Full Report
No organisation can navigate the migration alone; key takeaways from our first PQC migration workshop.
Analysis Summary
# Best Practices: Post-Quantum Cryptography (PQC) Migration
## Overview
These practices address the systemic risk posed by future quantum computers capable of breaking current public key cryptography (RSA, ECC). The goal is to transition organizational infrastructure to PQC algorithms to ensure long-term data confidentiality and integrity against both classical and quantum threats.
## Key Recommendations
### Immediate Actions
1. **Identify a Senior Sponsor:** Appoint a CTO, CIO, or CISO to represent PQC migration as a business risk at the board level.
2. **Conduct Initial Discovery:** Begin an inventory of internal and third-party systems that utilize public key cryptography.
3. **Engage the Supply Chain:** Start dialogues with vendors to understand their PQC roadmaps and readiness timelines.
4. **Prioritize High-Value Assets:** Identify "harvest now, decrypt later" risks—systems processing sensitive, long-lived data that must remain secure for 10+ years.
### Short-term Improvements (1-3 months)
1. **Build the Business Case:** Frame PQC as a resilience imperative rather than just a technical upgrade; emphasize that early planning reduces the cost of "compressed" transitions later.
2. **Define Cryptographic Inventory:** Document where cryptography is used, which algorithms are in place, and where dependencies on long-lived hardware exist.
3. **Benchmark Against Peers:** Use industry standards and peer activities to validate the migration timeline to leadership.
### Long-term Strategy (3+ months)
1. **Phased Roadmap Development:** Create a structured plan with specific milestones for 2028 and 2031 (aligned with NCSC targets).
2. **Address Legacy Technical Debt:** Use the PQC migration as a catalyst to decommission insecure legacy systems that cannot support modern cryptographic agility.
3. **Establish Multi-Disciplinary Teams:** Formalize collaboration between cryptographers, cyber security teams, and network operations.
## Implementation Guidance
### For Small Organizations
- **Focus on Procurement:** Ensure new hardware or software purchases are "quantum-ready" or upgradable via software.
- **SaaS Reliance:** Monitor and pressure service providers (cloud, email, banking) to manage the PQC transition on your behalf.
### For Medium Organizations
- **Audit Internal Tools:** Identify custom scripts or internal applications that use hard-coded cryptographic libraries.
- **Resource Allocation:** Dedicate specific budget lines for cryptographic discovery tools and talent training.
### For Large Enterprises
- **Cryptographic Agility:** Design systems to be "algorithm-agnostic" so that future cryptographic standards can be swapped without re-architecting the entire stack.
- **Supply Chain Pressure:** Mandate PQC readiness in RFPs and contracts for all critical infrastructure providers.
## Configuration Examples
*While specific code was not provided in the report, the guidance emphasizes:*
- **TLS/IPsec Updates:** Aligning configurations with updated NCSC guidance on security certificates.
- **Hybrid Key Exchange:** Implementing a combination of classical (e.g., ECDH) and PQC algorithms (e.g., ML-KEM) to maintain security during the transition period.
## Compliance Alignment
- **NCSC PQC Migration Timelines:** Targeting key milestones for 2028 and 2031.
- **IETF Standards:** Alignment with **RFC 9794** for standardized post-quantum terminology.
- **NIST:** Adherence to upcoming finalized PQC algorithm standards.
## Common Pitfalls to Avoid
- **Working in Silos:** Attempting a migration within IT without board-level buy-in or cross-departmental communication.
- **Waiting for Final Standards:** Delaying discovery and planning until algorithms are perfectly finalized; the "pre-work" (discovery and inventory) can and should happen now.
- **Underestimating Hardware:** Failing to account for long-lived hardware (IoT, industrial controls) that cannot be easily updated via software.
## Resources
- **NCSC PQC Guidance:** [https://www.ncsc.gov.uk/paper/next-steps-in-preparing-for-post-quantum-cryptography]
- **Migration Timelines:** [https://www.ncsc.gov.uk/guidance/pqc-migration-timelines]
- **Technical Standards:** RFC 9794 (Post-Quantum Terminology).