Modern airliners are flying networks. The Boeing 787 and Airbus A350 carry hundreds of computers connected through ARINC 664 / AFDX (Avionics Full-Duplex Switched Ethernet) backbones. Air-to-ground messages flow over ACARS, with newer ACARS Message Security extensions providing cryptographic protection. Air traffic control communicates with aircraft over VHF voice, controller pilot data link communications (CPDLC), and increasingly satellite links. Each cryptographic touchpoint is engineered for safety integrity, and each one will eventually need to migrate from RSA and ECDSA to post-quantum equivalents. The Federal Aviation Administration (FAA), the International Civil Aviation Organization (ICAO), and the avionics industry standards bodies are all engaged on this transition, but the constraints unique to aviation, including weight, power, certification cycles, and decades-long aircraft lifecycles, make this one of the most demanding sector migrations.
This article walks through ARINC 664 / AFDX architecture, the cryptographic footprint of ACARS and CPDLC, ICAO Doc 9896 air-ground data link guidance, and how a post-quantum migration program should be structured around the safety and certification realities of aviation.
Why Aviation Cryptography Has Unusual Constraints
Aircraft are designed for 25 to 30 year service lives. The Boeing 737 family has been in production since 1967 with current variants likely flying into the 2050s. The Airbus A320 family has been in production since 1987 with similar longevity. Avionics systems installed today must therefore plan for cryptographic transitions across multiple decades. Quantum computers will arrive within that window with high probability.
Avionics also faces unusual physical constraints. Weight matters because every kilogram costs fuel for the life of the aircraft. Power matters because aircraft electrical systems are tightly budgeted. Heat matters because cooling is expensive in flight. Software certification under DO-178C and hardware certification under DO-254 take years, and any change to certified avionics requires a return to certification. These constraints shape PQC migration in ways that enterprise IT does not face.
For broader background see What Is Post-Quantum Cryptography and Harvest Now, Decrypt Later.
ARINC 664 / AFDX in the Avionics Backbone
ARINC 664 Part 7 specifies AFDX, the deterministic Ethernet network used in modern airliner avionics. AFDX provides redundancy, bandwidth allocation through Virtual Links, and bounded latency. The Boeing 787 Common Core System and the Airbus A350 IMA architecture both use AFDX as the backbone connecting flight controls, displays, communication systems, and dozens of subsystems.
AFDX itself does not specify cryptographic protection on the data plane. The avionics architecture treats the AFDX network as a closed, physically secured environment inside the aircraft, with cryptographic protection handled at the system boundaries (ACARS, CPDLC, satellite links, and increasingly inflight entertainment / connectivity systems). However, the integration of cabin-side and flight-deck-side networks, and the trend toward more software-defined avionics, increases the cryptographic attack surface.
For sector context see PQC for Government and Defense and the NIST FIPS Guide.
ACARS and ACARS Message Security
The Aircraft Communications Addressing and Reporting System (ACARS) is the legacy datalink protocol for air-to-ground messages. ACARS carries position reports, weather observations, maintenance data, flight plan updates, and operational messages. It runs over VHF, HF, and satellite links. The original ACARS protocol was designed without cryptographic protection, and unencrypted ACARS messages were widely captured and decoded by hobbyists and researchers throughout the 2000s and 2010s.
ACARS Message Security (AMS), specified by ARINC 823, provides cryptographic authentication and confidentiality for ACARS messages. AMS uses asymmetric cryptography (RSA today) for key establishment and symmetric cryptography for message protection. The deployed AMS base is small relative to total ACARS traffic, but it is growing as airlines adopt the standard for sensitive messages including flight plan updates, performance data, and security-related messages.
PQC migration in AMS is on the radar of the avionics industry. Migrating to hybrid post-quantum key establishment is the natural next step. The constraints are size and bandwidth: ACARS over VHF has very limited bandwidth (typically 2.4 kbps), and post-quantum public keys and ciphertexts are larger than RSA. Profile work is needed to fit PQC inside the bandwidth envelope.
Controller Pilot Data Link Communications
CPDLC is the modern data link replacement for some voice communications between air traffic controllers and pilots. CPDLC is specified by RTCA DO-258 / EUROCAE ED-100 (FANS-1/A) and DO-280 / ED-110 (ATN). CPDLC over satellite is increasingly common on transoceanic routes, with both Iridium and Inmarsat-based services in operation.
CPDLC has integrity and authentication requirements specified by ICAO Annex 10 and Doc 9896 (Manual on the Aeronautical Telecommunication Network using ISO/OSI Standards and Protocols) and Doc 9880 (Manual on Detailed Technical Specifications for the Aeronautical Telecommunication Network using ISO/OSI Standards and Protocols). The cryptographic profiles used in CPDLC vary by region and by service provider, with mostly classical primitives in the deployed base.
Migrating CPDLC to post-quantum requires coordination between ICAO, the regional ANSPs (FAA, EUROCONTROL, NavCanada, etc.), the satellite service providers, and the airlines. The timeline is multi-year and shaped by the aircraft equipage cycle and the satellite service provider roadmap.
ICAO Doc 9896 and Air-Ground Data Link
ICAO Doc 9896 specifies the Aeronautical Telecommunication Network (ATN) using ISO/OSI standards. The publication addresses end-to-end communication between aircraft and ground systems, including security profiles. The cryptographic profiles in Doc 9896 are based on classical algorithms (RSA, AES, SHA-2) and need migration to post-quantum equivalents over the coming decade.
ICAO's work on aviation cybersecurity has been gaining momentum. The ICAO Aviation Cybersecurity Action Plan and the related guidance documents establish the framework within which PQC migration will be evaluated. The ICAO Trust Framework Study Group has been examining identity, authentication, and cryptographic considerations for the broader aviation ecosystem.
ARINC 664 IFE Connectivity and the New Attack Surface
The cabin side of modern airliners increasingly connects to the internet through satellite or air-to-ground systems. Inflight entertainment (IFE), passenger Wi-Fi, and crew connectivity all flow through ARINC 664-style networks that are notionally separated from the flight deck network. The separation has been the subject of public scrutiny since the 2014-2015 reporting on the Boeing 787 network architecture.
PQC migration on the connectivity side is largely an enterprise IT migration in flight. The satellite providers (Inmarsat / Viasat, Iridium, Intelsat, SES) are all working on PQC roadmaps for their commercial broadband offerings. Airlines should require PQC commitments in their connectivity service agreements and should align cabin connectivity cryptographic posture with the broader enterprise PQC migration.
For broader sector context see PQC for Critical Infrastructure Grid.
DO-178C, DO-254, and the Certification Cycle
Avionics software is certified under DO-178C ("Software Considerations in Airborne Systems and Equipment Certification") at design assurance levels A through E. Hardware is certified under DO-254 at similar levels. Cryptographic libraries used in certified avionics must satisfy the certification objectives, which is non-trivial work.
Migrating cryptographic libraries from classical to post-quantum requires re-certification. The PQC algorithms are larger and more complex than RSA or ECDSA, with more code paths and more potential failure modes. Side-channel resistance for lattice-based algorithms requires careful implementation. The certification work for a PQC library at DO-178C Design Assurance Level A is substantial, typically 18 to 36 months from start to certification.
This is the dominant timeline constraint for avionics PQC migration. Cryptographic agility, in the sense of being able to swap algorithms via configuration, is hard to achieve inside DO-178C boundaries because every cryptographic configuration requires its own certification evidence.
Migration Strategy for Aviation
A practical migration sequence for an aviation operator starts with the ground side and works toward the air side. Step one is the airline's enterprise IT and operations control center (OCC) systems. Move to hybrid PQC on standard enterprise IT timelines. Step two is the airline's interface with ATC ground systems and with maintenance vendors and parts suppliers. These benefit from PQC and can move on a 3 to 5 year timeline.
Step three is the airline's aircraft fleet. New aircraft delivered after a certain date should specify PQC capability in the equipage. Existing aircraft will follow the natural avionics refresh cycle, with PQC arriving as part of new flight management systems, communications management units, and satcom terminals over a 10 to 20 year window.
The avionics industry standards bodies, including ARINC, RTCA, and EUROCAE, are the venues where the PQC profiles for aviation will be specified. Airlines and operators should be participating in these committees to ensure the profiles match operational requirements.
Air Traffic Management and the FAA NextGen Program
The FAA's Next Generation Air Transportation System (NextGen) program is modernizing air traffic management with new surveillance, communications, and information systems. Key NextGen components include ADS-B (Automatic Dependent Surveillance Broadcast), Data Comm (CPDLC over VDL Mode 2 and satellite), and System Wide Information Management (SWIM).
ADS-B does not currently encrypt the broadcast position reports, by design. The position data is treated as a public broadcast for situational awareness. Identification and authentication of ADS-B messages is a research area, with interest in cryptographic approaches that could distinguish authentic ADS-B messages from spoofed ones. Any such cryptographic protocol would benefit from post-quantum design.
SWIM is the FAA's information management system for aviation data exchange. SWIM uses standard web service security including TLS, and migration to hybrid post-quantum TLS is a natural step within the broader FAA enterprise IT modernization.
Airline Operations Control Center Cryptography
Airline operations control centers (OCCs) coordinate flight operations across the fleet, handling crew scheduling, dispatch, fuel planning, weather, and irregular operations. The cryptographic surface includes integration with FAA dispatch systems, weather data providers, fuel suppliers, ground handlers, and the airline's own aircraft via aircraft communications. PQC migration in the OCC layer aligns with airline enterprise IT migration timelines and provides a useful pilot ground for the longer airborne migration.
Pilot bag and EFB (electronic flight bag) systems are another important cryptographic surface. Modern EFBs run on tablets with airline-issued software for charts, performance calculations, and flight documents. The cryptographic protection of EFB content distribution and EFB-to-aircraft connectivity (via aircraft interface devices) needs PQC migration alongside the broader airline cryptographic refresh.
Frequently Asked Questions
Does the FAA require post-quantum cryptography?
Not by name as of 2026. The FAA's cybersecurity posture is evolving and aligned with broader U.S. federal expectations under NIST IR 8547 and CISA guidance. PQC mandates will likely come through the certification framework as FIPS-validated PQC modules become more common.
What is the biggest aviation PQC challenge?
The combination of long aircraft lifecycles, certification cycles measured in years, and weight/power/bandwidth constraints in avionics. Cryptographic agility is hard inside DO-178C boundaries, and PQC algorithms are larger than the classical equivalents they replace.
When will hybrid PQC arrive in ARINC 664 networks?
ARINC 664 is the network layer; cryptography sits at the application boundaries. Hybrid PQC will arrive incrementally in ACARS Message Security, CPDLC, satcom links, and IFE connectivity over the next decade as ARINC and ICAO publish updated profiles.
Can existing aircraft be upgraded to PQC?
For some systems, yes, through line-replaceable unit (LRU) upgrades to communications management units, flight management systems, and satcom terminals. The work follows the natural avionics refresh cycle, typically 7 to 15 years between major upgrades.
How does ICAO coordinate the migration?
ICAO publishes guidance through Annex 10 and the Doc 9896 family. ICAO panels including the Air Navigation Commission and the Aviation Cybersecurity Panel coordinate with regional ANSPs and industry standards bodies. The pace is measured but the direction is clear: aviation cryptography needs to migrate to post-quantum standards in alignment with NIST IR 8547 timelines.
Sources
- FAA. "NextGen Implementation Plan." faa.gov.
- ICAO. "Doc 9896: Manual on the Aeronautical Telecommunication Network using ISO/OSI Standards." icao.int.
- ICAO. "Doc 9880: Manual on Detailed Technical Specifications for the Aeronautical Telecommunication Network." icao.int.
- ARINC. "ARINC 664 Part 7: Avionics Full-Duplex Switched Ethernet." sae.org.
- ARINC. "ARINC 823: DataLink Security." sae.org.
- NIST. "NIST IR 8547: Transition to Post-Quantum Cryptography Standards." nist.gov.
- RTCA. "DO-178C: Software Considerations in Airborne Systems and Equipment Certification." rtca.org.
Related Articles
- What Is Post-Quantum Cryptography
- Harvest Now, Decrypt Later
- PQC for Government and Defense
- PQC for Critical Infrastructure Grid
- Hybrid Encryption
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.