Post-Quantum Cryptographic Agility for Critical Internet Infrastructure: Architecture, Metrics, and Migration Strategies

Subhajit Roy

This preprint presents a systems-security and architectural analysis of post-quantum cryptography deployment challenges in modern API ecosystems. The paper examines hybrid TLS 1.3 integration, cryptographic agility, migration strategies, API gateway architectures, certificate management, and operational considerations surrounding quantum-resilient distributed systems. The work focuses on applied cryptographic engineering and migration planning rather than proposing new cryptographic primitives. It synthesizes current standards, adversarial models, implementation constraints, and deployment considerations relevant to practical post-quantum migration for API infrastructure. Keywords: post-quantum cryptography, API security, TLS 1.3, ML-KEM, cryptographic agility, hybrid TLS.

Saoud AlAbdulla, Mustafa Al Samara, Okba Ben Atia +2 more

Sachin Ware, Shalini Wankhade, Chudaman Devidasrao Sukte +3 more

Rahul Kumar Seema Agrawal

The emergence of cryptographically relevant quantum computing presents a fundamental challenge to contemporary public-key cryptography because Shor's algorithm can solve the integer-factorization and discrete-logarithm problems on which widely deployed RSA and elliptic-curve cryptographic systems rely. Although standardized post-quantum cryptographic (PQC) algorithms are now available, migration from classical cryptography to quantum-resistant systems is not a simple algorithm-selection problem. Different applications impose different requirements with respect to security strength, computational cost, communication overhead, interoperability, algorithmic diversity, and crypto-agility. This paper proposes RACAF-PQC, a Risk-Aware Crypto-Agility Framework for post-quantum migration decision-making. The framework introduces a Post-Quantum Migration Readiness Index (PMRI) that integrates six normalized criteria: security adequacy, computational performance, communication efficiency, algorithmic diversity, interoperability, and crypto-agility. Six cryptographic configurations are evaluated across five application scenarios: low-risk web communication, enterprise systems, high-confidentiality systems, constrained Internet-of-Things (IoT) environments, and critical infrastructure. The proposed framework is experimentally validated using a reproducible multi-criteria computational experiment and a 10,000-trial sensitivity analysis. Results show that the framework selects ML-KEM-512 for resource-sensitive environments and an ECDHE+ML-KEM-768 hybrid configuration for enterprise, high-confidentiality, and critical-infrastructure scenarios. Relative to a fixed ML-KEM-768 strategy, RACAF-PQC produces scenario-dependent decision improvements ranging from 0.7% to 8.8%, with a mean improvement of approximately 5.0%. Relative to classical-only migration, the corresponding mean improvement is approximately 42.0%. Sensitivity analysis demonstrates that the principal selections remain stable under perturbation of the decision weights, with selection stability reaching 100% for enterprise systems and 99.42% for critical infrastructure. The results demonstrate that post-quantum migration can be improved by treating cryptographic agility and application-specific risk as explicit decision variables rather than adopting a single universal algorithm. The study provides a mathematically transparent and reproducible framework for PQC migration planning while avoiding unsupported claims of hardware-level performance.

Asif Alif, Khondokar Fida Hasan, Basker Palaniswamy +1 more

Smart healthcare industry is increasingly relying on Internet of Things (IoT) devices to improve patient care and operational efficiency. However, the cryptographic algorithms that enable fundamental security and are widely used in these cyber systems are vulnerable to attacks by emerging quantum computers - known as Quantum Threat. This paper examines the quantum threat to healthcare IoT across the four layers of the IoT architecture: physical, network, perception, and application. It proposes a comprehensive migration framework integrating a phased hybrid approach with crypto-agility to transition healthcare IoT systems to quantum-safe cryptography. This framework prioritises resource-constrained devices, emphasises interoperability, and considers the challenges of vendor readiness and infrastructure upgrades. This paper contributes a detailed, phased migration plan specifically tailored to the unique security needs and resource limitations of IoT-based healthcare systems.

Faisal Abbasi, Pawan Kumar Singh