Preparing for post-quantum migration and crypto agility
In short: Moving to post-quantum cryptography is a multi-year programme, not a quick patch. Start by assigning ownership and building a cryptographic inventory, then prioritise long-lived sensitive data and devices, test hybrid modes, and press vendors for roadmaps. Crypto agility means designing systems so algorithms can be swapped without rebuilding them.
Why plan now
Past cryptographic changes, such as retiring SHA-1 or old TLS versions, took many years even though the replacements were simple. The move to post-quantum cryptography is larger: public-key algorithms are everywhere, the new ones have different sizes and behaviour, and some devices in service today will still be running long into the future. National agencies, including the UK National Cyber Security Centre (NCSC) and US agencies, have published migration guidance and timelines that expect organisations to plan and act well before a quantum computer appears. Check the current guidance for your country and sector, because it is being updated.
Step 1 and 2: govern and discover
Give the programme a senior owner and include it in risk registers, procurement policy and architecture standards. Then build a cryptographic inventory: a list of where cryptography is used, which algorithms and key sizes, which libraries, who owns each system, and how long the data and the system must last. Some organisations record this as a Cryptographic Bill of Materials (CBOM), an extension of the software bill of materials idea.
Discovery combines several methods: scanning network endpoints, reviewing certificate stores, searching code and dependencies, checking hardware security modules (HSMs) and asking suppliers. For example, on systems you own or are authorised to test:
nmap --script ssl-enum-ciphers -p 443 192.168.10.0/24
openssl s_client -connect intranet.example.com:443 -brief < /dev/null
openssl x509 -in server.crt -noout -text | grep -E "Public Key Algorithm|Signature Algorithm"
ssh -Q kexStep 3 and 4: prioritise and migrate
| Priority | Examples | Why |
|---|---|---|
| Highest | Site-to-site VPNs, remote access, links carrying long-lived sensitive data | Exposed to harvest now, decrypt later |
| High | Roots of trust in long-lived devices, firmware and code signing, root CAs | Hard or impossible to change after deployment |
| Medium | Internal web services, APIs, SSH | Often fixed by upgrading libraries and platforms |
| Lower | Short-lived authentication, low-value data | Risk only once a quantum computer exists |
Most organisations will not write PQC code themselves. Migration usually means upgrading operating systems, libraries, browsers, VPN gateways, load balancers and PKI to versions that support the new algorithms, then enabling them. Begin with hybrid key exchange where it is available; plan signature and certificate changes alongside your PKI provider. Test carefully, since larger handshakes can expose MTU, fragmentation and middlebox problems.
Crypto agility and vendor management
Crypto agility means systems can change algorithms through configuration or a routine update, not a redesign. In practice that means:
- Use central, well-maintained crypto libraries and platform services instead of hard-coding algorithms in many places.
- Avoid fixed-size assumptions for keys, signatures and certificates in protocols and databases.
- Keep algorithm choices in policy and configuration, and log which ones are actually used.
- Automate certificate issuance and renewal so switching CAs or algorithms is not a manual project.
Put PQC requirements into procurement: ask suppliers which standards they support (FIPS 203, 204, 205), when hybrid modes will ship, and how devices will be updated in the field. Products bought today without an upgrade path may become tomorrow's hardest problem.
Tip: the inventory pays off even before quantum computers arrive. It reveals expired certificates, weak legacy algorithms and unknown systems, which are immediate risks in their own right.
Practice
What is a cryptographic inventory?
Why are long-lived IoT and OT devices a high priority?
What does crypto agility mean in practice?
Key takeaways
- PQC migration is a multi-year programme with a senior owner.
- Start with a cryptographic inventory covering infrastructure, code, devices and suppliers.
- Prioritise HNDL-exposed links and long-lived roots of trust.
- Migrate mostly by upgrading platforms and enabling hybrid modes, then test.
- Build crypto agility and put PQC requirements into procurement.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.