital Signature Algorithm)

  DSA is susceptible to attacks involving the discrete logarithm problem. Quantum computers can solve this problem more efficiently, weakening the security of DSA.

• ECDSA (Elliptic Curve Digital Signature Algorithm)

  Similar to DSA, the security of ECDSA is based on the hardness of the elliptic curve discrete logarithm problem, which quantum computers can exploit using Shor’s algorithm.

• Diffie-Hellman key exchange (and its variants)

  The security of Diffie-Hellman depends on the difficulty of the discrete logarithm problem. Quantum computers can break this security assumption using Shor’s algorithm.

Algorithms that are considered safe from quantum computers at current key sizes include:

• Hashes

  Cryptographic hashes (like SHA-2, SHA-3, BLAKE2) are considered quantum-safe for now, though Grover’s algorithm provides a quadratic speedup for preimage attacks, which is why SHA-256 and larger outputs are preferred.

• Symmetric Ciphers

  Most symmetric ciphers (like AES-256, ChaCha20, Twofish-256, and Camellia-256) are considered quantum-safe. AES-128 provides a reduced security margin against Grover’s algorithm; AES-256 is preferred for post-quantum contexts.

• MAC algorithms

  MAC algorithms like HMAC and CMAC are considered quantum-safe.

• Key-derivation functions (bcrypt, Scrypt, Argon2) are speculated as quantum-safe (only slightly affected by quantum computing).

CNSA 2.0 Deadlines and Regulatory Timeline

NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0), issued in September 2022, sets binding deadlines for National Security Systems that flow down through the federal supply chain:

Deadline	Requirement
January 2027	New NSS acquisitions must support CNSA 2.0 algorithms
2027	Operating systems must support and prefer CNSA 2.0
2030	Software and firmware signing in NSS must use CNSA 2.0 exclusively; networking equipment (VPNs, routers) must use CNSA 2.0 exclusively
December 31, 2031	CNSA 2.0 algorithms mandated across NSS per NSA CNSA 2.0 FAQ
2033	Operating systems must use CNSA 2.0 exclusively; custom applications and legacy systems must be updated or replaced
2030 / 2035	NIST IR 8547 designates RSA-2048 and ECC P-256 for deprecation by 2030 and full disallowance by 2035

Cryptographic Inventory Prerequisites for PQC Migration

The starting point for any PQC migration is a cryptographic asset inventory. You cannot migrate what you have not mapped. Most large enterprises have cryptographic assets distributed across on-premises infrastructure, cloud environments, CI/CD pipelines, and IoT or operational technology devices. In most environments, a significant portion of these assets have no centralized tracking at all.

A practical inventory effort combines automated discovery tooling, network traffic analysis, and manual review of configuration files and certificate stores to identify:

• Every algorithm in use and where it is deployed
• The key sizes and expiration dates of deployed certificates
• The hardware and software dependencies that constrain which algorithms can be swapped in (HSM firmware support, TLS library versions, application code dependencies)
• The data flows that carry asymmetric-encrypted traffic with long-term confidentiality requirements (HNDL exposure)

Encryption Consulting’s CBOM Secure provides continuous discovery and inventory of cryptographic assets across enterprise infrastructure, cloud environments, applications, and cryptographic services. It generates and consumes Cryptographic Bills of Materials (CBOMs) that track certificates, keys, algorithms, and cryptographic dependencies continuously, not just at a point in time. For more on why cryptographic inventory is the non-negotiable first step, see Securing the Future with Cryptographic Inventory.

How Do You Plan for PQC Migration?

Although quantum computers capable of breaking current encryption do not yet exist at the required scale, organizations can and must begin preparing now. The following are the essential steps for PQC migration planning:

• Quantum Risk Assessment

  Performing a quantum risk assessment must be any organization’s first step while migrating to PQC algorithms. It creates a list of applications that will be affected by the creation of quantum computers, identifying the gap between the current cryptographic infrastructure and what needs to be implemented, and prioritizing by HNDL exposure and regulatory deadline pressure.

• Critical Data Identification

  After assessing the current cryptographic infrastructure, identify the organization’s data at risk. Determine which systems and data need to be prioritized and protected using post-quantum cryptography, particularly any data transmitted or stored today that must remain confidential for more than five years.

• Track NIST’s PQC Standards

  FIPS 203, 204, and 205 are finalized. Migration planning should target these standards. FIPS 206 (FN-DSA/FALCON) and HQC are still under development; monitor NIST’s publications and validate that your tooling and HSM vendor support the finalized algorithms before committing to them in production.

• Spreading Awareness

  Raise awareness among key stakeholders and employees about the importance of post-quantum cryptography and the potential impact of quantum attacks on your security posture. PQC migration requires cross-functional coordination across security, development, operations, and procurement teams.

• Crypto-Agility

  NIST has indicated that using crypto-agile solutions is a great way to begin moving towards having quantum-safe security in place. An environment designed with algorithm flexibility, where cryptographic primitives can be updated without rewriting applications or replacing hardware, can absorb PQC migration incrementally and will also handle future algorithm transitions more efficiently.

• Education and Training

  Invest in educating your IT and security teams about post-quantum cryptography and ensuring your staff is well-versed in the principles and best practices associated with quantum-resistant cryptographic algorithms. This includes understanding the performance and size differences of PQC algorithms relative to RSA and ECDSA and how those differences affect deployment decisions.

• Implement Transition Plans

  Develop and implement transition plans to upgrade your organization’s cryptographic algorithms to post-quantum algorithms. Be prepared to update hardware and software systems and Public Key Infrastructure (PKI) protocols and policies to accommodate these new cryptographic algorithms. Use hybrid mode (classical plus PQC) during the transition period to maintain interoperability with counterparties that have not yet migrated.

Algorithm and Interoperability Caveats

PQC algorithms introduce specific interoperability challenges that must be addressed before production deployment:

• Larger key and signature sizes: ML-KEM and ML-DSA produce significantly larger public keys and ciphertexts than RSA or ECDSA. TLS handshake message sizes increase, which can cause fragmentation issues in certain network configurations. Certificate chains carrying PQC signatures are larger and may approach or exceed limits in protocols with fixed maximum message sizes.
• HSM support gaps: many FIPS 140-3 validated HSMs do not yet support ML-KEM or ML-DSA. Organizations must track their HSM vendor’s roadmap for PQC support and plan for the FIPS 140-3 re-validation timeline before PQC keys can be generated and stored in hardware for regulated environments.
• TLS library readiness: TLS 1.3 implementations must be updated or patched to support PQC key exchange groups before a PQC TLS handshake can complete. Check your TLS library versions and vendor roadmaps before planning a production cutover.
• Hybrid mode during transition: running classical and PQC algorithms together for a session provides a migration path that maintains security against both classical and quantum adversaries while maintaining interoperability with non-PQC counterparties. Hybrid mode is the recommended approach during the transition period for most enterprise deployments.
• Algorithm diversity: SLH-DSA and HQC provide non-lattice alternatives to the primary lattice-based standards. Deploying algorithm diversity across different mathematical assumptions reduces the risk of a future advance in one class of algorithms compromising the entire post-quantum security posture.

PQC Implementation Checklist

• Complete a cryptographic asset inventory covering all algorithms, key sizes, certificate expirations, and hardware dependencies
• Identify HNDL-exposed systems and data flows with long-term confidentiality requirements
• Map regulatory obligations: CNSA 2.0 deadlines for NSS environments and supply chain; NIST IR 8547 deprecation timeline for all organizations
• Confirm HSM vendor roadmap for ML-KEM and ML-DSA support and FIPS 140-3 re-validation timeline
• Confirm TLS library versions and update schedule for PQC key exchange group support
• Design for crypto-agility: decouple cryptographic primitive selection from application logic
• Plan hybrid mode deployment for TLS and PKI during the transition period
• Pilot test PQC algorithms in a staging environment, validate interoperability with counterparties, and measure performance impact
• Establish CBOM (Cryptographic Bill of Materials) tracking to maintain visibility as the cryptographic inventory evolves
• Define internal migration deadlines that provide buffer before regulatory cutover dates
• Train IT and security teams on PQC algorithm properties, size differences, and migration procedures
• Retain testing evidence, configuration records, and migration approval records for compliance review

How Can Encryption Consulting Help?

In the ever-evolving landscape of cybersecurity, Encryption Consulting stands as a resource for organizations navigating the quantum transition. As practitioners in encryption advisory services, we specialize in orchestrating transitions to Post-Quantum Cryptography (PQC) as the next frontier in secure data management.

Encryption Consulting’s PQC Advisory Services deliver structured support across five phases: Cryptographic Discovery and Inventory, PQC Assessment, PQC Strategy and Roadmap, Vendor Evaluation and Pilot Testing, and Full Implementation. Our CBOM Secure platform provides the continuous cryptographic inventory required to maintain PQC readiness as the environment evolves. For organizations preparing for CNSA 2.0 supply chain requirements or NIST IR 8547 deprecation deadlines, we can help translate regulatory requirements into actionable migration plans.

Conclusion

It is crucial to acknowledge the significant threat that quantum computing poses to traditional information security systems. Organizations are strongly advised to strategize and implement a robust transition to quantum-safe cryptography, proactively addressing potential quantum threats. The NIST PQC standards are finalized, CNSA 2.0 deadlines are published, and the HNDL threat is active. Begin with the cryptographic inventory; everything else in the migration plan depends on it. For the full technical explanation of how quantum computers break RSA and ECC, see What Is Quantum Computing and Why Does It Threaten Encryption. For the Harvest Now, Decrypt Later threat in detail, see Harvest Now, Decrypt Later: Preparing for the Quantum Threat. For cryptographic inventory tools, see CBOM Secure.

Frequently Asked Questions

What NIST PQC standards have been finalized and what algorithms do they standardize?

NIST finalized three PQC standards in August 2024: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber) for key exchange; FIPS 204 (ML-DSA, derived from CRYSTALS-Dilithium) for digital signatures; and FIPS 205 (SLH-DSA, derived from SPHINCS+) as an alternative signature algorithm based on hash function hardness. FIPS 206 (FN-DSA/FALCON) is under development, and NIST selected HQC in March 2025 as a second KEM based on error-correcting codes.

Which cryptographic algorithms are vulnerable to quantum computers?

RSA, DSA, ECDSA, and Diffie-Hellman key exchange (including ECDH) are all vulnerable to quantum computers running Shor’s algorithm, which reduces integer factoring and discrete logarithm problems to polynomial time. Symmetric algorithms such as AES-256 and hash functions such as SHA-2 and SHA-3 are considered quantum-safe, though AES-128 provides a reduced security margin against Grover’s algorithm.

What is the Harvest Now, Decrypt Later threat and why does it require action now?

Harvest Now, Decrypt Later (HNDL) is a strategy in which an adversary collects encrypted data today and archives it until a cryptographically relevant quantum computer exists to decrypt it. The threat is present-day because the adversary’s collection window is already open. Any data that must remain confidential beyond the point at which a capable quantum computer could realistically exist is already at risk. CISA and NSA both cite HNDL as a primary driver for accelerating PQC migration timelines.

What are the CNSA 2.0 deadlines for National Security Systems?

New NSS acquisitions must support CNSA 2.0 as of January 2027. Software and firmware signing and networking equipment must use CNSA 2.0 exclusively by 2030. CNSA 2.0 algorithms are mandated across NSS by December 31, 2031. Operating systems and custom applications must reach exclusive use by 2033. NIST IR 8547 designates RSA-2048 and ECC P-256 for deprecation by 2030 and full disallowance by 2035.

What does a cryptographic inventory prerequisite involve for PQC migration?

A cryptographic inventory involves discovering and documenting every cryptographic asset across the enterprise: every algorithm in use, key sizes and certificate expiration dates, hardware and software dependencies, and data flows carrying asymmetric-encrypted traffic with long-term confidentiality requirements. The output is a prioritized list of systems by quantum risk exposure, with HNDL-exposed systems flagged for earliest remediation.

What are the interoperability caveats of deploying PQC algorithms?

PQC algorithms produce significantly larger key sizes and signature sizes than RSA or ECDSA, which can cause TLS handshake size issues. Many FIPS 140-3 validated HSMs do not yet support ML-KEM or ML-DSA. TLS 1.3 implementations must be updated for PQC key exchange. Hybrid mode (running classical and PQC algorithms together) is the recommended approach during the transition period to maintain interoperability with non-PQC counterparties.