Abstract: This study investigates quantum-safe modernization strategies for critical infrastructure by proposing a rigorous post-quantum (PQ) migration and verification framework that treats cryptographic transition as a safety-critical, multi-system engineering program rather than a routine software upgrade. The core argument is that infrastructure operators face two coupled risks: (i) cryptanalytic obsolescence of classical public-key systems under cryptographically relevant quantum computing and (ii) operational fragility introduced by large-scale cryptographic refactoring across heterogeneous assets such as industrial control systems, substation automation, telecommunications backhaul, and safety instrumentation. To address both, the framework integrates inventory-driven migration planning, hybrid-mode interoperability controls, and verification evidence that is continuously auditable across the asset lifecycle. The manuscript operationalizes verification as a chain of assurance spanning algorithm selection, protocol composition, implementation conformance, and deployment governance. Standardized PQ primitives (e.g., ML‑KEM for key establishment and ML‑DSA/SLH‑DSA for signa-tures) are used as reference baselines, with explicit attention to size and performance implications that alter network and device constraints. Real-data collection is defined as standards-backed parameter extraction, vendor/firmware artifact inspection, and protocol telemetry capture in representative environments. Results are reported as decision-facing tables and figures that quantify payload expansion, transition milestones, and published performance overheads, alongside interpretation of their operational significance for safety and resilience. Keywords: post-quantum cryptography; ML-KEM; ML-DSA; SLH-DSA; CNSA 2.0; critical infrastructure; migration governance; protocol verification; conformance testing; cryptographic agility
Abstract: This study investigates quantum-safe modernization strategies for critical infrastructure by proposing a rigorous post-quantum (PQ) migration and verification framework that treats cryptographic transition as a safety-critical, multi-system engineering program rather than a routine software upgrade. The core argument is that infrastructure operators face two coupled risks: (i) cryptanalytic obsolescence of classical public-key systems under cryptographically relevant quantum computing and (ii) operational fragility introduced by large-scale cryptographic refactoring across heterogeneous assets such as industrial control systems, substation automation, telecommunications backhaul, and safety instrumentation. To address both, the framework integrates inventory-driven migration planning, hybrid-mode interoperability controls, and verification evidence that is continuously auditable across the asset lifecycle. The manuscript operationalizes verification as a chain of assurance spanning algorithm selection, protocol composition, implementation conformance, and deployment governance. Standardized PQ primitives (e.g., ML‑KEM for key establishment and ML‑DSA/SLH‑DSA for signa-tures) are used as reference baselines, with explicit attention to size and performance implications that alter network and device constraints. Real-data collection is defined as standards-backed parameter extraction, vendor/firmware artifact inspection, and protocol telemetry capture in representative environments. Results are reported as decision-facing tables and figures that quantify payload expansion, transition milestones, and published performance overheads, alongside interpretation of their operational significance for safety and resilience. Keywords: post-quantum cryptography; ML-KEM; ML-DSA; SLH-DSA; CNSA 2.0; critical infrastructure; migration governance; protocol verification; conformance testing; cryptographic agility
The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.
Large-scale quantum computers would invalidate the hardness assumptions behind many deployed public key cryptosystems and reduce the effective strength of symmetric primitives. As a result, governments and industry have begun a multi-year transition toward post quantum cryptography and quantum safe protocols. This survey provides a structured overview of that transition. It classifies the main families of post quantum schemes, with emphasis on the standardized lattice based and hash-based algorithms ML-KEM, ML-DSA, SLH-DSA, FALCON and Classic McEliece, and it summarizes their parameter sets, key sizes, ciphertext or signature lengths and performance profiles across the NIST security categories. The survey then reviews stateful hash-based signatures, multivariate and isogeny-based proposals and emerging MPC in the head constructions and discusses their security assumptions and level of maturity. At the protocol level it analyzes hybrid designs for TLS 1.3, QUIC, IPsec, SSH and public key infrastructures and draws lessons from early deployments in web, IoT, and cloud environments. By collating detailed parameter data from recent NIST standards and reference implementations and mapping them to concrete deployment scenarios, the survey links high-level policy guidance to engineering choices. The paper also synthesizes cross cutting implementation and migration challenges, including side channel resistance, cryptographic agility, asset inventory and migration planning, and algorithm diversity across deployments. Finally, it identifies open problems such as leakage resilient implementations, domain specific post quantum profiles for constrained devices and combinations of post quantum cryptography with quantum key distribution. The goal is to give researchers and practitioners a coherent reference that connects algorithms, standards, protocol mechanisms and deployment guidance for building quantum safe systems.
Abstract: This study develops a public policy evaluation framework for quantum-safe cyber-defence in financial infrastructure, with emphasis on post-quantum cryptography, quantum communications and the governance of critical-sector resilience. The research addresses a strategic problem now facing central banks, payment operators, market infrastructures, commercial banks, fintech platforms and regulators: the public-key cryptographic foundations used for authentication, key establishment and digital trust will become exposed if a cryptographically relevant quantum computer emerges before high-value financial systems complete migration. The paper treats quantum risk not as a narrow algorithm replacement problem, but as a multi-layered policy challenge involving standards, operational continuity, procurement, vendor coordination, legal accountability, cyber-insurance, institutional capability and cross-border interoperability. The framework is grounded in real public evidence from standards bodies, cyber agencies and financial-system reports, including NIST post-quantum standards, NIST migration guidance, NCSC system-owner guidance, NSA post-quantum resources, BIS financial-system quantum-readiness work, BIS Project Leap and national quantum strategy evidence (NIST, 2023; NIST, 2024; BIS, 2025; OECD, 2025). The methodological contribution is a structured evaluation model that links cryptographic exposure, data longevity, systemic criticality, migration complexity and mitigation maturity into a risk-priority index. The results identify wholesale settlement, central counterparty clearing, securities settlement, cross-border financial messaging, certificate trust anchors and key-management services as the most urgent layers for cryptographic inventory, hybrid testing and staged transition. The analysis finds that post-quantum cryptography is the practical near-term route to scalable resilience, while quantum key distribution remains appropriate only for carefully bounded pilots unless cost, authentication and infrastructure dependencies are resolved. The paper concludes that quantum-safe financial infrastructure requires an integrated policy architecture built around cryptographic agility, real-time asset discovery, supervisory milestones, interoperable implementation testing, mathematically auditable decision rules and coordinated public-private transition governance. Keywords: post-quantum cryptography; quantum-safe finance; cyber-defence; financial infrastructure; public policy evaluation; quantum communications; critical infrastructure resilience; cryptographic agility; ML-KEM; ML-DSA; quantum readiness; payment systems
The emergence of cryptographically relevant quantum computing presents a strategic governance challenge for national security because contemporary digital infrastructures depend extensively on public-key cryptographic mechanisms whose long-term security may be threatened by sufficiently capable quantum computers. This research examines post-quantum cryptographic governance as a policy, risk-management, interoperability, and implementation problem rather than solely as a cryptographic algorithm-selection exercise. The study adopts a conceptual research-and-review methodology based exclusively on the supplied literature, using insights from security and privacy, interoperability, digital transformation, standards-based architectures, and emerging technology governance to construct an integrated post-quantum governance framework. Particular attention is given to cryptographic inventory, risk prioritization, migration governance, interoperability, institutional accountability, lifecycle management, and national-security continuity. The analysis indicates that post-quantum readiness requires coordinated governance across technical and organizational layers, with migration decisions guided by asset criticality, data longevity, dependency relationships, and operational constraints. The study further argues that interoperability principles are central to post-quantum migration because cryptographic transitions must coexist with heterogeneous legacy systems and distributed information environments. The proposed framework therefore combines risk assessment, policy development, technical migration, validation, monitoring, and institutional oversight. The research contributes a governance-oriented perspective in which cryptographic agility and standards-based interoperability become strategic national-security capabilities rather than isolated technical controls.
This paper examines the technical, operational, and governance challenges of migrating modern enterprise and cloud architectures to post-quantum cryptography (PQC). Following the National Institute of Standards and Technology's (NIST) release of finalized standards—including FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA)—organizations face significant friction regarding key and signature size inflation, protocol interoperability, and legacy infrastructure constraints. By analyzing these barriers, the study outlines practical transition strategies, emphasizing automated cryptographic discovery, hybrid deployment architectures, crypto-agility, and a phased, risk-based rollout program.
Brownfield supervisory control and data acquisition environments face a migration problem that is materially different from enterprise information technology. Post-quantum cryptography must be introduced into systems that privilege safety, deterministic communications, long asset lifetimes, staged outages, vendor-certified configurations, and protocol heterogeneity. At the same time, the public standards landscape changed rapidly between 2023 and March 2026, including finalization of the NIST ML-KEM, ML-DSA, and SLH-DSA standards, publication of NIST guidance for key-encapsulation mechanisms, growth of national migration roadmaps, and active standardization of hybrid and pure post-quantum handshakes for Transport Layer Security and Internet Key Exchange. This paper develops a framework for hybrid classical-post-quantum migration in brownfield SCADA settings that is evidence-based, implementation-oriented, and explicitly staged. We distinguish coexistence from true cryptographic hybridization, quantify control-plane overhead using official algorithm sizes and current protocol drafts, and propose a conduit-first migration sequence that prioritizes gateways, remote access, management planes, trust anchors, and software-signing services before intrusive field-device replacement. To support the applied-research claim, the framework is evaluated through standards-derived protocol-overhead analysis, a representative brownfield case demonstration, explicit scoring-model parameter rationale, sensitivity analysis, phase-gate validation criteria, and a pilot evidence package. The result is a practical path for operators who must begin quantum-safe preparation now, even where endpoint-native post-quantum support remains uneven.