The imminent maturation of Cryptographically Relevant Quantum Computers (CRQCs) represents a fundamental threat to the digital security infrastructure, specifically targeting modern cryptographic standards such as AES, RSA and Elliptic Curve Cryptography (ECC). While Post -Quantum Cryptography (PQC) offers a mathematical defense, the transition is complicated by the “Harvest Now, Decrypt Later ” (HNDL) strategy, where encrypted data is intercepted today for future decryption. This thesis explores the critical necessity of an organized migration strategy to protect long-term data sensitivity against the rapid advancement of quantum capabilities and addresses the gaps in the current migration landscape: the absence of a standardized, risk -based prioritization methodology, the absence of an AI based prioritization system to accommodate the approximate nature of variables involved, and a comparison of both the implementations. Finally, the technical deadlock surrounding non -upgradable legacy systems. Current literature often lacks a semi-quantified approach that uses data criticality as the primary criterion for migration triage. This thesis covers the void by introducing a framework supported by a custom software tool based on that assigns numerical priority scores based on data shelf -life and organizational risk and also implements the prioritization using Fuzzy Logic and them comparing the results of the two implementations to see which platform better suits the problem . Furthermore, the thesis tackles the challenge of legacy hosts that cannot support NIST-standardized algorithms, proposing a crypto -agile architectural solution that utilizes intermediate VPN terminals and SSH tunnels to wrap vulnerable traffic in quantum -resistant encryption. The results of this thesis demonstrate that a structured, data -centric approach can successfully mitigate quantum risk even in complex enterprise environments , furthermore it determines how a Fuzzy Logic based implementation better suits the approximate nature of the problem. Experimental validation through the “corp.com” simulation showed that implementing the proposed PQC -based SSH VPN reduced legacy host exposure to near zero while maintaining high operational performance. Despite the inherent computational overhead of PQC algorithms, the hybrid implementation experienced only a 15.7% increase in average round -trip time for 100 packets, significantly outperforming the 20% speed loss typically associated with hybrid PQC over networks. These findings provide a scientific and repeatable basis for organizational leaders to direct resources toward quantum-safe encryption without compromising network efficiency.
The imminent maturation of Cryptographically Relevant Quantum Computers (CRQCs) represents a fundamental threat to the digital security infrastructure, specifically targeting modern cryptographic standards such as AES, RSA and Elliptic Curve Cryptography (ECC). While Post -Quantum Cryptography (PQC) offers a mathematical defense, the transition is complicated by the “Harvest Now, Decrypt Later ” (HNDL) strategy, where encrypted data is intercepted today for future decryption. This thesis explores the critical necessity of an organized migration strategy to protect long-term data sensitivity against the rapid advancement of quantum capabilities and addresses the gaps in the current migration landscape: the absence of a standardized, risk -based prioritization methodology, the absence of an AI based prioritization system to accommodate the approximate nature of variables involved, and a comparison of both the implementations. Finally, the technical deadlock surrounding non -upgradable legacy systems. Current literature often lacks a semi-quantified approach that uses data criticality as the primary criterion for migration triage. This thesis covers the void by introducing a framework supported by a custom software tool based on that assigns numerical priority scores based on data shelf -life and organizational risk and also implements the prioritization using Fuzzy Logic and them comparing the results of the two implementations to see which platform better suits the problem . Furthermore, the thesis tackles the challenge of legacy hosts that cannot support NIST-standardized algorithms, proposing a crypto -agile architectural solution that utilizes intermediate VPN terminals and SSH tunnels to wrap vulnerable traffic in quantum -resistant encryption. The results of this thesis demonstrate that a structured, data -centric approach can successfully mitigate quantum risk even in complex enterprise environments , furthermore it determines how a Fuzzy Logic based implementation better suits the approximate nature of the problem. Experimental validation through the “corp.com” simulation showed that implementing the proposed PQC -based SSH VPN reduced legacy host exposure to near zero while maintaining high operational performance. Despite the inherent computational overhead of PQC algorithms, the hybrid implementation experienced only a 15.7% increase in average round -trip time for 100 packets, significantly outperforming the 20% speed loss typically associated with hybrid PQC over networks. These findings provide a scientific and repeatable basis for organizational leaders to direct resources toward quantum-safe encryption without compromising network efficiency.
As the era of quantum computing approaches, the fundamental cryptographic primitives securing global communications face a paradigm shift. With the National Institute of Standards and Technology (NIST) finalizing new standards, the industry must urgently address the vulnerabilities of legacy systems. The imminent advent of CRQCs (Cryptographically Relevant Quantum Computers) poses an existential threat to the Public Key Infrastructure (PKI) underpinning the global digital economy. Classical algorithms such as RSA and ECC (Elliptic Curve Cryptography) are vulnerable to polynomial-time cryptanalysis via Shor’s algorithm. This study investigates the HNDL (Harvest Now, Decrypt Later) threat model and evaluates the resilience of NIST-standardized PQC (Post-Quantum Cryptography) algorithms: ML-KEM and ML-DSA. Utilizing a high-performance Fortinet networking environment, we experimentally validate that "Hybrid Mode" IPsec VPNs can achieve quantum resistance with negligible performance degradation, offering a viable migration path for enterprise infrastructure. Specifically, we benchmark the trade-offs between PQC’s larger key sizes and network latency, demonstrating that the overhead remains within acceptable operational thresholds. Implementing hybrid protocols provides a critical transition mechanism, allowing organizations to secure long-term data confidentiality against retrospective decryption while preserving interoperability with legacy systems.
Abstract—The advent of fault-tolerant Cryptanalytically Relevant Quantum Computers (CRQCs) presents an existential threat to modern information security. Shor's polynomial-time quantum algorithm renders widely deployed public-key cryptographic primitives—including RSA, Diffie-Hellman (DH), and Elliptic Curve Cryptography (ECDH/ECDSA)—completely vulnerable to private key derivation. Furthermore, 'Harvest Now, Decrypt Later' (HNDL) adversarial campaigns actively intercept and store encrypted enterprise telemetry today, anticipating future quantum decryption capabilities. In response, the National Institute of Standards and Technology (NIST) finalized its primary Post-Quantum Cryptography (PQC) standards in FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). However, transitioning complex enterprise IT ecosystems to quantum-resistant primitives introduces severe architectural and computational disruptions: public key and signature sizes increase by several orders of magnitude, cryptographic handshake latencies escalate, network packets experience Maximum Transmission Unit (MTU) fragmentation, and legacy Hardware Security Modules (HSMs) lack microarchitectural support for lattice-based polynomial arithmetic. This paper provides an exhaustive, mathematically grounded technical survey and architectural roadmap for enterprise PQC migration. We formalize the Module Learning with Errors (M-LWE) and Module Short Integer Solution (M-SIS) hardness foundations, evaluate hybrid classical/post-quantum cryptographic transition models across standard transport protocols (TLS 1.3, IKEv2/IPsec, SSH), and formulate an enterprise Crypto-Agility Maturity Model. Furthermore, we construct an empirical enterprise testbed measuring throughput, connection establishment latency, memory footprints, and packet fragmentation across legacy and quantum-resistant suites. Our results show that while ML-KEM-768 achieves microsecond-level encapsulation, its 1,088-byte ciphertext expands TLS ClientHello payloads into multiple TCP segments under constrained networks. Finally, we establish open research directions in post-quantum identity federations, stateful hash signature tracking, and hardware-accelerated polynomial arithmetic. Index Terms—Post-Quantum Cryptography (PQC), FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), Crypto-Agility, TLS 1.3, Lattice-Based Cryptography, Harvest Now Decrypt Later, Hardware Security Modules (HSM), Enterprise Migration.
The arrival of cryptographically relevant quantum computers (CRQCs) represents an existential threat to the public-key cryptographic infrastructure underpinning global enterprise operations. Enterprise security today relies on RSA and elliptic-curve cryptography (ECC) for TLS, VPNs, PKI, code signing, and identity systems—all of which are fundamentally broken by Shor's algorithm on a sufficiently powerful quantum computer. The defining risk is time-shifted compromise: adversaries can harvest encrypted traffic today and decrypt it once CRQCs exist, a threat already underway according to U.S. intelligence assessments. NIST finalized three post-quantum cryptographic (PQC) standards in August 2024 (FIPS 203/204/205) and mandates deprecation of quantum-vulnerable algorithms by 2035. Yet only 5% of organizations have implemented quantum-safe encryption and 95% lack formal quantum transition plans. This paper provides a comprehensive, threat-driven analysis across seven dimensions: quantum algorithm impact, harvest-now-decrypt-later (HNDL) threat models, enterprise asset risks (PKI, TLS, VPNs, code signing, cloud, IoT, identity, blockchain, supply chain), sector-specific vulnerabilities (financial services, healthcare, critical infrastructure), cryptographic primitive analysis, migration standards and roadmaps, and enterprise readiness gaps. The convergence of HNDL attacks already underway, multi-decade data sensitivity windows, and 12–15 year enterprise migration timelines means the migration deadline has, for most sectors, already passed.
Abstract The prospect of cryptanalytically relevant quantum computers (CRQCs) motivates a transition from classical cryptography to post-quantum cryptography (PQC). Shor’s algorithm threatens widely deployed public-key schemes used for key establishment and digital signatures, while Grover’s algorithm reduces effective security margins for symmetric-key and hash-based primitives. The harvest-now, decrypt-later (HNDL) threat further increases urgency because adversaries can store encrypted data today for future decryption, placing long-lived confidentiality requirements and trust infrastructure at risk. This survey frames PQC adoption as a standards-to-deployment program. We review the PQC design space and summarize deployment-critical constraints, including handshake and certificate size growth, latency under network loss, computational cost, memory and storage requirements, implementation complexity, and side-channel robustness. We then present an iterative migration pipeline covering cryptographic inventory, risk-based prioritization using data sensitivity and cryptoperiod, algorithm and parameter profile selection, hybrid classical and PQC constructions for backward compatibility, pilot validation with measurable go/no-go criteria, and long-term operations with crypto-agility. Finally, we connect standardization outputs to concrete integration surfaces and illustrate the workflow across transport layer security (TLS) and the web public key infrastructure (Web PKI), virtual private networks (VPNs) and internet protocol security (IPsec), and constrained Internet of things (IoT) deployments, and we summarize open challenges in interoperability, public key infrastructure (PKI) transition mechanics, implementation maturity and operational governance.
The imminent advent of a Cryptographically Relevant Quantum Computer (CRQC) poses an existential threat to the US financial infrastructure.Current payment rails including FedWire, CHIPS, and ACH rely on RSA and ECC standards that are mathematically vulnerable to Shor's Algorithm.This facilitates "Harvest Now, Decrypt Later" (HNDL) attacks, where encrypted data is intercepted today for future decryption.This paper evaluates the migration to NIST-standardized Post-Quantum Cryptography (PQC), specifically ML-KEM and ML-DSA.We analyze the architectural challenges of integrati ng these primitives into ISO 20022 formats, focusing on the trade-offs between increased packet size and sub-millisecond latency requirements.By proposing a phased migration framework using Hybrid Cryptographic Wrappers, this research provides a roadmap for maintaining regulatory compliance under NSM-10 while preventing a systemic collapse of digital trust and the associated multitrillion-dollar risk to the US GDP.
Introduction The rapid advancement of quantum computing presents an existential threat to the mathematical foundations of modern internet security. Fault-tolerant quantum computers are projected to reach the logical qubit scale necessary to execute Shor's algorithm by 2030–2035, threatening currently deployed public-key cryptography infrastructures. Methods We evaluate the performance metrics of integrating post-quantum cryptography (PQC), specifically the newly finalized NIST standards (FIPS 203, 204, and 205), with quantum key distribution (QKD) across communication networks. Results Our analysis demonstrates that while hybrid PQC-QKD models reduce long-term key compromise probabilities to near 0%, they introduce a 15% to 40% increase in bandwidth overhead during initial cryptographic handshakes. Discussion Given that enterprise-wide cryptographic migrations historically require 7–10 years, organizations face an immediate vulnerability window against “harvest now, decrypt later” adversaries. Ultimately, we propose a phased, cryptographically agile framework to achieve a Zero-Trust, Quantum-Safe network architecture within a 5-year implementation timeline.