PQC Migration: A Step-by-Step Plan for Hybrid Post-Quantum Cryptography

PQC Migration at a Glance

• What changes: public-key cryptography, meaning key exchange and key wrapping (RSA, Diffie-Hellman, ECDH) and signatures (RSA, ECDSA, EdDSA).
• What stays: symmetric ciphers such as AES-256 and hash functions such as SHA-2 and SHA-3.
• In what order: key establishment first, because recorded data can be decrypted later (harvest now, decrypt later); signatures next, before a large quantum computer exists.
• In what form: hybrid, for example X25519 with ML-KEM-768 in TLS, which current browsers already use by default.
• By when: see the deadlines table; most targets fall between 2028 and 2035.

Why Hybrid

A hybrid combines a classical algorithm (such as X25519 or Ed25519) with a post-quantum one (ML-KEM or ML-DSA), so an attacker has to break both. It protects against a flaw in the newer algorithms while still defending against quantum computers. This is how the most visible deployments work today: Chrome, Edge, Firefox and Safari use hybrid X25519MLKEM768 key exchange by default (Cloudflare's list), OpenSSH 10.0 uses hybrid mlkem768x25519-sha256 by default (release notes), and Signal's PQXDH pairs X25519 with a post-quantum KEM. For national security systems, NSA does not require hybrids under CNSA 2.0, though it expects product and interoperability needs to lead some systems to use them.

The 10-Step Plan

1. Assign ownership

Name an executive sponsor and a lead, and include the people who run networks, identity, storage, software signing and vendor contracts. The 2023 CISA, NSA and NIST quantum-readiness factsheet tells organizations to start planning now and to engage their vendors early.

2. Inventory your cryptography

List where RSA and elliptic curves are used: TLS and VPN endpoints, SSH, code signing, certificates, stored data and backups, identity systems and embedded devices. OMB M-23-02 directs US agencies to submit a prioritized inventory every year from 2023 until 2035, and CISA has a strategy for automated discovery and inventory tools (August 2024). QNSQY's scan, free on every plan, finds classical-cryptography files and writes a CycloneDX cryptography bill of materials. See how to inventory cryptographic assets.

3. Rank by data lifetime

Data that must stay secret for years is at risk now, because a recorded copy can be decrypted later. Mosca's inequality is a quick test: if the years the data must stay secret plus the years migration takes exceed the years until a quantum computer exists, migration should already be under way. Put long-lived data and the systems that carry it first.

4. Choose algorithms

• Key establishment: ML-KEM-768 for general use, ML-KEM-1024 for long-lived data or national security systems, combined with X25519 where a hybrid is used.
• Signatures: ML-DSA-65 for general use, ML-DSA-87 for national security systems; SLH-DSA where you want security that rests on hash functions alone; LMS or XMSS (NIST SP 800-208) for firmware and software signing.
• Symmetric and hash: AES-256 and SHA-384 or SHA-512 (or SHA-3).
• National security systems: CNSA 2.0 specifies ML-KEM-1024, ML-DSA-87, LMS or XMSS for software and firmware signing, AES-256 and SHA-384 or SHA-512.

5. Pilot on one new system

Turn on hybrid TLS 1.3 key exchange on a low-risk service and measure handshake time, message sizes and compatibility with older clients and middleboxes. OpenSSL 3.5 and later include ML-KEM, ML-DSA and SLH-DSA (release notes).

6. Roll out to the edge

Enable hybrid key exchange on load balancers, CDNs, VPNs and SSH. Some providers, Cloudflare among them, already negotiate it with clients that offer it; check what yours negotiates rather than assuming.

7. Move data at rest

Find stored data and backups whose keys are wrapped with RSA or elliptic curves and re-wrap or re-encrypt them with post-quantum key establishment, starting with long-lived records. Data encrypted only under a strong password with AES-256 is a lower priority. QNSQY encrypts files and folders with hybrid ML-KEM and X25519 on your own device.

8. Migrate signatures

Plan code signing, firmware updates, document signing and certificates. Long-lived signatures should move before a large quantum computer exists, since forged signatures would then be possible. Use LMS or XMSS for firmware where state can be managed safely, and ML-DSA or SLH-DSA elsewhere.

9. Bring vendors along

Ask suppliers of cloud services, VPNs, identity, backup and hardware security modules for dated PQC roadmaps, and write the requirement into renewals. For US agencies, CISA's product categories list (January 2026) names categories where PQC-capable products are already widely available, such as web browsers and servers, chat and messaging, cloud platforms and data-at-rest security.

10. Measure, then retire the old algorithms

Track the share of connections, stored data and signatures that use post-quantum algorithms, report it regularly, and set dates to turn off RSA and elliptic-curve options once their users have moved. NIST's draft plan would disallow them after 2035.

PQC Migration Deadlines

These dates were checked against the sources above on 19 October 2026. Draft documents can still change. For national security systems in detail, see the CNSA 2.0 deadline plan.

Common Pitfalls

• Migrating TLS but leaving stored data and backups whose keys are still wrapped with RSA.
• Forgetting firmware, embedded devices and hardware security modules, which have long upgrade cycles.
• Buying products that cannot change algorithms without a redesign (no crypto-agility). See crypto-agility explained.
• Underestimating the size of post-quantum keys, ciphertexts and signatures in constrained protocols.
• Assuming a product is FIPS 140-3 validated without checking its certificate, where your rules require validation.

Frequently Asked Questions

What is PQC migration?

Replacing RSA, Diffie-Hellman and elliptic-curve cryptography with NIST's post-quantum algorithms, ML-KEM for key establishment and ML-DSA or SLH-DSA for signatures, across protocols, stored data, software signing and identity systems.

Why migrate in hybrid form?

A hybrid combines a classical algorithm with a post-quantum one, so a flaw in either alone does not expose the data. Browsers, OpenSSH and Signal all use hybrids today. NSA does not require them for national security systems under CNSA 2.0.

What should move first?

Key establishment for data that must stay secret for years, because recorded traffic and files can be decrypted later. Signatures can follow, as long as they change before a large quantum computer exists.

How long does PQC migration take?

Years. The UK NCSC asks organizations to finish discovery and an initial plan by 2028 and migration by 2035, and NIST's draft transition plan would disallow quantum-vulnerable public-key algorithms after 2035.

Do I need FIPS-validated modules?

If a regulation or contract requires them. US federal agencies are required to use FIPS 140-3 validated modules to protect sensitive information, and NIST SP 800-171 Rev. 2 asks for FIPS-validated cryptography to protect controlled unclassified information. National security systems follow NSA's CNSA 2.0 and NSA-approved products.

What if a vendor cannot ship PQC yet?

Ask for a dated roadmap, write PQC requirements into renewals, and plan a replacement if the answer is not good enough. For US agencies, CISA lists product categories where PQC-capable products are already widely available.

Sources

1. CISA, NSA and NIST: Quantum-Readiness: Migration to Post-Quantum Cryptography (August 2023)
2. OMB M-23-02: Migrating to Post-Quantum Cryptography (November 2022)
3. CISA: Strategy for Migrating to Automated PQC Discovery and Inventory Tools (August 2024)
4. CISA: Product Categories for Technologies That Use Post-Quantum Cryptography Standards (January 2026)
5. Executive Order 14412, Federal Register (June 2026)
6. OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography
7. NSA: Announcing the Commercial National Security Algorithm Suite 2.0
8. NIST IR 8547 (initial public draft): Transition to Post-Quantum Cryptography Standards
9. NIST SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes
10. NIST SP 800-171 Rev. 2: Protecting Controlled Unclassified Information
11. UK NCSC: Timelines for migration to post-quantum cryptography
12. EU: Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography
13. Cloudflare: Post-quantum cryptography support
14. OpenSSL 3.5 release notes
15. OpenSSH 10.0 release notes

Related Articles

• What Is Post-Quantum Cryptography?
• Harvest Now, Decrypt Later
• Inventory Crypto Assets
• Crypto-Agility
• Implementing PQC
• Hybrid Encryption
• PQC Migration Budget
• Training Teams for PQC Migration