Public-key cryptography protects key establishment, authentication, software integrity and trust relationships across the optical transport and IP/MPLS networks that carry U.S. critical-infrastructure communications. A sufficiently capable quantum computer would break the widely deployed algorithms on which these protections rest. This study investigates how such networks can migrate to post-quantum cryptography (PQC) without disrupting operational communications, and how they can be made crypto-agile so that future algorithm changes are routine instead of exceptional.
Public-key cryptography protects key establishment, authentication, software integrity and trust relationships across the optical transport and IP/MPLS networks that carry U.S. critical-infrastructure communications. A sufficiently capable quantum computer would break the widely deployed algorithms on which these protections rest. This study investigates how such networks can migrate to post-quantum cryptography (PQC) without disrupting operational communications, and how they can be made crypto-agile so that future algorithm changes are routine instead of exceptional.
The transition to post-quantum cryptography presents enterprises with a complex systems-engineering challenge extending beyond algorithm replacement. Transport Layer Security, public key infrastructure, virtual private networks, cloud-native platforms, identity services, and machine-to-machine communications depend on interconnected cryptographic libraries, certificates, protocols, hardware modules, policies, and vendor products. This review examines crypto-agile migration to hybrid post-quantum cryptography, where classical and quantum-resistant mechanisms are combined to preserve established assurance while emerging algorithms and implementations mature. It develops a migration-oriented taxonomy covering cryptographic discovery, dependency mapping, hybrid key establishment, composite authentication, certificate lifecycle management, protocol negotiation, performance optimization, interoperability testing, and operational governance. Particular attention is given to larger keys, ciphertexts, and signatures; handshake fragmentation; certificate-chain expansion; hardware acceleration; legacy compatibility; downgrade resistance; and observability across distributed environments. The review compares migration requirements in enterprise TLS, PKI, remote-access and site-to-site VPNs, service meshes, API gateways, container platforms, serverless services, secrets systems, and multicloud infrastructures. It also analyzes staged deployment patterns, including inventory-first modernization, proxy-based termination, dual certificates, hybrid tunnels, algorithm-policy abstraction, and controlled fallback. Evaluation criteria integrate security, interoperability, latency, throughput, bandwidth, memory, certificate issuance, operational resilience, and rollback readiness. The findings indicate that successful migration depends on treating cryptography as a continuously governed enterprise capability rather than a fixed protocol configuration. The paper concludes by identifying gaps in standardization, automated discovery, cross-vendor testing, cryptographic telemetry, constrained-device support, and lifecycle evidence, providing organizations with a structured foundation for prioritized, reversible, and verifiable post-quantum transformation across heterogeneous digital services. Keywords: Crypto-Agility, Hybrid Cryptography, Post-Quantum Cryptography, Public Key Infrastructure, Quantum-Safe Migration, Transport Layer Security.
Introduction The rapid advancement of quantum computing presents an existential threat to the mathematical foundations of modern internet security. Fault-tolerant quantum computers are projected to reach the logical qubit scale necessary to execute Shor's algorithm by 2030–2035, threatening currently deployed public-key cryptography infrastructures. Methods We evaluate the performance metrics of integrating post-quantum cryptography (PQC), specifically the newly finalized NIST standards (FIPS 203, 204, and 205), with quantum key distribution (QKD) across communication networks. Results Our analysis demonstrates that while hybrid PQC-QKD models reduce long-term key compromise probabilities to near 0%, they introduce a 15% to 40% increase in bandwidth overhead during initial cryptographic handshakes. Discussion Given that enterprise-wide cryptographic migrations historically require 7–10 years, organizations face an immediate vulnerability window against “harvest now, decrypt later” adversaries. Ultimately, we propose a phased, cryptographically agile framework to achieve a Zero-Trust, Quantum-Safe network architecture within a 5-year implementation timeline.
Quantum computing poses an existential threat to classical public-key cryptography, particularly RSA and elliptic-curve systems, which form the backbone of secure communication, authentication, and digital trust. Once scalable quantum computers emerge, algorithms such as Shor’s will be capable of breaking these schemes, jeopardizing confidentiality and integrity across the internet and enterprise systems. Post-quantum cryptography (PQC) offers a viable defense, providing quantum-resistant algorithms that can be implemented on today’s hardware and protocols. Recent standardization milestones—including NIST’s approval of ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) for signatures, and the selection of HQC as a complementary KEM—mark a turning point for practical adoption. This paper surveys the quantum threat model, algorithm families, performance trade-offs, and integration patterns such as hybrid modes and crypto-agile architectures. It further outlines a phased migration roadmap for enterprises, emphasizing harvest-now-decrypt-later risks and compliance imperatives. By bridging technical, operational, and policy perspectives, the study provides actionable guidance to prepare organizations for a secure and quantum-resilient future.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
Hybrid enterprise environments combining public cloud, private infrastructure, and edge devices—rely fundamentally on classical public-key cryptography (PKC) for secure key exchange, authentication, and digital signatures. The emergence of cryptographically relevant quantum computers (CRQCs) threatens to dismantle these foundations via algorithms such as Shor's, rendering current data confidentiality and long-term security guarantees obsolete.1 This systematic review transitions the focus from pure cloud security to the complex architectural challenge of integrating Post-Quantum Cryptography (PQC) across distributed enterprise landscapes. The analysis examines the foundational PQC candidates (NIST selection), assesses architectural dependencies (PKI, KMS, ZTA), reviews implementation hurdles (side-channels, performance overhead in IoT), and details the strategic necessity of crypto-agility. Furthermore, this report critically examines the global regulatory framework, including US CNSA 2.0 and FIPS 140-3, highlighting critical gaps in migration planning, governance, and compliance readiness required to mitigate the systemic risk of the "Harvest Now, Decrypt Later" threat model.
Quantum computing represents a significant threat to the asymmetric cryptographic algorithms currently used to protect the traditional data security infrastructure today’s enterprises depend upon. With Gartner predicting that by 2029 advances in quantum computing will render applications, data and networks protected by asymmetric cryptography unsafe, organisations must begin preparations to transition to post-quantum cryptography (PQC). Organisations that fail to prepare for quantum today risk potentially exposing their sensitive data on a massive scale, as threat actors are already collecting encrypted enterprise data in anticipation of future quantum decryption capabilities. The migration to PQC involves updating risk registers and enabling the crypto agility that supports the rapid implementation of new algorithms and ensures organisations can adapt fast to new regulatory standards.