aqora

Towards a Quantum Risk Index: a risk-based framework for prioritizing Post-Quantum Cryptography Migration

Ivan Soto Maciá

Jan 1, 20260 citations

Risk-Adaptive Framework for Enterprise Post-Quantum Cryptography Readiness and Transition

Ali Qureshi

Jan 1, 20261 citation

From Post-Quantum Cryptography to Quantum DevSecOps: Securing the Quantum Software Lifecycle

Evangelos Markakis, Ilias Politis, Nikolay Tcholtchev +14 more

Jun 18, 20260 citations

A Post-Quantum Security Framework for European Digital Identities

José Manuel Merlos, Jesús García-Rodríguez, Antonio Skármeta +4 more

Quantum computing threatens the foundations of currentcryptography, posing critical risks to digital identity systems. This pa-per presents a modular framework to support the transition of Europeandigital identities toward post-quantum cryptography (PQC). Developedwithin the context of the POSEIDON project, the framework considersboth Self-Sovereign Identity (SSI) principles and the European DigitalIdentity (EUDI) Wallet ecosystem.Our framework centers on crypto-agile abstraction layers and decou-ples identity components from underlying cryptographic primitives, en-abling the adoption of classical, hybrid, and post-quantum algorithms.The framework supports user-centric credential management, qualifiedsignatures, and resource-constrained IoT environments through inter-operable building blocks and lightweight components. Additionally, wecomplement our framework with the Quantum Risk Assessment Toolkit,a lifecycle-aware recommendation platform that rounds out the frame-work’s capabilities for achieving an agile PQC transition across differentdeployment scenarios.Quantum computing threatens the foundations of currentcryptography, posing critical risks to digital identity systems. This pa-per presents a modular framework to support the transition of Europeandigital identities toward post-quantum cryptography (PQC). Developedwithin the context of the POSEIDON project, the framework considersboth Self-Sovereign Identity (SSI) principles and the European DigitalIdentity (EUDI) Wallet ecosystem.Our framework centers on crypto-agile abstraction layers and decou-ples identity components from underlying cryptographic primitives, en-abling the adoption of classical, hybrid, and post-quantum algorithms.The framework supports user-centric credential management, qualifiedsignatures, and resource-constrained IoT environments through inter-operable building blocks and lightweight components. Additionally, wecomplement our framework with the Quantum Risk Assessment Toolkit,a lifecycle-aware recommendation platform that rounds out the frame-work’s capabilities for achieving an agile PQC transition across differentdeployment scenarios.

Jul 28, 20260 citations

Migrating two worlds at once: a comparative risk analysis of post-quantum cryptographic adoption in information-technology and operational-technology environments

Simon Baradziej

The standardization of post-quantum cryptography (PQC) by the National Institute of Standards and Technology in 2024 opened a migration that most organizations run across two different estates: information technology (IT) and operational technology (OT). Policy often treats this as a single program with one deadline, yet the constraints on cryptographic change in a data center bear little resemblance to those in a substation, a water plant, or a rail interlocking. This paper develops a structured comparative risk analysis of PQC migration in IT and OT. Drawing on standards, agency guidance, government oversight reporting, and technical literature, it compares the two environments across seven constraint dimensions and extends the comparison to a six-sector critical-infrastructure matrix. The analysis is framed as a likelihood-and-impact risk assessment; Mosca's inequality supplies the timing terms that drive sequencing. IT risk is dominated by data-harvesting exposure that vendor-driven updates remediate, whereas OT risk is dominated by the difficulty of changing multi-decade field assets in time and by the consequence of failure. Sector-aware mitigations follow: confidentiality-first sequencing and hybrid key establishment for IT; crypto-agility, segmentation, prioritized authentication, and lifecycle-aligned replacement for OT.The standardization of post-quantum cryptography (PQC) by the National Institute of Standards and Technology in 2024 opened a migration that most organizations run across two different estates: information technology (IT) and operational technology (OT). Policy often treats this as a single program with one deadline, yet the constraints on cryptographic change in a data center bear little resemblance to those in a substation, a water plant, or a rail interlocking. This paper develops a structured comparative risk analysis of PQC migration in IT and OT. Drawing on standards, agency guidance, government oversight reporting, and technical literature, it compares the two environments across seven constraint dimensions and extends the comparison to a six-sector critical-infrastructure matrix. The analysis is framed as a likelihood-and-impact risk assessment; Mosca's inequality supplies the timing terms that drive sequencing. IT risk is dominated by data-harvesting exposure that vendor-driven updates remediate, whereas OT risk is dominated by the difficulty of changing multi-decade field assets in time and by the consequence of failure. Sector-aware mitigations follow: confidentiality-first sequencing and hybrid key establishment for IT; crypto-agility, segmentation, prioritized authentication, and lifecycle-aligned replacement for OT.

Next research.Sep 25, 20260 citations

Post quantum cryptography for data safeguarding

Mohammed Suhail Hussain, Karmel Arockiasamy, G. Kanimozhi

Elsevier eBooksJan 1, 20250 citations

A Data Lifecycle-Aware Risk Assessment Framework for Post-Quantum Cryptography

Related papers

A Data Lifecycle-Aware Risk Assessment Framework for Post-Quantum Cryptography

Related papers