PQC Migration Overview
Migrating to post-quantum cryptography is a multi-year program, not a single upgrade. This page explains why migration must start now, how to reason about urgency with the risk equation, and the phased approach that the rest of this section details.
Why migrate, and why now
A cryptographically relevant quantum computer (CRQC) does not exist yet, but the threat is already actionable. Under harvest-now, decrypt-later (HNDL), an adversary can capture encrypted traffic and stored ciphertext today and decrypt it once a CRQC arrives. Any secret whose confidentiality must outlive the arrival of a CRQC is therefore already at risk.
Migration is slow for reasons that have nothing to do with quantum physics: cryptography is embedded in protocols, libraries, hardware, certificates, and trust stores that take years to inventory, replace, and redistribute. Mandates and guidance now set hard dates:
- US NSM-10 directs federal agencies to prepare for the migration to quantum-resistant cryptography.
- NSA CNSA 2.0 sets adoption milestones for national security systems, with full transition targeted across roughly 2030–2033 depending on the system class.
- NIST IR 8547 (initial public draft) sets out an expected path for migrating from quantum-vulnerable public-key algorithms to PQC: phasing out relevant RSA/ECC uses after 2030 and disallowing them in NIST-approved uses after 2035. The specific constraints depend on the applicable regulatory, procurement, or compliance framework.
- EU / BSI / ANSSI guidance pushes early adoption and, for specific assurance levels or contexts, requires hybrid deployments.
The risk equation (Mosca)
Mosca's inequality is a risk-judgment tool — a way to reason about urgency, not a precise predictive formula. Used that way, it helps you tell whether you are already late. Define:
- X — how many years your data must stay confidential (the secret's shelf-life).
- Y — how many years it will take you to migrate your systems to PQC.
- Z — how many years until a CRQC exists.
If X + Y > Z, you will be exposed before you finish migrating. Because Y (migration time) is itself measured in years for most enterprises, organizations holding long-lived secrets are already inside the danger zone. The practical conclusion: begin inventory and pilots now, regardless of when Z lands.
The phased approach
The remainder of this section breaks migration into repeatable phases. Treat them as a loop, not a one-shot project — you will re-inventory and re-prioritize as standards and your estate evolve.
| Phase | Goal | Key output |
|---|---|---|
| 1. Govern & inventory | Know what crypto you have and who owns it | CBOM, risk ranking via X+Y>Z |
| 2. Prioritize | Order assets by sensitivity, lifetime, exposure | Ranked migration backlog |
| 3. Pilot hybrid | Prove PQC in low-risk paths (TLS/VPN) | Working hybrid KEX in production-like env |
| 4. Crypto-agile rollout | Replace libraries so algorithms can be swapped | Abstraction layer, negotiated algorithms |
| 5. Migrate PKI & signing | Issue PQC/hybrid certs; firmware signing first | PQC-capable CA, LMS/XMSS for firmware |
| 6. Decommission & monitor | Retire legacy, re-assess continuously | Legacy disabled, monitoring in place |
How the pieces fit
Each phase maps to a dedicated page. Discovery feeds governance and prioritization. Crypto-agility is the engineering foundation that makes every later swap cheap. Hybrid is how you deploy PQC safely before implementations fully mature. PKI is usually the longest pole because trust stores propagate slowly. The playbook stitches these into an executable plan with owners and exit criteria.
Crypto-Agility →
Design systems so algorithms can be swapped without re-architecting.
Hybrid Cryptography →
Combine classical and PQC so security holds if either survives.
Discovery & CBOM →
Build a cryptographic inventory; you can't migrate what you can't see.
PKI Impact →
Larger keys, bigger certs, and slow trust-store migration.
Migration Playbook →
Step-by-step phases with actions, owners, and exit criteria.
Standards Timeline →
Mandate dates and deprecation milestones that set your deadline.
Standards & references
- NIST IR 8547 — initial public draft outlining a planned transition: deprecating RSA/ECC uses after 2030 and disallowing them in NIST-approved uses after 2035.
- NCCoE SP 1800-38 — practical migration guide with reference architectures.
- NSA CNSA 2.0 — adoption milestones for national security systems.
- ETSI Quantum-Safe Cryptography — standards and guidance for quantum-safe deployment.
- Resources — full standards register
PQC 迁移总览
迁移到后量子密码是一项跨越数年的工程，而非一次性升级。本页说明为何必须立即启动迁移，如何用风险方程判断紧迫性，以及本节其余页面将逐一展开的分阶段方法。
为何迁移 为何现在
能够威胁现行密码的量子计算机（CRQC）尚未出现，但威胁已经现实存在。在先收集后解密（HNDL）模式下，攻击者今天即可截获并存储加密流量与密文，待 CRQC 到来后再行解密。因此，任何机密性需要延续到 CRQC 出现之后的数据，此刻就已处于风险之中。
迁移之所以缓慢，原因与量子物理无关：密码被深度嵌入协议、库、硬件、证书与信任库之中，盘点、替换并重新分发这些资产需要数年。多项强制要求与指南已经划定了硬性时间线：
- 美国 NSM-10 要求联邦机构为迁移到抗量子密码做好准备。
- NSA CNSA 2.0 为国家安全系统设定了采用里程碑，依系统类别不同，全面过渡目标大致落在 2030 至 2033 年。
- NIST IR 8547 初始公开草案提出了从量子脆弱公钥算法迁移到 PQC 的预期路线：2030 年后逐步弃用相关 RSA/ECC 用法，2035 年后在 NIST 批准用途中禁用。具体约束取决于适用的监管、采购或合规框架。
- 欧盟 / BSI / ANSSI 的指南推动尽早采用，并在特定保障等级或场景下要求采用混合部署。
风险方程 Mosca
Mosca 不等式是一种风险判断工具——用于推断紧迫性，而非精确的预测公式。以此使用时，它可帮助你判断是否已经落后。定义：
- X——数据需要保持机密的年限（机密保鲜期）。
- Y——将系统迁移到 PQC 所需的年限。
- Z——距离 CRQC 出现还有多少年。
若 X + Y > Z，则你将在完成迁移之前就已暴露。由于对多数企业而言 Y（迁移耗时）本身就以年计，持有长寿命机密的组织实际上早已身处危险区。务实的结论是：无论 Z 何时到来，都应立即启动盘点与试点。
分阶段方法
本节其余内容将迁移拆解为可重复的阶段。请将其视为循环而非一次性项目——随着标准与资产现状演进，你需要反复重新盘点与重新排序。
| 阶段 | 目标 | 关键产出 |
|---|---|---|
| 1. 治理与盘点 | 摸清拥有哪些密码资产 由谁负责 | CBOM 基于 X+Y>Z 的风险排序 |
| 2. 优先级排序 | 按敏感度 寿命 暴露面排序资产 | 排序后的迁移待办清单 |
| 3. 混合试点 | 在低风险路径验证 PQC（TLS/VPN） | 类生产环境中可用的混合密钥交换 |
| 4. 密码敏捷化推广 | 替换库以支持算法热插拔 | 抽象层 算法协商机制 |
| 5. 迁移 PKI 与签名 | 签发 PQC/混合证书 固件签名先行 | 支持 PQC 的 CA 用于固件的 LMS/XMSS |
| 6. 退役与监测 | 下线旧算法 持续重新评估 | 旧算法关闭 监测机制就位 |
各部分如何衔接
每个阶段对应一个专门页面。发现盘点为治理与优先级排序提供输入。密码敏捷是工程基石，让后续每一次算法替换都成本低廉。混合密码是在实现尚未完全成熟前安全部署 PQC 的方式。PKI 通常是耗时最长的一环，因为信任库传播极慢。实施手册将以上各环节串联成一份带责任人与退出标准的可执行计划。
密码敏捷 →
让系统在无需重构的前提下替换算法。
混合密码 →
结合经典与 PQC 算法 任一存活即保安全。
发现与 CBOM →
建立密码资产清单 看不见就无法迁移。
PKI 影响 →
更大的密钥与证书 缓慢的信任库迁移。
迁移实施手册 →
带行动 责任人与退出标准的分阶段步骤。
标准时间线 →
设定截止期限的强制要求与弃用里程碑。
标准与参考
- NIST IR 8547 — 初始公开草案 提出过渡路线：2030 年后逐步弃用 RSA/ECC 用法 2035 年后在 NIST 批准用途中禁用。
- NCCoE SP 1800-38 — 附参考架构的实操迁移指南。
- NSA CNSA 2.0 — 国家安全系统的采用里程碑。
- ETSI Quantum-Safe Cryptography — 量子安全部署的标准与指南。
- 资源链接 — 完整标准登记册