Migrating two worlds at once: a comparative risk analysis of post-quantum cryptographic adoption in information-technology and operational-technology environments
The standardization of post-quantum cryptography (PQC) by the National Institute of Standards and Technology in 2024 opened a migration that most organizations run across two different estates: information technology (IT) and operational technology (OT). Policy often treats this as a single program with one deadline, yet the constraints on cryptographic change in a data center bear little resemblance to those in a substation, a water plant, or a rail interlocking. This paper develops a structured comparative risk analysis of PQC migration in IT and OT. Drawing on standards, agency guidance, government oversight reporting, and technical literature, it compares the two environments across seven constraint dimensions and extends the comparison to a six-sector critical-infrastructure matrix. The analysis is framed as a likelihood-and-impact risk assessment; Mosca's inequality supplies the timing terms that drive sequencing. IT risk is dominated by data-harvesting exposure that vendor-driven updates remediate, whereas OT risk is dominated by the difficulty of changing multi-decade field assets in time and by the consequence of failure. Sector-aware mitigations follow: confidentiality-first sequencing and hybrid key establishment for IT; crypto-agility, segmentation, prioritized authentication, and lifecycle-aligned replacement for OT.
The standardization of post-quantum cryptography (PQC) by the National Institute of Standards and Technology in 2024 opened a migration that most organizations run across two different estates: information technology (IT) and operational technology (OT). Policy often treats this as a single program with one deadline, yet the constraints on cryptographic change in a data center bear little resemblance to those in a substation, a water plant, or a rail interlocking. This paper develops a structured comparative risk analysis of PQC migration in IT and OT. Drawing on standards, agency guidance, government oversight reporting, and technical literature, it compares the two environments across seven constraint dimensions and extends the comparison to a six-sector critical-infrastructure matrix. The analysis is framed as a likelihood-and-impact risk assessment; Mosca's inequality supplies the timing terms that drive sequencing. IT risk is dominated by data-harvesting exposure that vendor-driven updates remediate, whereas OT risk is dominated by the difficulty of changing multi-decade field assets in time and by the consequence of failure. Sector-aware mitigations follow: confidentiality-first sequencing and hybrid key establishment for IT; crypto-agility, segmentation, prioritized authentication, and lifecycle-aligned replacement for OT.
The advancement of quantum computing is increasingly recognized as a significant threat to classical public-key cryptographic systems, triggering a global shift toward Post-Quantum Cryptography (PQC). This article presents a topical survey and comparative analysis of the transition strategies adopted by leading cybersecurity agencies—including National Institute of Standards and Technology (NIST), Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI), Bundesamt für Sicherheit in der Informationstechnik (BSI), Cryptography Research and Evaluation Committees (CRYPTREC), and European Union Agency for Cybersecurity (ENISA). The technical foundations of standardized PQC algorithms (Module Lattice–Key Encapsulation Mechanism (ML-KEM), Module Lattice–Digital Signature Algorithm (ML-DSA), Fast-Fourier Lattice-based Compact Signatures over NTRU (FALCON), and Stateless Hash-based–Digital Signature Algorithm (SLH-DSA)) are reviewed, alongside a critical examination of hybrid cryptography, crypto-agility, and strategic alignment on standards and migration principles, despite jurisdictional differences in policy enforcement. The survey highlights shared priorities, such as phased implementation, backward compatibility, and risk mitigation via hybrid adoption. To enhance analytical depth, the study introduces the Institutional–Sectoral PQC Migration Convergence Framework, linking institutional pillars to sectoral readiness for reproducible comparative assessment. National strategies are shown to serve as potential roadmaps for global institutions, underscoring the importance of international coordination and adaptability. These insights support the development of secure, interoperable, and future-proof cryptographic infrastructures in the quantum era, operationalized via the proposed 10-step migration playbook.
The emergence of cryptographically relevant quantum computing presents a strategic governance challenge for national security because contemporary digital infrastructures depend extensively on public-key cryptographic mechanisms whose long-term security may be threatened by sufficiently capable quantum computers. This research examines post-quantum cryptographic governance as a policy, risk-management, interoperability, and implementation problem rather than solely as a cryptographic algorithm-selection exercise. The study adopts a conceptual research-and-review methodology based exclusively on the supplied literature, using insights from security and privacy, interoperability, digital transformation, standards-based architectures, and emerging technology governance to construct an integrated post-quantum governance framework. Particular attention is given to cryptographic inventory, risk prioritization, migration governance, interoperability, institutional accountability, lifecycle management, and national-security continuity. The analysis indicates that post-quantum readiness requires coordinated governance across technical and organizational layers, with migration decisions guided by asset criticality, data longevity, dependency relationships, and operational constraints. The study further argues that interoperability principles are central to post-quantum migration because cryptographic transitions must coexist with heterogeneous legacy systems and distributed information environments. The proposed framework therefore combines risk assessment, policy development, technical migration, validation, monitoring, and institutional oversight. The research contributes a governance-oriented perspective in which cryptographic agility and standards-based interoperability become strategic national-security capabilities rather than isolated technical controls.
Abstract: This study investigates quantum-safe modernization strategies for critical infrastructure by proposing a rigorous post-quantum (PQ) migration and verification framework that treats cryptographic transition as a safety-critical, multi-system engineering program rather than a routine software upgrade. The core argument is that infrastructure operators face two coupled risks: (i) cryptanalytic obsolescence of classical public-key systems under cryptographically relevant quantum computing and (ii) operational fragility introduced by large-scale cryptographic refactoring across heterogeneous assets such as industrial control systems, substation automation, telecommunications backhaul, and safety instrumentation. To address both, the framework integrates inventory-driven migration planning, hybrid-mode interoperability controls, and verification evidence that is continuously auditable across the asset lifecycle. The manuscript operationalizes verification as a chain of assurance spanning algorithm selection, protocol composition, implementation conformance, and deployment governance. Standardized PQ primitives (e.g., ML‑KEM for key establishment and ML‑DSA/SLH‑DSA for signa-tures) are used as reference baselines, with explicit attention to size and performance implications that alter network and device constraints. Real-data collection is defined as standards-backed parameter extraction, vendor/firmware artifact inspection, and protocol telemetry capture in representative environments. Results are reported as decision-facing tables and figures that quantify payload expansion, transition milestones, and published performance overheads, alongside interpretation of their operational significance for safety and resilience. Keywords: post-quantum cryptography; ML-KEM; ML-DSA; SLH-DSA; CNSA 2.0; critical infrastructure; migration governance; protocol verification; conformance testing; cryptographic agility
Abstract Quantum computing threatens the public-key cryptography on which contemporary digital infrastructure depends, and the practical question has shifted from whether that threat will materialise to how quickly organisations are obliged to respond. Two developments drove this shift: the United States National Institute of Standards and Technology published its first post-quantum cryptographic standards in August 2024, and in June 2026 an executive order attached binding dates to their adoption across federal systems and federal contractors. This review examines those developments through targeted retrieval of primary standards and policy documents, together with peer-reviewed cryptanalytic and resource-estimation literature, with bibliographic details verified against publisher records. Three principal findings emerge. First, the standardised portfolio is smaller than commonly reported: three Federal Information Processing Standards are published, a fourth remains in development, and a fifth algorithm has been selected but not yet standardised, a distinction that matters because procurement obligations attach only to published standards. Second, two candidates that reached advanced evaluation were defeated by classical rather than quantum cryptanalysis, one within a weekend on consumer hardware. Third, published estimates of the quantum resources required to break widely deployed key sizes have moved by more than an order of magnitude in a single dimension within six years, exchanging machine size for running time. The review concludes that cryptographic agility, not the selection of any particular algorithm, is the durable objective, and that migration should be prioritised by the confidentiality lifetime of data rather than by forecasts of adversary capability. Keywords: Standardization; Keywords: post-quantum cryptography; cryptographic migration; cryptographic agility; critical infrastructure
This paper examines the technical, operational, and governance challenges of migrating modern enterprise and cloud architectures to post-quantum cryptography (PQC). Following the National Institute of Standards and Technology's (NIST) release of finalized standards—including FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA)—organizations face significant friction regarding key and signature size inflation, protocol interoperability, and legacy infrastructure constraints. By analyzing these barriers, the study outlines practical transition strategies, emphasizing automated cryptographic discovery, hybrid deployment architectures, crypto-agility, and a phased, risk-based rollout program.
Quantum computing threatens the security foundations of global financial systems, exposing long-lived data and signed digital assets to “harvest-now, decrypt-later” attacks. While the timeline for cryptographically relevant quantum computers remains uncertain, regulatory signals from the USA, UK, EU, Canada, and Australia converge: financial institutions and payment infrastructures must begin migrating to post-quantum cryptography (PQC) now to preserve confidentiality, integrity, and systemic stability. This paper maps emerging standards and roadmaps, contrasting binding requirements like the EU’s DORA crypto-agility provisions with non-binding guidance from NIST, ENISA, and ETSI. Despite a shared intent to secure high-risk use cases by 2030–2031 and complete migration by 2035, divergences in enforcement and milestones create uncertainty for cross-border banks and financial market infrastructures. In parallel, technical adoption is advancing: major browsers, cryptographic libraries (OpenSSL/BoringSSL), and CDNs (e.g., AWS CloudFront) have deployed hybrid PQC key exchange in TLS 1.3, proving confidentiality defenses are viable at internet scale. The paper synthesizes historical transition lessons, sector-specific regulatory drivers, and operational constraints in payment infrastructures to derive a new, principle-based migration: crypto-agility, risk-prioritized scoping, hybrid deployment, vendor and supply-chain alignment, independent testing, and proactive supervisory engagement. Acting now reduces long-tail exposure and ensures readiness for imminent compliance and interoperability deadlines.