Post-quantum migration sounds like a problem for a decade from now, and for most of your systems it is. The exception is the one that makes it urgent: an adversary can record encrypted traffic today and decrypt it whenever a capable quantum computer exists. If the data has a confidentiality lifetime measured in decades — health records, legal files, state secrets, long-lived keys — then the exposure started the day it crossed the wire.
That is the entire argument for acting now, and it is worth separating from the broader anxiety, because it tells you exactly which systems to prioritise: the ones carrying data that still matters in 2040.
Key exchange first, and it is nearly free
Hybrid key exchange is the practical starting point and is already widely deployed: a classical elliptic-curve exchange is combined with a post-quantum KEM, and the session key is derived from both. An attacker must break both to recover it, so you gain quantum resistance without betting on a newer algorithm alone.
In most estates this is a configuration change at the edge — a supported TLS library, a cipher preference list, a load balancer setting — with a small handshake size increase and negligible CPU impact. It is the highest ratio of protection to effort available in this whole area.
# Confirm what your edge actually negotiated, rather than what the docs claim.
openssl s_client -connect api.example.com:443 -groups X25519MLKEM768 </dev/null 2>&1 \
| grep -E 'Negotiated TLS1.3 group|Protocol|Cipher'
# Inventory is the real work. Find every place crypto is pinned in code:
grep -rnE 'RSA|rsa_|ECDSA|P-256|secp256|SHA1|pkcs1' --include='*.py' --include='*.go' src/
# And every certificate you will eventually have to reissue:
kubectl get secrets -A -o json \
| jq -r '.items[] | select(.type=="kubernetes.io/tls") | .metadata.namespace + "/" + .metadata.name'Signatures are the hard half
Confidentiality is retroactively vulnerable; authentication is not — a signature forged in 2035 cannot retroactively compromise a session from today. So signatures are less urgent, and considerably more disruptive to migrate. Post-quantum signatures are substantially larger, and size shows up in places with fixed budgets: certificate chains, firmware images, boot verification, embedded devices, hardware tokens that cannot be updated at all.
- Inventory first. Most organisations cannot list where cryptography is used, and you cannot migrate an unknown.
- Prioritise by data lifetime: anything confidential beyond ten years goes first.
- Turn on hybrid key exchange at the edge now; it is cheap and it stops the harvesting.
- Design for agility — algorithms behind an interface, no hardcoded curve names, certificate lifetimes short enough that rotation is routine.
- Ask vendors for their roadmap in writing. Hardware security modules and embedded devices have the longest lead times and the least flexibility.
The migration nobody plans for is not the algorithm change. It is discovering how many places in your estate have a curve name compiled in.
The durable outcome here is not post-quantum algorithms specifically. It is crypto agility: the ability to change primitives without re-architecting. Organisations that built that when they moved off SHA-1 found this migration to be a configuration exercise. Everyone else is about to rediscover the same lesson, more expensively, on a deadline set by someone else.