The standardization of post-quantum cryptographic (PQC) primitives by the U.S. National Institute of Standards and Technology (NIST) resolves the question of which algorithms enterprises should adopt, but it does not resolve how organizations establish, observe, and prove trust during a migration that will span many years and heterogeneous, long-lived systems. This paper argues that the binding enterprise problem in the post-quantum transition is not primitive selection but trust continuity: the ability to establish quantum-resistant trust and to produce durable, lifecycle-level evidence that it was established correctly. We introduce the Quantum-Secure Bootstrap Protocol (QSBP), an open protocol framework defined by four design requirements — algorithm agnosticism, event-driven operation, auditability, and forward compatibility — and expressed as a seven-stage trust-establishment lifecycle. QSBP is deliberately specified at the level of protocol shape and observable events rather than implementation: it describes the stages that should be visible and auditable without exposing cryptographic secrets or proprietary mechanics. We position QSBP as a proposed standard shape intended to make trust establishment legible to auditors, compliance officers, architects, and executives, not only to cryptographers. The contribution is a vocabulary and a lifecycle model for governing the transition period, offered for critique and standardization. Recent U.S. federal policy accelerating PQC migration for federal systems, contractors, and critical infrastructure sharpens the practical relevance of an auditable, governance-legible bootstrap framework. Keywords: post-quantum cryptography; trust continuity; cryptographic agility; auditability; protocol standardization; harvest-now-decrypt-later; critical infrastructure; cryptographic governance; quantum networking; enterprise security architecture
The standardization of post-quantum cryptographic (PQC) primitives by the U.S. National Institute of Standards and Technology (NIST) resolves the question of which algorithms enterprises should adopt, but it does not resolve how organizations establish, observe, and prove trust during a migration that will span many years and heterogeneous, long-lived systems. This paper argues that the binding enterprise problem in the post-quantum transition is not primitive selection but trust continuity: the ability to establish quantum-resistant trust and to produce durable, lifecycle-level evidence that it was established correctly. We introduce the Quantum-Secure Bootstrap Protocol (QSBP), an open protocol framework defined by four design requirements — algorithm agnosticism, event-driven operation, auditability, and forward compatibility — and expressed as a seven-stage trust-establishment lifecycle. QSBP is deliberately specified at the level of protocol shape and observable events rather than implementation: it describes the stages that should be visible and auditable without exposing cryptographic secrets or proprietary mechanics. We position QSBP as a proposed standard shape intended to make trust establishment legible to auditors, compliance officers, architects, and executives, not only to cryptographers. The contribution is a vocabulary and a lifecycle model for governing the transition period, offered for critique and standardization. Recent U.S. federal policy accelerating PQC migration for federal systems, contractors, and critical infrastructure sharpens the practical relevance of an auditable, governance-legible bootstrap framework. Keywords: post-quantum cryptography; trust continuity; cryptographic agility; auditability; protocol standardization; harvest-now-decrypt-later; critical infrastructure; cryptographic governance; quantum networking; enterprise security architecture
Abstract: This study investigates quantum-safe modernization strategies for critical infrastructure by proposing a rigorous post-quantum (PQ) migration and verification framework that treats cryptographic transition as a safety-critical, multi-system engineering program rather than a routine software upgrade. The core argument is that infrastructure operators face two coupled risks: (i) cryptanalytic obsolescence of classical public-key systems under cryptographically relevant quantum computing and (ii) operational fragility introduced by large-scale cryptographic refactoring across heterogeneous assets such as industrial control systems, substation automation, telecommunications backhaul, and safety instrumentation. To address both, the framework integrates inventory-driven migration planning, hybrid-mode interoperability controls, and verification evidence that is continuously auditable across the asset lifecycle. The manuscript operationalizes verification as a chain of assurance spanning algorithm selection, protocol composition, implementation conformance, and deployment governance. Standardized PQ primitives (e.g., ML‑KEM for key establishment and ML‑DSA/SLH‑DSA for signa-tures) are used as reference baselines, with explicit attention to size and performance implications that alter network and device constraints. Real-data collection is defined as standards-backed parameter extraction, vendor/firmware artifact inspection, and protocol telemetry capture in representative environments. Results are reported as decision-facing tables and figures that quantify payload expansion, transition milestones, and published performance overheads, alongside interpretation of their operational significance for safety and resilience. Keywords: post-quantum cryptography; ML-KEM; ML-DSA; SLH-DSA; CNSA 2.0; critical infrastructure; migration governance; protocol verification; conformance testing; cryptographic agility
Quantum computing poses a significant threat to blockchain systems that rely on elliptic curve cryptography and other classical security mechanisms. Algorithms such as Shor’s and Grover’s can weaken or completely break the cryptographic foundations of current blockchain networks, exposing them to risks including private key recovery, transaction forgery, consensus manipulation, and harvest-now-decrypt-later attacks. This paper presents a systems framework for designing quantum-resilient blockchains by integrating post-quantum cryptographic standards, threat modeling, architectural redesign, governance mechanisms, and migration planning. The study evaluates major post-quantum cryptographic primitives, assesses their suitability for blockchain environments, and proposes a layered architecture grounded in crypto-agility, defense-in-depth, and forward secrecy. A structured migration strategy is also introduced to support the transition of existing blockchain networks toward post-quantum security while maintaining operational continuity and stakeholder trust. The framework provides practical guidance for researchers, developers, and policymakers preparing blockchain ecosystems for the post-quantum era.
Abstract—The advent of fault-tolerant Cryptanalytically Relevant Quantum Computers (CRQCs) presents an existential threat to modern information security. Shor's polynomial-time quantum algorithm renders widely deployed public-key cryptographic primitives—including RSA, Diffie-Hellman (DH), and Elliptic Curve Cryptography (ECDH/ECDSA)—completely vulnerable to private key derivation. Furthermore, 'Harvest Now, Decrypt Later' (HNDL) adversarial campaigns actively intercept and store encrypted enterprise telemetry today, anticipating future quantum decryption capabilities. In response, the National Institute of Standards and Technology (NIST) finalized its primary Post-Quantum Cryptography (PQC) standards in FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). However, transitioning complex enterprise IT ecosystems to quantum-resistant primitives introduces severe architectural and computational disruptions: public key and signature sizes increase by several orders of magnitude, cryptographic handshake latencies escalate, network packets experience Maximum Transmission Unit (MTU) fragmentation, and legacy Hardware Security Modules (HSMs) lack microarchitectural support for lattice-based polynomial arithmetic. This paper provides an exhaustive, mathematically grounded technical survey and architectural roadmap for enterprise PQC migration. We formalize the Module Learning with Errors (M-LWE) and Module Short Integer Solution (M-SIS) hardness foundations, evaluate hybrid classical/post-quantum cryptographic transition models across standard transport protocols (TLS 1.3, IKEv2/IPsec, SSH), and formulate an enterprise Crypto-Agility Maturity Model. Furthermore, we construct an empirical enterprise testbed measuring throughput, connection establishment latency, memory footprints, and packet fragmentation across legacy and quantum-resistant suites. Our results show that while ML-KEM-768 achieves microsecond-level encapsulation, its 1,088-byte ciphertext expands TLS ClientHello payloads into multiple TCP segments under constrained networks. Finally, we establish open research directions in post-quantum identity federations, stateful hash signature tracking, and hardware-accelerated polynomial arithmetic. Index Terms—Post-Quantum Cryptography (PQC), FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), Crypto-Agility, TLS 1.3, Lattice-Based Cryptography, Harvest Now Decrypt Later, Hardware Security Modules (HSM), Enterprise Migration.
Introduction The rapid advancement of quantum computing presents an existential threat to the mathematical foundations of modern internet security. Fault-tolerant quantum computers are projected to reach the logical qubit scale necessary to execute Shor's algorithm by 2030–2035, threatening currently deployed public-key cryptography infrastructures. Methods We evaluate the performance metrics of integrating post-quantum cryptography (PQC), specifically the newly finalized NIST standards (FIPS 203, 204, and 205), with quantum key distribution (QKD) across communication networks. Results Our analysis demonstrates that while hybrid PQC-QKD models reduce long-term key compromise probabilities to near 0%, they introduce a 15% to 40% increase in bandwidth overhead during initial cryptographic handshakes. Discussion Given that enterprise-wide cryptographic migrations historically require 7–10 years, organizations face an immediate vulnerability window against “harvest now, decrypt later” adversaries. Ultimately, we propose a phased, cryptographically agile framework to achieve a Zero-Trust, Quantum-Safe network architecture within a 5-year implementation timeline.
Abstract: This study develops a unified approach to quantum-safe security in accounting and finance by linking concept analysis, a design framework, and implementation guidance to measurable risk reduction. Concept analysis distinguishes confidentiality lifetimes, “harvest-now-decrypt-later” exposure, and cryptographic dependence across ledgers, payments, reporting pipelines, and audit trails. Building on this, a layered framework is articulated comprising (i) threat taxonomy and impact surfaces for financial workflows; (ii) standards alignment with post-quantum cryptography (PQC) suites and crypto-agility policies; (iii) key- and certificate-lifecycle orchestration using HSM-backed services; and (iv) controls for ledger integrity, non-repudiation, and regulatory evidence. The core problem addressed is the absence of end-to-end, standards-compatible designs that deliver quantum resilience without disrupting performance, interoperability, or compliance. Methodology integrates formal threat modeling, standards mapping, and reference-architecture synthesis with scenario evaluation in representative financial processes (inter-system reconciliation, e-signature workflows, and archival protection). Results show that phased PQC migration with automated key rotation and dual-stack validation reduces exposure windows, preserves auditability, and maintains throughput within target bounds for typical batch and near-real-time workloads. Impact arises from procurement-ready patterns, crypto-agile runbooks, and assurance artifacts that support regulatory review and external audit. The implications include actionable migration roadmaps for institutions, improved durability of financial records against future cryptanalytic advances, and clearer accountability through evidence bundles that connect controls to quantifiable risk reduction. Keywords: quantum-safe cryptography, post-quantum cryptography (PQC), financial systems security, accounting information systems, harvest-now decrypt-later, crypto-agility, key management and HSM, digital signatures and non-repudiation, ledger integrity, regulatory compliance, audit evidence, zero-trust architecture, certificate lifecycle, risk assessment and migration planning
Purpose: The purpose of this paper is to examine the emerging threat that large-scale quantum computing poses to classical public-key cryptographic systems, particularly RSA and Elliptic Curve Cryptography (ECC), which form the backbone of contemporary digital security infrastructures. In response to this threat, the study aims to analyze post-quantum cryptography (PQC) as a viable long-term solution capable of resisting both classical and quantum adversaries. The paper further seeks to assess the urgency of PQC adoption in light of the “harvest now, decrypt later” threat model and to evaluate the practical readiness of quantum-safe cryptographic algorithms currently under consideration by the National Institute of Standards and Technology (NIST). Materials and Methods: This study employs a qualitative and analytical research methodology grounded in an extensive review of authoritative sources, including NIST’s post-quantum cryptography standardization documents, recent academic literature, industry white papers, and policy reports from organizations such as RAND Corporation and Cloudflare. The analysis systematically surveys major families of post-quantum cryptographic algorithms namely lattice-based, code-based, and hash-based schemes and evaluates them based on security assumptions, computational efficiency, implementation complexity, and standardization maturity. Findings: The analysis indicates that Lattice-based cryptographic schemes demonstrate the highest maturity and practical readiness, evidenced by their selection in NIST’s PQC process. Code- and hash-based methods provide strong security but face key size and performance challenges. The lack of scalable quantum computers does not reduce urgency, as data harvesting persists. Artificial intelligence emerges as a key enabler for accelerating PQC adoption. Unique Contribution to Theory, Practice and Policy: The paper recommends a proactive, phased post-quantum migration using hybrid cryptographic architectures. Organizations should conduct inventories, benchmarking, and pilot deployments aligned with NIST standards. AI-driven tools are advised to improve key management and reduce complexity. Continued interdisciplinary research and policy support are encouraged to ensure a secure, scalable transition to quantum-resistant security systems.