Toward Evidence-Based Post-Quantum Cryptography Migration: A Structured Review of Recent IEEE Access and Related Literature and a Validation-Ready Architecture for a Quantum-Ready Encryption Migration Assistant
Gavhane Vaishnavi Sharad, S. B. Bhosale, Bangar Abhishek P.
Post-quantum cryptography (PQC) migration is moving from algorithm design to organisational practice, yet the evidence that should guide migration tools is scattered across process studies, performance experiments, agility surveys and risk models. This paper presents a structured review guided by three research questions: what migration process is supported by the literature, what is known about the performance cost of the new algorithms, and what is missing for automated migration support. Eleven sources were analysed in depth, including recent IEEE Access papers and related surveys, experiments and guidance documents. The review finds that process terminology is still inconsistent, that performance evidence is mostly laboratory-based and per algorithm, that crypto-agility and risk scoring remain largely conceptual, and that cryptographic inventory is the prerequisite for everything else. These findings are converted into seven traceable requirements, which shape a seven-layer architecture for a Quantum-Ready Encryption Migration Assistant mapped to a four-phase migration process. A validation protocol with hypotheses, metrics, baselines and threats to validity is specified so that the assistant can be evaluated in future work. The architecture is conceptual and no experimental results are claimed.
Post-quantum cryptography (PQC) migration is moving from algorithm design to organisational practice, yet the evidence that should guide migration tools is scattered across process studies, performance experiments, agility surveys and risk models. This paper presents a structured review guided by three research questions: what migration process is supported by the literature, what is known about the performance cost of the new algorithms, and what is missing for automated migration support. Eleven sources were analysed in depth, including recent IEEE Access papers and related surveys, experiments and guidance documents. The review finds that process terminology is still inconsistent, that performance evidence is mostly laboratory-based and per algorithm, that crypto-agility and risk scoring remain largely conceptual, and that cryptographic inventory is the prerequisite for everything else. These findings are converted into seven traceable requirements, which shape a seven-layer architecture for a Quantum-Ready Encryption Migration Assistant mapped to a four-phase migration process. A validation protocol with hypotheses, metrics, baselines and threats to validity is specified so that the assistant can be evaluated in future work. The architecture is conceptual and no experimental results are claimed.
Post-quantum cryptography (PQC) migration is moving from algorithm design to organisational practice, yet the evidence that should guide migration tools is scattered across process studies, performance experiments, agility surveys and risk models. This paper presents a structured review guided by three research questions: what migration process is supported by the literature, what is known about the performance cost of the new algorithms, and what is missing for automated migration support. Eleven sources were analysed in depth, including recent IEEE Access papers and related surveys, experiments and guidance documents. The review finds that process terminology is still inconsistent, that performance evidence is mostly laboratory-based and per algorithm, that crypto-agility and risk scoring remain largely conceptual, and that cryptographic inventory is the prerequisite for everything else. These findings are converted into seven traceable requirements, which shape a seven-layer architecture for a Quantum-Ready Encryption Migration Assistant mapped to a four-phase migration process. A validation protocol with hypotheses, metrics, baselines and threats to validity is specified so that the assistant can be evaluated in future work. The architecture is conceptual and no experimental results are claimed.
Networks such as the Internet are essential for our connected world. Quantum computing threatens its fundamental security mechanisms. Therefore, a migration to post-quantum-cryptography (PQC) is necessary for networks and their components. Currently, there is little knowledge on how such migrations should be structured and implemented in practice. Our systematic literature review addresses migration approaches for IP networks towards PQC. It surveys papers about the migration process and exemplary real-world software system migrations. On the process side, we found that terminology, migration steps, and roles are not defined precisely or consistently across the literature. Still, we identified four major phases and appropriate substeps which we matched with also emerging archetypes of roles. In terms of real-world migrations, we see that reports used several different PQC implementations and hybrid solutions for migrations of systems belonging to a wide range of system types. Across all papers we noticed three major challenges for adopters: missing experience of PQC and a high realization effort, concerns about the security of the upcoming system, and finally, high complexity. Our findings indicate that recent standardization efforts already push quantum-safe networking forward. However, the literature is still not in consensus about definitions and best practices. Implementations are mostly experimental and not necessarily practical, leading to an overall chaotic situation. To better grasp this fast moving field of (applied) research, our systematic literature review provides a comprehensive overview of its current state and serves as a starting point for delving into the matter of PQC migration.
This paper examines recurring technical and organizational bottlenecks in post-quantum cryptography (PQC) migration and develops an enterprise-oriented framework for managing them. A structured narrative review synthesizes NIST standards and guidance, CISA migration guidance, IETF specifications, and selected academic and research literature on enterprise migration, interoperability, software engineering, and PQC adoption. The paper organizes recurring migration concerns into five interacting layers and a six-stage migration lifecycle, and proposes candidate readiness metrics for future empirical testing. It connects technical migration concerns with organizational cybersecurity governance and presents a practical structure for treating PQC readiness as a continuous organizational capability. The framework is conceptual and is not presented as a validated maturity model.
Post-quantum cryptography (PQC) is driven by the threat posed by quantum computers, particularly the harvest-now-decrypt-later attack. PQC aims to prepare classical systems and hardware to become resilient against quantum attacks. This research discusses the system vulnerabilities, the need to migrate to PQC, and how to integrate this migration. PQC has become one of the solutions for addressing today’s vulnerabilities and threats while increasing security. The paper concludes that harvest-now-decrypt-later, Q-Day attacks, and new quantum attacks are today’s most critical threats, which can be addressed by deploying PQC solutions and, thus, increasing security. This research proposes a conceptual multi-phased model framework for the migration. The framework first addresses system objectives, goals and assets, then ranks assets based on the highest sensitivity. Crypto-Agility is achieved via the automation of PQC migration, such as the automation of re-keying endpoints, followed by the automation of auditing and testing of each migration stage. Human judgment is required to review the migration process. Once one asset is successfully transitioned, the framework goes to the next highest asset; otherwise, testing is repeated. This is expected to help systems migrate at the lowest cost and with the fewest consequences. However, the limitation of PQC migration is its high resource cost, time, requirement of human professionals, burden on existing systems, and financial expenses. Lastly, the paper recommends creating an ML model to help rank a system’s data and vulnerabilities. Moreover, the paper recommends conducting experiments to evaluate the effectiveness of the proposed framework. In addition, the paper recommends performing migration in relation to a real-world company.
The prospect of a cryptographically relevant quantum computer (CRQC) undermines the public-key primitives that secure virtually every layer of modern communication networks, from subscriber authentication in cellular cores to transport-layer key exchange. Adversaries already following a harvest-now, decrypt-later (HNDL) strategy make this threat actionable today for any traffic whose confidentiality must outlast a decade. Following NIST’s finalisation of the first post-quantum cryptography (PQC) standards, ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) in August 2024, and the selection of HQC as a fourth key-encapsulation candidate in March 2025, research has shifted from algorithm design to network-level integration. This paper reports a PRISMA-2020-compliant systematic literature review of PQC migration in communication networks, structured around five research questions covering protocol and scenario coverage, quantitative performance impact, hybrid cryptography strategies, transition barriers, and open research gaps. Six databases (IEEE Xplore, Scopus, Web of Science, ACM Digital Library, SpringerLink, and MDPI) were searched (3229 records identified); after deduplication, title-keyword screening, full-text eligibility assessment, and a pre-specified quality appraisal (Q1–Q6, threshold ≥3/6) applied to 310 eligible studies, a final synthesis corpus of 141 studies (68 journal articles, 68 conference papers, 4 conference-derived book chapters, 1 workshop paper) was screened, quality-appraised, and synthesised narratively with supporting evidence tables. The review finds that transport-layer protocols (TLS 1.3, QUIC, DTLS 1.3) dominate the literature, that lattice-based ML-KEM/ML-DSA offer the most favourable latency–bandwidth–energy trade-off among standardised families, and that classical–PQC hybrid schemes are the de facto transition strategy across 5G/6G, IoT, VPN, and automotive scenarios, at the cost of 10–100× larger keys/signatures and 8–40% handshake latency overhead. Persistent barriers include constrained-device resource limits, immature hardware acceleration, incomplete IETF/3GPP standardisation, and public-key-infrastructure scaling. We propose a five-level PQC transition-readiness maturity model and identify large-scale field validation, PQC–QKD integration, and lightweight signature schemes as priority directions for future work.
Post Quantum Cryptography (PQC) readiness is increasingly constrained not by algorithm availability, but by cryptographic visibility, dependency complexity, and fragmented governance. This paper presents an anonymised case study of a large European critical service provider that initiated PQC readiness through a discovery first strategy, utilizing tool supported cryptographic inventorying to establish an evidence based baseline prior to migration planning. The discovery phase revealed systemic challenges, including distributed cryptographic ownership, uneven evidence quality across legacy and modern environments, and high dependency on third party cryptographic roadmaps. To operationalise these findings, the organisation introduced a structured exposure register that enabled prioritisation based on asset criticality, confidentiality longevity, and migration feasibility. We argue that PQC discovery should be understood as a governance capability that stabilises organisational knowledge and converts cryptographic uncertainty into measurable accountability, supporting risk based decision making and ecosystem coordination. The results contribute actionable lessons for institutions pursuing crypto-agility and resilience under post quantum harvest now, decrypt later threat models.