The target state
NIST's FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) define the algorithms. Its draft IR 8547 proposes deprecating 112-bit RSA and ECC in 2030 and disallowing them in 2035; sources note that hybrid schemes combining classical and post-quantum algorithms are treated differently.
Symmetric algorithms such as AES are not the focus of the transition.
Step 1: cryptographic inventory
Scan code and dependencies for crypto libraries, list certificates and their algorithms, and record every external service that terminates TLS or signs data on your behalf. Include HSMs, KMS keys, VPNs, SSO and code signing.
Tag each item with the confidentiality lifetime of the data it protects. Long-lived sensitive data goes first.
Step 2: hybrid key exchange
For TLS, hybrid key exchange that combines X25519 with ML-KEM protects traffic against future decryption while keeping classical security. Test it at your load balancers and CDN first, measure handshake size and latency, and watch for middleboxes that break on larger messages.
Step 3: crypto-agility
Centralise cryptographic choices in configuration and shared libraries rather than scattering algorithm names through code. Version signed artefacts so verifiers can accept old and new signatures during the transition.
Signatures will take longer than key exchange, because post-quantum signatures are larger and many protocols assume small ones. Plan that work for 2027–2030.
Sources
Have a project like this in mind?
Talk To Our Team →
