Post-Quantum Cryptography Migration

Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to resist attacks from both classical and quantum computers. Unlike current public-key algorithms (RSA, ECC, Diffie-Hellman) that rely on integer factorization or discrete logarithm problems, PQC algorithms are based on mathematical problems believed to be hard for quantum computers: lattice problems (ML-KEM, ML-DSA), hash functions (SLH-DSA), code-based problems (Classic McEliece), and isogeny problems. NIST standardized the first three PQC algorithms in August 2024 after an eight-year evaluation process.

For a typical mid-size organization, the complete migration process takes 18-36 months from initial assessment to full production deployment. This includes 2-4 weeks for the cryptographic inventory, 4-8 weeks for architecture planning, 2-3 months for pilot implementation, and 6-18 months for phased production rollout. Larger enterprises with complex multi-cloud environments, legacy systems, or extensive partner ecosystems may require 3-5 years. The key variable is the number of cryptographic dependencies and the pace of vendor support for PQC algorithms.

Quantum key distribution (QKD) and post-quantum cryptography solve different problems and are not interchangeable. QKD uses quantum mechanics to distribute encryption keys and requires specialized hardware (single-photon detectors, quantum channels). It works over limited distances (typically under 100 km without quantum repeaters) and is impractical for internet-scale communications. PQC algorithms are software-based and can be deployed on existing infrastructure. The NSA has explicitly stated that QKD is not approved for protecting NSS and recommends PQC instead. For most organizations, PQC is the correct migration target.

PQC algorithms have different performance characteristics than classical algorithms. ML-KEM key encapsulation is actually faster than RSA key exchange in most benchmarks. However, ML-KEM and ML-DSA use larger keys and signatures, which increases TLS handshake sizes and may add latency on bandwidth-constrained connections. In PTG's pilot deployments, we typically see 1-3 ms additional latency per TLS handshake and 2-5% bandwidth increase. For most web applications, these differences are imperceptible. For high-frequency trading, IoT, or real-time systems, architecture planning addresses performance optimization.

NIST's August 2024 publications (FIPS 203, 204, 205) are finalized standards, not drafts. They are ready for production deployment. The hybrid mode approach (running classical + PQC simultaneously) provides an additional safety net: if an unexpected vulnerability is discovered in a PQC algorithm, the classical algorithm maintains protection while a fix is deployed. Waiting increases your HNDL exposure and compresses your migration timeline. NIST, NSA, CISA, and major technology companies (Google, Cloudflare, Amazon) all recommend starting PQC deployment now.

Symmetric algorithms (AES) and hash functions (SHA) are not broken by Shor's algorithm. Grover's algorithm provides a quadratic speedup for brute-force search, effectively halving the bit strength: AES-256 becomes equivalent to 128-bit security, and AES-128 becomes equivalent to 64-bit security. AES-256 and SHA-256 remain secure against quantum attacks. The only action required is upgrading any AES-128 instances to AES-256, which is typically a configuration change rather than an architectural migration. Your PQC migration focuses on public-key cryptography: key exchange, digital signatures, and key agreement protocols.

CMMC 2.0 requires FIPS-validated cryptography for CUI protection (based on NIST SP 800-171). As NIST's Cryptographic Module Validation Program (CMVP) adds PQC algorithm validations and deprecates quantum-vulnerable algorithms, CMMC compliance will increasingly require PQC. NSA CNSA 2.0 provides the specific timeline for National Security Systems. Defense contractors who proactively migrate to PQC will be ahead of their competitors when these requirements formalize. PTG's CMMC-RP and CCA credentials ensure your PQC migration documentation aligns with what CMMC assessors expect.

ML-KEM (FIPS 203) and ML-DSA (FIPS 204) serve different cryptographic functions. ML-KEM is a key encapsulation mechanism used for establishing shared secrets over insecure channels. It replaces RSA key exchange, ECDH, and Diffie-Hellman in protocols like TLS, IPsec, and SSH. ML-DSA is a digital signature algorithm used for authentication, code signing, certificate issuance, and document integrity. It replaces RSA signatures and ECDSA. Both are based on lattice cryptography but are not interchangeable. A complete PQC migration requires deploying both algorithms across your infrastructure.

Cost varies significantly by organization size, infrastructure complexity, and regulatory requirements. The primary cost drivers are HSM upgrades or replacements, engineering time for protocol and application updates, vendor license renewals for PQC-capable versions, and testing/validation. For a mid-size enterprise (500-5,000 endpoints), PTG's migration engagements typically range from $150,000 to $500,000 over the 18-36 month timeline. The initial readiness assessment and consultation are free, and we provide detailed cost projections before any engagement begins.

Yes. PTG produces all migration documentation in formats aligned to your compliance requirements. For defense contractors, this means CMMC-compatible evidence packages and SSP updates. For healthcare organizations, this means HIPAA Security Rule documentation. For financial services, this means PCI DSS audit evidence. CEO Craig Petronella holds CMMC-RP and CCA credentials, is a Licensed Digital Forensic Examiner, and has published 15 books on cybersecurity. Our compliance documentation has been accepted by CMMC assessors, HIPAA auditors, and PCI QSAs.