CRC Press eBooks

Replacing vulnerable algorithms

Walt Powell

Published Dec 12, 2025• 0 citations

Abstract

This chapter provides practical guidance for replacing cryptographic algorithms vulnerable to quantum attacks, such as RSA, ECC, and Diffie-Hellman, with quantum-resistant alternatives approved or shortlisted by NIST. It explores transition strategies, including direct replacement with algorithms like ML-KEM, Dilithium, and Falcon, and hybrid deployment models that combine classical and quantum-safe algorithms for backward compatibility. Readers are introduced to deployment options within TLS 1.3, VPNs, code signing, authentication, and other cryptographic workflows, with references to relevant standards such as RFC 8784 (hybrid key exchange in IKEv2), RFC 9242 (hybrid authentication in TLS 1.3), and RFC 9370 (quantum-safe IPsec). The chapter discusses the complexity of implementing algorithm replacements in distributed environments, especially where legacy systems, hardware security modules (HSMs), and constrained devices introduce friction. It provides examples of dual-stack certificate usage and phased cutovers to help organizations minimize service disruption. Special attention is given to vendor compatibility, cryptographic agility, and open-source tools such as OpenSSL, BoringSSL, and liboqs, which are essential for pilot deployments and evaluation. Practical testing, fallback planning, and rollback strategies are included to manage risk during transition. K eywords : post-quantum cryptography (PQC), ML-KEM, CRYSTALS-Dilithium, Falcon, RSA deprecation, ECC replacement, hybrid certificates, dual-stack architecture, cryptographic algorithm migration, RFC 8784, RFC 9242, RFC 9370, TLS 1.3, quantum-safe VPN, IPsec, IKEv2, PQC libraries, OpenSSL, BoringSSL, liboqs, HSM compatibility, cryptographic agility, secure key exchange, post-quantum standards, interoperability testing.

DOI: 10.1201/9781003685760-16

Related papers

Post-Quantum Cryptography: Standardisation, Algorithms, and Deployment Migration

Bini P B

The prospect of cryptographically relevant quantum computers threatens public-key primitives underpinning modern digital infrastructure, including RSA, Diffie-Hellman, and elliptic-curve cryptography. Post-quantum cryptography (PQC) responds with algorithms believed to be hard for both classical and quantum adversaries. In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalised the first three PQC standards: FIPS 203 (ML-KEM, based on Kyber), FIPS 204 (ML-DSA, based on Dilithium), and FIPS 205 (SLH-DSA, based on SPHINCS+). This paper surveys the algorithmic families behind these standards, the harvest-now-decrypt-later threat model, hybrid migration strategies, performance trade-offs, and the engineering challenges of transitioning the global cryptographic stack. We examine deployment progress in TLS, SSH, X.509, and constrained devices, and outline open research questions on side-channel security, falcon-style signatures, and the long-term replacement schedule for classical asymmetric cryptography.

May 10, 20260 citations

Exploring Post-Quantum Cryptography: Review and Directions for the Transition Process

Kanza Cherkaoui Dekkaki, Igor Alexander Bello Tasic, Maria‐Dolores Cano

As quantum computing advances, current cryptographic protocols are increasingly vulnerable to quantum attacks, particularly those based on Public Key Infrastructure (PKI) like RSA or Elliptic Curve Cryptography (ECC). This paper presents a comprehensive review of Post-Quantum Cryptography (PQC) as a solution to protect digital systems in the quantum era. We provide an in-depth analysis of various quantum-resistant cryptographic algorithms, including lattice-based, code-based, hash-based, isogeny-based, and multivariate approaches. The review highlights the National Institute of Standards and Technology (NIST) PQC standardization process, highlighting key algorithms, such as CRYSTALS–Kyber, CRYSTALS–Dilithium, Falcon, and SPHINCS+, and discusses the strengths, vulnerabilities, and implementation challenges of the leading algorithms. In addition, we explore transition strategies for organizations, emphasizing hybrid cryptography to ensure backward compatibility during migration. This study offers key insights into the future of cryptographic standards and the critical steps necessary to prepare for the transition from classical to quantum-resistant systems.

TechnologiesNov 23, 202473 citations

Implementing quantum-safe cryptography into network infrastructure

Akbayan Bekarystankyzy, Amir Zhailin

As the era of quantum computing approaches, the fundamental cryptographic primitives securing global communications face a paradigm shift. With the National Institute of Standards and Technology (NIST) finalizing new standards, the industry must urgently address the vulnerabilities of legacy systems. The imminent advent of CRQCs (Cryptographically Relevant Quantum Computers) poses an existential threat to the Public Key Infrastructure (PKI) underpinning the global digital economy. Classical algorithms such as RSA and ECC (Elliptic Curve Cryptography) are vulnerable to polynomial-time cryptanalysis via Shor’s algorithm. This study investigates the HNDL (Harvest Now, Decrypt Later) threat model and evaluates the resilience of NIST-standardized PQC (Post-Quantum Cryptography) algorithms: ML-KEM and ML-DSA. Utilizing a high-performance Fortinet networking environment, we experimentally validate that "Hybrid Mode" IPsec VPNs can achieve quantum resistance with negligible performance degradation, offering a viable migration path for enterprise infrastructure. Specifically, we benchmark the trade-offs between PQC’s larger key sizes and network latency, demonstrating that the overhead remains within acceptable operational thresholds. Implementing hybrid protocols provides a critical transition mechanism, allowing organizations to secure long-term data confidentiality against retrospective decryption while preserving interoperability with legacy systems.

InterConfDec 30, 20250 citations

Develop a migration and testing plan

Walt Powell

This chapter outlines a comprehensive approach to building a post-quantum cryptography (PQC) migration and testing plan, turning strategic intent into operational action. It introduces a phased roadmap that includes setting migration criteria, defining success metrics, and staging pilot environments for crypto-agility validation. Emphasis is placed on identifying quick wins and high-risk cryptographic workloads that must transition first, while accounting for infrastructure dependencies, vendor constraints, and regulatory requirements. The chapter also presents simplified mitigation strategies, such as data withdrawal or crypto-isolation, for systems that cannot yet adopt quantum-safe algorithms. Readers are guided through practical test lab design, leveraging tools like OpenSSL, BoringSSL, liboqs, and Qiskit to evaluate PQC candidates in controlled environments. The chapter includes guidance on simulating algorithm swaps, measuring application compatibility, and documenting fallbacks for hybrid or dual-stack scenarios. Specific testing protocols are outlined for TLS, VPNs, code signing, encrypted storage, and other critical cryptographic functions, helping organizations uncover performance issues and interoperability gaps before deployment. The role of the Cryptographic Bill of Materials (CBOM) is reinforced as an input to track algorithm usage and inform targeted testing.

CRC Press eBooksDec 12, 20250 citations

Post-Quantum Cryptography (PQC) and Migration Strategies for Enterprise IT Infrastructure: Standards, Protocol Benchmarks, and Crypto-Agility

Yash Prashar, Tanishk Sharma, Vishal Shrivastava +2 more

Abstract—The advent of fault-tolerant Cryptanalytically Relevant Quantum Computers (CRQCs) presents an existential threat to modern information security. Shor's polynomial-time quantum algorithm renders widely deployed public-key cryptographic primitives—including RSA, Diffie-Hellman (DH), and Elliptic Curve Cryptography (ECDH/ECDSA)—completely vulnerable to private key derivation. Furthermore, 'Harvest Now, Decrypt Later' (HNDL) adversarial campaigns actively intercept and store encrypted enterprise telemetry today, anticipating future quantum decryption capabilities. In response, the National Institute of Standards and Technology (NIST) finalized its primary Post-Quantum Cryptography (PQC) standards in FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). However, transitioning complex enterprise IT ecosystems to quantum-resistant primitives introduces severe architectural and computational disruptions: public key and signature sizes increase by several orders of magnitude, cryptographic handshake latencies escalate, network packets experience Maximum Transmission Unit (MTU) fragmentation, and legacy Hardware Security Modules (HSMs) lack microarchitectural support for lattice-based polynomial arithmetic. This paper provides an exhaustive, mathematically grounded technical survey and architectural roadmap for enterprise PQC migration. We formalize the Module Learning with Errors (M-LWE) and Module Short Integer Solution (M-SIS) hardness foundations, evaluate hybrid classical/post-quantum cryptographic transition models across standard transport protocols (TLS 1.3, IKEv2/IPsec, SSH), and formulate an enterprise Crypto-Agility Maturity Model. Furthermore, we construct an empirical enterprise testbed measuring throughput, connection establishment latency, memory footprints, and packet fragmentation across legacy and quantum-resistant suites. Our results show that while ML-KEM-768 achieves microsecond-level encapsulation, its 1,088-byte ciphertext expands TLS ClientHello payloads into multiple TCP segments under constrained networks. Finally, we establish open research directions in post-quantum identity federations, stateful hash signature tracking, and hardware-accelerated polynomial arithmetic. Index Terms—Post-Quantum Cryptography (PQC), FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), Crypto-Agility, TLS 1.3, Lattice-Based Cryptography, Harvest Now Decrypt Later, Hardware Security Modules (HSM), Enterprise Migration.

Oct 9, 20260 citations

Comparative Analysis of Classical Public-Key Cryptography and NIST-Standardized Post-Quantum Algorithms with a Focus on Migration Strategies

Sreerasmi V M

The rapid developments in quantum computing pose a critical threat to classical public-key cryptography, particularly RSA and Elliptic Curve Cryptography (ECC), which rely on mathematical problems solvable by Shor’s algorithm. In response, the National Institute of Standards and Technology (NIST) has standardized quantum-resistant algorithms, including ML-KEM, ML-DSA, FALCON, and SPHINCS+, to prepare global infrastructure for a post-quantum future. This paper provides a unified comparative analysis of classical cryptography and NIST-standardized PQC algorithms, evaluating their security assumptions, efficiency, architectural characteristics, and resilience against quantum adversaries. A comprehensive literature review identifies gaps in existing studies, particularly concerning unified migration frameworks that combine theory, implementation requirements, certificate ecosystem changes, and organizational readiness. To address these gaps, the paper proposes a structured comparative framework and outlines practical migration strategies, including hybrid cryptographic deployment, protocol upgrades, and phased transition roadmaps. The findings highlight that while PQC introduces larger key and signature sizes, its quantum resistance and standardization maturity make it essential for long-term security. The study concludes that strategic migration planning, driven by hybrid adoption and ecosystem adjustments, is crucial for ensuring a secure and seamless transition to post-quantum cryptography

International Journal for Research in Applied Science and Engineering TechnologyDec 23, 20250 citations