RACAF-PQC: A Risk-Aware Crypto-Agility Framework for Post-Quantum Secure Communication with Experimental Validation of Security, Performance and Migration Decisions
The emergence of cryptographically relevant quantum computing presents a fundamental challenge to contemporary public-key cryptography because Shor's algorithm can solve the integer-factorization and discrete-logarithm problems on which widely deployed RSA and elliptic-curve cryptographic systems rely. Although standardized post-quantum cryptographic (PQC) algorithms are now available, migration from classical cryptography to quantum-resistant systems is not a simple algorithm-selection problem. Different applications impose different requirements with respect to security strength, computational cost, communication overhead, interoperability, algorithmic diversity, and crypto-agility. This paper proposes RACAF-PQC, a Risk-Aware Crypto-Agility Framework for post-quantum migration decision-making. The framework introduces a Post-Quantum Migration Readiness Index (PMRI) that integrates six normalized criteria: security adequacy, computational performance, communication efficiency, algorithmic diversity, interoperability, and crypto-agility. Six cryptographic configurations are evaluated across five application scenarios: low-risk web communication, enterprise systems, high-confidentiality systems, constrained Internet-of-Things (IoT) environments, and critical infrastructure. The proposed framework is experimentally validated using a reproducible multi-criteria computational experiment and a 10,000-trial sensitivity analysis. Results show that the framework selects ML-KEM-512 for resource-sensitive environments and an ECDHE+ML-KEM-768 hybrid configuration for enterprise, high-confidentiality, and critical-infrastructure scenarios. Relative to a fixed ML-KEM-768 strategy, RACAF-PQC produces scenario-dependent decision improvements ranging from 0.7% to 8.8%, with a mean improvement of approximately 5.0%. Relative to classical-only migration, the corresponding mean improvement is approximately 42.0%. Sensitivity analysis demonstrates that the principal selections remain stable under perturbation of the decision weights, with selection stability reaching 100% for enterprise systems and 99.42% for critical infrastructure. The results demonstrate that post-quantum migration can be improved by treating cryptographic agility and application-specific risk as explicit decision variables rather than adopting a single universal algorithm. The study provides a mathematically transparent and reproducible framework for PQC migration planning while avoiding unsupported claims of hardware-level performance.
The emergence of cryptographically relevant quantum computing presents a fundamental challenge to contemporary public-key cryptography because Shor's algorithm can solve the integer-factorization and discrete-logarithm problems on which widely deployed RSA and elliptic-curve cryptographic systems rely. Although standardized post-quantum cryptographic (PQC) algorithms are now available, migration from classical cryptography to quantum-resistant systems is not a simple algorithm-selection problem. Different applications impose different requirements with respect to security strength, computational cost, communication overhead, interoperability, algorithmic diversity, and crypto-agility. This paper proposes RACAF-PQC, a Risk-Aware Crypto-Agility Framework for post-quantum migration decision-making. The framework introduces a Post-Quantum Migration Readiness Index (PMRI) that integrates six normalized criteria: security adequacy, computational performance, communication efficiency, algorithmic diversity, interoperability, and crypto-agility. Six cryptographic configurations are evaluated across five application scenarios: low-risk web communication, enterprise systems, high-confidentiality systems, constrained Internet-of-Things (IoT) environments, and critical infrastructure. The proposed framework is experimentally validated using a reproducible multi-criteria computational experiment and a 10,000-trial sensitivity analysis. Results show that the framework selects ML-KEM-512 for resource-sensitive environments and an ECDHE+ML-KEM-768 hybrid configuration for enterprise, high-confidentiality, and critical-infrastructure scenarios. Relative to a fixed ML-KEM-768 strategy, RACAF-PQC produces scenario-dependent decision improvements ranging from 0.7% to 8.8%, with a mean improvement of approximately 5.0%. Relative to classical-only migration, the corresponding mean improvement is approximately 42.0%. Sensitivity analysis demonstrates that the principal selections remain stable under perturbation of the decision weights, with selection stability reaching 100% for enterprise systems and 99.42% for critical infrastructure. The results demonstrate that post-quantum migration can be improved by treating cryptographic agility and application-specific risk as explicit decision variables rather than adopting a single universal algorithm. The study provides a mathematically transparent and reproducible framework for PQC migration planning while avoiding unsupported claims of hardware-level performance.
Quantum computing poses an existential threat to public-key cryptography, with Shor's algorithm capable of breaking RSA and elliptic curve systems once cryptographically relevant quantum computers (CRQCs) emerge. While post-quantum cryptography (PQC) offers algorithmic solutions, organizational readiness extends beyond technical implementation to encompass governance, interoperability, and adaptive capacity. This review synthesizes the quantum threat landscape, evaluates NIST-standardized PQC algorithms through quantitative performance analysis, and examines global standardization dynamics. We introduce a novel Quantum Readiness Maturity Model (QRMM) that enables organizations to assess and advance their preparedness across five dimensions: cryptographic infrastructure, governance frameworks, sectoral adaptation, interoperability resilience, and strategic agility. Applying this model to finance, telecommunications, and defense sectors reveals systematic gaps in migration planning and crypto-agility. Our analysis demonstrates that quantum readiness requires treating cryptographic transformation as a strategic enterprise capability rather than a purely technical upgrade. The proposed framework provides actionable pathways for practitioners while identifying critical research directions in hybrid deployment strategies, post-quantum PKI architectures, and algorithmic diversity.
The emergence of large-scale quantum computing presents an imminent threat to contemporary public-key cryptosystems, with quantum algorithms such as Shor’s algorithm capable of efficiently breaking RSA and elliptic curve cryptography (ECC). This vulnerability has catalyzed accelerated standardization efforts for post-quantum cryptography (PQC) by the U.S. National Institute of Standards and Technology (NIST) and global security stakeholders. While theoretical security analysis of these quantum-resistant algorithms has advanced considerably, comprehensive real-world performance benchmarks spanning diverse computing environments—from high-performance cloud infrastructure to severely resource-constrained IoT devices—remain insufficient for informed deployment planning. This paper presents the most extensive cross-platform empirical evaluation to date of NIST-selected PQC algorithms, including CRYSTALS-Kyber and NTRU for key encapsulation mechanisms (KEMs), alongside BIKE as a code-based alternative, and CRYSTALS-Dilithium and Falcon for digital signatures. Our systematic benchmarking framework measures computational latency, memory utilization, key sizes, and protocol overhead across multiple security levels (NIST Levels 1, 3, and 5) in three distinct hardware environments and various network conditions. Results demonstrate that contemporary server architectures can implement these algorithms with negligible performance impact (<5% additional latency), making immediate adoption feasible for cloud services. In contrast, resource-constrained devices experience more significant overhead, with computational demands varying by up to 12× between algorithms at equivalent security levels, highlighting the importance of algorithm selection for edge deployments. Beyond standalone algorithm performance, we analyze integration challenges within existing security protocols, revealing that naive implementation of PQC in TLS 1.3 can increase handshake size by up to 7× compared to classical approaches. To address this, we propose and evaluate three optimization strategies that reduce bandwidth requirements by 40–60% without compromising security guarantees. Our investigation further encompasses memory-constrained implementation techniques, side-channel resistance measures, and hybrid classical-quantum approaches for transitional deployments. Based on these comprehensive findings, we present a risk-based migration framework and algorithm selection guidelines tailored to specific use cases, including financial transactions, secure firmware updates, vehicle-to-infrastructure communications, and IoT fleet management. This practical roadmap enables organizations to strategically prioritize systems for quantum-resistant upgrades based on data sensitivity, resource constraints, and technical feasibility. Our results conclusively demonstrate that PQC is deployment-ready for most applications, provided that implementations are carefully optimized for the specific performance characteristics and security requirements of target environments. We also identify several remaining research challenges for the community, including further optimization for ultra-constrained devices, standardization of hybrid schemes, and hardware acceleration opportunities.
Abstract The prospect of cryptanalytically relevant quantum computers (CRQCs) motivates a transition from classical cryptography to post-quantum cryptography (PQC). Shor’s algorithm threatens widely deployed public-key schemes used for key establishment and digital signatures, while Grover’s algorithm reduces effective security margins for symmetric-key and hash-based primitives. The harvest-now, decrypt-later (HNDL) threat further increases urgency because adversaries can store encrypted data today for future decryption, placing long-lived confidentiality requirements and trust infrastructure at risk. This survey frames PQC adoption as a standards-to-deployment program. We review the PQC design space and summarize deployment-critical constraints, including handshake and certificate size growth, latency under network loss, computational cost, memory and storage requirements, implementation complexity, and side-channel robustness. We then present an iterative migration pipeline covering cryptographic inventory, risk-based prioritization using data sensitivity and cryptoperiod, algorithm and parameter profile selection, hybrid classical and PQC constructions for backward compatibility, pilot validation with measurable go/no-go criteria, and long-term operations with crypto-agility. Finally, we connect standardization outputs to concrete integration surfaces and illustrate the workflow across transport layer security (TLS) and the web public key infrastructure (Web PKI), virtual private networks (VPNs) and internet protocol security (IPsec), and constrained Internet of things (IoT) deployments, and we summarize open challenges in interoperability, public key infrastructure (PKI) transition mechanics, implementation maturity and operational governance.
Abstract—The advent of fault-tolerant Cryptanalytically Relevant Quantum Computers (CRQCs) presents an existential threat to modern information security. Shor's polynomial-time quantum algorithm renders widely deployed public-key cryptographic primitives—including RSA, Diffie-Hellman (DH), and Elliptic Curve Cryptography (ECDH/ECDSA)—completely vulnerable to private key derivation. Furthermore, 'Harvest Now, Decrypt Later' (HNDL) adversarial campaigns actively intercept and store encrypted enterprise telemetry today, anticipating future quantum decryption capabilities. In response, the National Institute of Standards and Technology (NIST) finalized its primary Post-Quantum Cryptography (PQC) standards in FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). However, transitioning complex enterprise IT ecosystems to quantum-resistant primitives introduces severe architectural and computational disruptions: public key and signature sizes increase by several orders of magnitude, cryptographic handshake latencies escalate, network packets experience Maximum Transmission Unit (MTU) fragmentation, and legacy Hardware Security Modules (HSMs) lack microarchitectural support for lattice-based polynomial arithmetic. This paper provides an exhaustive, mathematically grounded technical survey and architectural roadmap for enterprise PQC migration. We formalize the Module Learning with Errors (M-LWE) and Module Short Integer Solution (M-SIS) hardness foundations, evaluate hybrid classical/post-quantum cryptographic transition models across standard transport protocols (TLS 1.3, IKEv2/IPsec, SSH), and formulate an enterprise Crypto-Agility Maturity Model. Furthermore, we construct an empirical enterprise testbed measuring throughput, connection establishment latency, memory footprints, and packet fragmentation across legacy and quantum-resistant suites. Our results show that while ML-KEM-768 achieves microsecond-level encapsulation, its 1,088-byte ciphertext expands TLS ClientHello payloads into multiple TCP segments under constrained networks. Finally, we establish open research directions in post-quantum identity federations, stateful hash signature tracking, and hardware-accelerated polynomial arithmetic. Index Terms—Post-Quantum Cryptography (PQC), FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), Crypto-Agility, TLS 1.3, Lattice-Based Cryptography, Harvest Now Decrypt Later, Hardware Security Modules (HSM), Enterprise Migration.
The accelerating development of quantum computing creates substantial cybersecurity challenges for cloud and Internet of Things (IoT) environments that continue to depend on quantum-vulnerable public-key cryptography. This study developed and quantitatively evaluated an AI-driven quantum-resistant security framework for accelerating the migration of U.S. cloud and IoT systems toward National Institute of Standards and Technology (NIST) post-quantum cryptography (PQC) standards. The final analytical environment included 52 organizations, 164 cloud environments, 18,764 IoT devices, and 139,684 retained cryptographic assets, with 98.7% data completeness and 97.9% inventory-validation accuracy. Among retained assets, 62.1% contained quantum-vulnerable dependencies, including 34.6% associated with RSA, 20.0% with elliptic-curve cryptography, and 7.5% with Diffie–Hellman, while 63.2% of certificates remained quantum vulnerable. AI-assisted cryptographic discovery achieved 97.4% asset coverage and 97.9% vulnerability-detection sensitivity while reducing assessment time by 87.8%. XGBoost achieved the strongest quantum-risk classification performance, with 97.6% accuracy, 97.5% F1-score, 0.994 ROC-AUC, and 0.992 PR-AUC. Experimental evaluation of ML-KEM, ML-DSA, and SLH-DSA showed that pure PQC increased cloud secure-session latency by 23.8% and reduced throughput by 10.0%, whereas hybrid configurations increased latency by 39.5% and reduced throughput by 15.6%. AI-assisted migration increased implementation success from 84.6% to 97.1%, reduced remediation time by 60.2%, increased migration throughput by 151.1%, and reduced unresolved quantum-vulnerable exposure from 15.4% to 2.9%. High-security-maturity organizations achieved 98.8% implementation success compared with 87.8% among low-maturity organizations. Validation confirmed strong generalizability, with XGBoost achieving 97.1% cross-validation accuracy, 96.9% independent holdout accuracy, and 95.9% temporal-validation accuracy. Overall, the findings demonstrated that integrating AI-assisted cryptographic discovery, quantum-risk classification, migration prioritization, PQC performance assessment, cryptographic agility, interoperability testing, and organizational readiness provided a robust quantitative framework for strengthening post-quantum security across heterogeneous U.S. cloud and IoT infrastructures.
The emergence of quantum computing poses a significant threat to the cryptographic foundations that secure modern cloud infrastructures. Existing deployments of Zero Trust Architecture (ZTA) are largely built on classical cryptographic techniques such as the RSA algorithm and elliptic curve cryptography, which are vulnerable to future quantum attacks. Moreover, current studies offer limited guidance on how PQC can be integrated into cloud-native Zero Trust environments while guaranteeing operational efficiency and addressing adaptive security needs. The present study introduces an Adaptive Post Quantum Zero Trust (Adaptive PQC-ZT) Framework by combining the NIST recommended post quantum cryptographic algorithms with a policy based Crypto-Agility Engine for algorithm dynamic selection based upon Security Sensitivity, Algorithm Characteristics, and Latency. The framework was evaluated using a publicly available PQC benchmark dataset containing 37,004 key encapsulation mechanism (KEM) records and 71,456 digital signature records. The analysis examined latency, communication overhead, security levels, and workload suitability for ML-KEM and ML-DSA algorithm families across representative cloud deployment scenarios. The results demonstrate that ML-KEM algorithms provide quantum-resistant key establishment with sub-millisecond latency, while ML-DSA algorithms significantly outperform SPHINCS+ variants in execution efficiency and communication overhead. The proposed Crypto-Agility Engine helps match cryptographic configuration with the needs of different workloads. This allows web applications to run with low latency, while also giving stronger protection to high-security systems such as financial databases. The proposed framework contributes a unified cloud-native security model that blends Zero Trust principles, post-quantum cryptography, benchmark-driven evaluation, and adaptive crypto-agility. This shows practical migration to quantum-safe cloud infrastructures can be done with manageable performance hits. Organizations get a solid path to boost their long-term defense against future quantum threats.