# ETSI TR 103 619: Migrating to Quantum-Safe Schemes **Source**: https://quantumsequrity.com/blog/etsi-tr-103-619 **Category**: Standards & Documents --- [← Back to Blog](../../blog.html) Standards & Documents # ETSI TR 103 619: Migrating to Quantum-Safe Schemes 11 min read In 2020, the European Telecommunications Standards Institute (ETSI) published Technical Report 103 619: "Migration strategies and recommendations to Quantum Safe schemes." It was one of the first comprehensive migration guidance documents in Europe. While NIST in the US was still finalizing PQC algorithms, ETSI was already thinking about the operational question: how do organizations actually move their cryptographic infrastructure? ETSI TR 103 619 sits in a different role than NIST IR 8547 or ISO/IEC standards. It is technical guidance, not regulation. It is published by an industry-driven standards body that focuses on telecommunications and ICT. Its recommendations carry weight because they reflect collaborative input from European telecoms, cryptographers, and industry vendors. Many European national bodies (BSI, ANSSI, NCSC) reference ETSI TR 103 619 in their own guidance. This post walks through what TR 103 619 contains: the migration framework, the hybrid mode guidance, the operational considerations. It compares ETSI's approach to NIST's IR 8547 and explains where the two converge and diverge. For organizations operating in Europe or interfacing with European systems, TR 103 619 is the practical migration reference. ## What ETSI TR 103 619 Covers TR 103 619 was published in July 2020. It runs about 90 pages and covers: - Threat model: who is the quantum attacker, what can they break, when - Inventory and assessment: how to identify cryptographic uses - Algorithm selection: what to migrate to (anticipating NIST PQC outcomes) - Hybrid schemes: combining classical and PQC for transition - Protocol-specific guidance: TLS, IPsec, S/MIME, VPNs - Sector considerations: telecom, banking, government The document is freely available from ETSI (unlike many ISO standards), making it accessible reference material. ## The ETSI Threat Model TR 103 619 articulates the threat model: - A cryptographically relevant quantum computer (CRQC) is expected within 10 to 20 years from publication date - Once available, all RSA, DSA, ECDSA, ECDH, DH key exchanges and signatures are vulnerable - Symmetric ciphers (AES) and hash functions (SHA-2, SHA-3) need only key/output size doubling for quantum resistance - Adversaries are already harvesting encrypted traffic to decrypt later This matches the NIST and NSA threat models. The 10 to 20 year timeline anchored at 2020 puts the CRQC arrival around 2030 to 2040, which aligns with current expert estimates as of 2026. ## The ETSI Migration Framework TR 103 619 lays out a six-phase migration: 1. **Inventory**: identify all cryptographic uses across the organization 2. **Risk assessment**: classify each use by data sensitivity, lifetime, exposure 3. **Strategy selection**: pure PQC, hybrid, or transitional approaches per use case 4. **Implementation planning**: vendor coordination, standards tracking, pilot deployments 5. **Deployment**: rollout in priority order 6. **Monitoring and maintenance**: track standard updates, algorithm health, key lifecycle This mirrors NIST IR 8547 phases (discovery, prioritize, plan, deploy, validate, retire). The substance is the same; the terminology differs slightly. See [NIST IR 8547](../nist-ir-8547-pqc-transition.html). ## Hybrid Mode Guidance A central recommendation in TR 103 619 is hybrid mode. The reasoning: - PQC algorithms are new. Confidence will grow with cryptanalysis. - A flaw in a PQC algorithm during the transition could leave systems exposed. - Combining classical (mature) with PQC (new) provides safety: security holds if either algorithm survives. ETSI specifies hybrid construction patterns: - **Concatenation**: ssK_hybrid = ssK_classical || ssK_pqc, then HKDF - **XOR**: ssK_hybrid = ssK_classical XOR ssK_pqc (only safe if both have full entropy) - **HKDF combiner**: ssK_hybrid = HKDF(ssK_classical, ssK_pqc, info) The HKDF combiner is the most widely adopted. It is what TLS hybrid drafts use, what IETF PQUIP recommends, and what QNSQY implements. See [hybrid encryption](../hybrid-encryption.html). ## Algorithm Recommendations TR 103 619 in 2020 could not name final NIST winners (those came in 2022). Instead it discussed candidate families: - **Lattice-based**: Kyber (now ML-KEM), Dilithium (now ML-DSA), Falcon (now FN-DSA) - **Code-based**: Classic McEliece, BIKE, HQC - **Hash-based**: SPHINCS+ (now SLH-DSA), LMS, XMSS - **Multivariate**: Rainbow (later broken) - **Isogeny-based**: SIKE (later broken) The lattice and hash-based families have proven most durable. Two candidates (Rainbow and SIKE) were broken between TR 103 619 publication and final NIST selection, illustrating why hybrid mode is wise. ETSI updates the recommendations as new ETSI documents publish. TS 103 744 (the hybrid KEX profile) and other ETSI Technical Specifications and Group Specifications carry forward the practical guidance. See [ETSI TS 103 744](../etsi-ts-103-744.html). ## Protocol-Specific Migration TR 103 619 covers migration approaches for specific protocols: ### TLS - TLS 1.3 is the migration target (TLS 1.2 should be retired) - Hybrid KEX during transition: classical group + PQC KEM in same handshake - IETF drafts will define hybrid named groups - Server and client both need PQC-capable libraries - Performance impact: larger handshake messages, more CPU ### IPsec / IKEv2 - Hybrid post-quantum key exchange via additional key share extensions - IETF RFC 8784 defines pre-shared key mixing for transition - Drafts in IPSECME working group define PQC KEM negotiation ### S/MIME and Email - Hybrid signatures (classical + PQC) on email - Long-lived encrypted email is highest priority due to harvest-now-decrypt-later - CMS protocol extensions for PQC ### VPN - WireGuard does not yet support PQC officially - IPsec-based VPNs lead the migration - TR 103 619 recommends pilot deployments ## Sector Guidance TR 103 619 discusses migration considerations by sector: ### Telecommunications 5G core network elements use cryptography heavily (subscriber identity confidentiality, network slicing, roaming agreements). PQC migration in telecom requires GSMA coordination, vendor cooperation, and timeline alignment with 5G evolution. ETSI ISG QSC continues this work. ### Banking and Finance Long-lived data (transaction archives, customer records) is high priority. Mixing PQC migration with PSD2 strong customer authentication updates makes sense. Card networks (Visa, Mastercard) coordinate global timelines. ### Government National security systems lead. CNSA 2.0 in the US, similar mandates in EU member states. Procurement language drives vendor priority. ### Healthcare Patient records have multi-decade confidentiality requirements. Hospital infrastructure runs decades-old systems. Migration is technically and operationally hard but compliance-mandated. QNSQY targets hospital and military deployments where data confidentiality requirements are decades-long. The hybrid PQC approach satisfies the long-lived data requirement TR 103 619 emphasizes. ## Cryptographic Agility TR 103 619 echoes other guidance documents on cryptographic agility: - Design protocols and applications so algorithms can change without rewriting - Negotiate algorithms at handshake; do not hardcode - Store algorithm identifiers in data formats - Build automated testing for new algorithms This is essential for PQC migration but also for the long term. Cryptographic agility is what allows the next migration (post-PQC, when something supersedes ML-KEM) to be smoother. ## The European Context ETSI is part of the European Standards Organization framework. Other European bodies that contribute to PQC migration: - **ENISA** (European Union Agency for Cybersecurity): publishes guidance, coordinates national responses - **BSI** (German Federal Office for Information Security): publishes technical guidelines, including BSI TR-02102 algorithm catalog - **ANSSI** (French national agency): publishes RGS (general security guidelines) - **NCSC** (UK National Cyber Security Centre): publishes guidance for UK organizations These bodies generally agree with TR 103 619's framework. National variations exist in algorithm preferences (ANSSI traditionally favors hybrid, BSI publishes detailed algorithm catalogs, NCSC emphasizes implementation maturity). For QNSQY users in Europe, the convergence means a single PQC strategy (NIST FIPS 203/204, hybrid mode, BSI-aligned) satisfies most national frameworks. ## Updates and Successor Documents TR 103 619 was published in 2020. Since then: - NIST finalized FIPS 203 and 204 (2024) - ETSI published TS 103 744 (hybrid KEX profile) - ETSI ISG QSC continues to publish use case documents - NIST IR 8547 (2024) covers similar ground from US perspective TR 103 619 remains valid as a framework document. The specific algorithm recommendations have been superseded by the NIST FIPS standards. Read TR 103 619 for the migration framework; read ETSI TS documents and NIST FIPS for the specific algorithms and parameters. ## How TR 103 619 Compares to NIST IR 8547 The two documents cover similar ground but with different emphases: - **NIST IR 8547** (2024): US federal focus, CBOM emphasis, alignment with CNSA 2.0 - **ETSI TR 103 619** (2020): European focus, hybrid mode emphasis, telecom and ICT use cases Practical advice: read both. They reinforce each other and a comprehensive migration plan benefits from both perspectives. ## ETSI ISG QSC and the Broader European Standards Family ETSI's Quantum-Safe Cryptography Industry Specification Group (ISG QSC) is the umbrella under which TR 103 619 and a family of related documents sit. Other key ETSI deliverables in this family: **TS 103 744** "Quantum-Safe Hybrid Key Exchanges": The technical specification for hybrid KEX, defining concrete combiner constructions and parameter sets. Published 2020, updated to v1.2.1 in 2022. This is the document protocols cite when they say "use the ETSI hybrid KEX combiner." **GR QSC 001** "Quantum-Safe Algorithmic Framework": A group report mapping use cases to algorithm families. Helps organizations choose algorithms based on their threat model. **GR QSC 003** "Case Studies and Deployment Scenarios": A group report with specific deployment patterns for telecom, government, and finance. **TR 103 823** "Quantum-Safe Identity-Based Cryptography": Looks at IBE/ABE post-quantum candidates. **TR 103 825** "Quantum-Safe Threshold Cryptography": Covers threshold signature and threshold KEM constructions. For organizations operating in Europe or following European standards, the QSC family is the canonical reference. ENISA, BSI, ANSSI, and NCSC frequently cite QSC documents in their national guidance. ## Migration Phases in the European Context The European Commission and member states have aligned on a phased migration approach that mirrors TR 103 619's framework but adds regulatory anchors: **Phase 1 (2024-2026): Inventory and Assessment** Member state cybersecurity agencies (BSI, ANSSI, NCSC, etc.) issue guidance for national critical infrastructure. Operators conduct cryptographic inventory. Procurement language begins to mention quantum-safe requirements. **Phase 2 (2026-2028): Pilot Deployments** Government and high-value private sector pilots deploy hybrid PQC. TLS 1.3 with hybrid KEX becomes available in major libraries. Telecom operators test PQ in 5G core networks. **Phase 3 (2028-2030): Production Rollout** Hybrid PQC becomes the default for new deployments. Legacy systems begin migration. Compliance frameworks update to require PQ for new high-assurance systems. **Phase 4 (2030-2035): Pure PQ Adoption** Pure PQ algorithms (no hybrid) become viable as confidence in PQ algorithms grows. Classical algorithms phase out for new deployments. Existing classical infrastructure migrates over time. This timeline aligns with NSA CNSA 2.0 in the US and similar mandates in other jurisdictions. The convergence reflects the global nature of cryptographic risk: a CRQC that breaks RSA in one country breaks RSA everywhere. ## TR 103 619 and the Telecom 5G Roadmap 5G networks use cryptography heavily. Subscriber identity confidentiality (SUCI) protects IMSI from over-the-air interception. Network slicing isolates customer traffic. Roaming agreements rely on cryptographic identity verification between operators. All of these depend on asymmetric cryptography vulnerable to CRQC. ETSI TR 103 619 specifically addresses 5G migration. Recommendations include: - Update 3GPP standards to support PQ algorithms in subscriber authentication - Migrate roaming key exchange to hybrid PQC - Plan 6G specifications with PQC as the default rather than an add-on - Coordinate with GSMA on global timeline 5G migration is a multi-year effort because the standards (3GPP) update on a slow cadence and equipment upgrades follow. Realistic timeline: PQ-ready 5G by 2028, broad deployment by 2030. ## FAQ ### Is ETSI TR 103 619 mandatory? No. ETSI Technical Reports are non-binding guidance. They become influential through reference in regulations and procurement. Many EU member state cybersecurity agencies cite TR 103 619 as a recommended starting point. ### Where can I get TR 103 619? ETSI publishes most documents free at https://www.etsi.org/. Search for "TR 103 619" or browse the Quantum-Safe Cryptography section. ### Has TR 103 619 been updated? The original 2020 version remains current. ETSI ISG QSC continues to publish related documents (TS 103 744 on hybrid KEX, GS QSC 001 on use cases) that complement TR 103 619 without superseding it. ### Does QNSQY follow ETSI TR 103 619 guidance? QNSQY's design aligns with TR 103 619 recommendations: hybrid mode (X25519 + ML-KEM, Ed25519 + ML-DSA), cryptographic agility (algorithm identifiers in QSPG v2 file format), and threat model anchored in harvest-now-decrypt-later. See [pricing](../../pricing.html). ### How does TR 103 619 compare to BSI guidance? BSI TR-02102 is more prescriptive (specific algorithm catalogs, key sizes, deprecation dates). ETSI TR 103 619 is more strategic (frameworks, hybrid mode, sector guidance). They complement each other; BSI provides the algorithm specifics, ETSI provides the migration strategy. ### What is the relationship between ETSI ISG QSC and 3GPP? 3GPP develops cellular standards including 5G and the upcoming 6G. ETSI ISG QSC focuses on the cryptographic primitives. 3GPP working groups (SA3 for security) consult QSC outputs when deciding which algorithms to integrate into cellular standards. The two organizations have overlapping membership and coordinate on timeline, but they publish independently. For PQ migration in 5G specifically, 3GPP TS 33.501 (the 5G security architecture) is the document that ultimately specifies which algorithms operators must support. ## Sources 1. ETSI TR 103 619 v1.1.1, "CYBER; Migration strategies and recommendations to Quantum Safe schemes," July 2020. https://www.etsi.org/deliver/etsi_tr/103600_103699/103619/01.01.01_60/tr_103619v010101p.pdf 2. ETSI ISG QSC, "Quantum-Safe Cryptography Industry Specification Group." https://www.etsi.org/committee/qsc 3. NIST IR 8547, "Transition to Post-Quantum Cryptography Standards," November 2024. https://csrc.nist.gov/pubs/ir/8547/final 4. ENISA, "Post-Quantum Cryptography: Anticipating Threats and Preparing the Future," October 2022. https://www.enisa.europa.eu/publications/post-quantum-cryptography-anticipating-threats-and-preparing-the-future 5. BSI Technical Guideline BSI TR-02102-1, "Cryptographic Mechanisms: Recommendations and Key Lengths." https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr02102/tr02102_node.html 6. ETSI TS 103 744 v1.2.1, "Quantum-Safe Hybrid Key Exchanges." https://www.etsi.org/deliver/etsi_ts/103700_103799/103744/ 7. 3GPP TS 33.501, "Security architecture and procedures for 5G System." https://www.3gpp.org/DynaReport/33501.htm ## Related Articles - [ETSI quantum-safe standards](../etsi-quantum-safe-standards.html) - [NIST IR 8547 PQC transition](../nist-ir-8547-pqc-transition.html) - [Hybrid encryption](../hybrid-encryption.html) - [Harvest now decrypt later](../harvest-now-decrypt-later.html) - [What is post-quantum cryptography?](../what-is-post-quantum-cryptography.html) --- ### Protect Your Data Before Q-Day Arrives QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats. [Try QNSQY](../../pricing.html)