What is post-quantum cryptography?
Post-quantum cryptography (PQC) refers to cryptographic algorithms that run on classical hardware yet withstand attacks from quantum computers. The public-key schemes in widespread use today — RSA and elliptic-curve cryptography (ECC) — rest on mathematical problems that a sufficiently capable quantum computer could solve using Shor's algorithm. PQC schemes draw on different problem classes, most notably lattice-based mathematics, for which no efficient quantum algorithms are known.
In August 2024, the US National Institute of Standards and Technology (NIST) finalised the first three PQC standards: FIPS 203 (ML-KEM, key encapsulation), FIPS 204 (ML-DSA, digital signatures) and FIPS 205 (SLH-DSA, hash-based signatures). For the first time, there is a normative reference framework against which governments, regulators and critical infrastructure operators can align their migration.
Why migration cannot wait
Two facts make migration a decision for the present, not the future. First: “harvest now, decrypt later.” State and non-state actors are already storing intercepted encrypted traffic to decrypt once quantum computers become available. Data with a long confidentiality horizon — health records, diplomatic communications, industrial secrets, state registers — is already at risk today.
Second, cryptographic migrations in large institutions routinely take a decade or longer. European regulation — notably the NIS2 directive and DORA in the financial sector — is additionally raising supervisory expectations that accountable officers understand and govern cryptographic risk. Those who begin now migrate in an orderly fashion; those who wait will migrate under duress.
Phase 1: Cryptographic inventory
Every migration begins with an inventory. Institutions must comprehensively record where and how cryptography is used: TLS termination, VPNs, signature and certificate infrastructures, HSMs, embedded systems, supplier and interface dependencies. The result is a Cryptographic Bill of Materials (CBOM) — the cryptographic analogue of a software bill of materials.
Experience shows that a substantial share of cryptography sits outside the visibility of central IT: in business applications, OT environments, procured services and legacy systems. Inventory is therefore not a purely tooling exercise but an organisational task with clear accountability at board or executive level.
Phase 2: Risk assessment and prioritisation
Not every system must migrate first. Prioritisation follows two axes: the required confidentiality horizon of the data and the remaining technical lifespan of the system. Systems that process data deserving long-term protection, or that anchor long-lived signature trust (root certificates, firmware signatures, archival signatures), take precedence.
This phase also establishes the institution's cryptographic agility: the ability to exchange algorithms without rebuilding systems. Hard-wired cryptography is the central obstacle to migration; agility is the central objective.
Phase 3: Implementation
Implementation proceeds in waves. The proven entry point is hybrid: classical and quantum-resistant schemes are combined (for example X25519 + ML-KEM in the TLS handshake) so that security holds even if one scheme falls. Internal public-key infrastructures, identity and signature services follow; external interfaces are migrated in step with partners and supervisors.
Certification and validation are not a formality but part of the architecture: FIPS 140-3 validated modules, audited implementations and documented key management create the demonstrability that supervisors and owners increasingly demand.
Phase 4: Operation and permanent agility
PQC is not a one-off project. Standards will evolve, parameters will be adjusted, implementations replaced. Institutions therefore need a permanent operating state: cryptography governance, regular re-inventory, defined replacement processes and supplier requirements that contractually secure cryptographic agility.
How CHANDAL supports institutions
Migration to quantum-resistant encryption touches infrastructure, software, procurement and supervision at once. The Programs division of CHANDAL Quantum Group supports institutions across the entire path — from cryptographic inventory through prioritisation to validated implementation in live systems, under Austrian law and fully accountable to European supervisory regimes.