The Migration & What Could Still Go Wrong

The Five-Phase Migration Roadmap

A standardised programme drawn from NIST, NCSC, and BSI guidance. The phases overlap; mature organisations run them in parallel.

Crypto-agility is the strategic outcome, not migration completion. New attacks, broken algorithms, and updated standards will continue arriving. Organisations that build systems where cryptography can be swapped without architectural change will navigate every future transition cheaply. Organisations that treat PQC as a one-off project will face this cost again.

PKI, HSMs & the Forgotten Layers

Replacing the algorithm is only the visible part. The cryptographic infrastructure beneath it — certificate authorities, hardware tokens, signed documents, identity systems — all need parallel migration.

Real-World Deployments Today

Post-quantum cryptography is no longer theoretical. Major technology companies have shipped production PQC to billions of users.

Libraries & Tooling Your Engineering Teams Will Use

Production-grade open-source implementations of the NIST standards already exist. The tooling decision is largely about ecosystem fit, not algorithm availability.

The dominant reference implementation is the Open Quantum Safe project (liboqs), maintained by an international collaboration with NIST coordination. It provides every NIST candidate and integrates with OpenSSL via the oqs-provider. For organisations using OpenSSL 3.x, this is the most direct path to PQC support.

Production libraries with PQC support include Cloudflare CIRCL (Go), BoringSSL (Google's TLS implementation), AWS-LC and s2n-tls (Amazon), Bouncy Castle (Java/.NET), wolfSSL (embedded), and PQClean (reference C implementations). Microsoft's SymCrypt includes PQC primitives for Windows ecosystems.

Hardware-accelerated PQC is emerging. Intel, ARM, and IBM are adding instruction-set extensions to accelerate lattice arithmetic. FPGA implementations are routine. The performance landscape will improve substantially through 2026–2028.

What Could Still Go Wrong

Post-quantum cryptography is not a finished story. Several risk vectors deserve continued attention from security teams and risk committees.

Lattice cryptanalysis is younger than RSA cryptanalysis. RSA's underlying assumption (integer factorisation difficulty) has 50 years of failed attacks behind it. Module-LWE has roughly 15 years. The cryptographic community considers lattices well-studied — but there is no proof, and another SIKE-scale surprise cannot be excluded.

Side-channel attacks against lattice implementations are an active research area. Timing leaks, power-analysis leaks, and fault injection have all been demonstrated against unprotected Kyber and Dilithium implementations. The mitigations exist but require careful engineering. Falcon's floating-point signing is particularly delicate. Implementation security, not algorithm security, is the realistic near-term threat.

Cryptographic monoculture risk. If most of the internet migrates to ML-KEM and ML-DSA — both lattice-based — a single mathematical breakthrough could affect both simultaneously. NIST's selection of HQC as a backup KEM and ongoing additional signatures round are explicit diversity insurance. Mature organisations should plan for multi-algorithm deployments.

Hybrid deployment increases attack surface. Running classical + PQC simultaneously means failure in either component requires careful handling. Implementation bugs in hybrid combiners have already been found. Sophisticated downgrade attacks against early TLS 1.3 PQC hybrids are documented.

Standards are not yet complete. FIPS 206 (Falcon) remains in draft. HQC standardisation is in progress. The additional signatures Round 2 will produce more algorithms. Organisations that lock in implementations too early may face rework. The opposite risk — waiting for "final" standards — is greater.

The Sceptical Counterpoint

Not every cryptographer believes a CRQC is imminent. A credible minority argues quantum computing may never reach cryptographic relevance. The strongest version of this case deserves engagement.

The strategic response is asymmetric: if the sceptics are right, PQC migration was inexpensive insurance with side benefits (crypto-agility, modernised PKI). If they are wrong and migration was skipped, the loss is catastrophic and irreversible — every secret protected by RSA or ECC during the harvest window becomes plaintext.

Standard risk-management practice in any domain with this asymmetry favours action. Boards should hear the sceptical view and weigh it, then conclude — as governments and major technology companies have concluded — that the cost of being wrong about quantum infeasibility vastly exceeds the cost of migration.