Chapter 20 — Quantum and post-quantum security: engineering context
Lesson map
Lesson 20 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["20.1 What breaks and what does not"]
N2["20.2 Prioritizing with Mosca"]
N3["20.3 Standards and policy, with status"]
N4["20.4 Migration as a programme"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["20.1 What breaks and what does not"]
N2["20.2 Prioritizing with Mosca"]
N3["20.3 Standards and policy, with status"]
N4["20.4 Migration as a programme"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX039"]
[Learning outcomes]
|
v
[20.1 What breaks and what does not]
|
v
[20.2 Prioritizing with Mosca]
|
v
[20.3 Standards and policy, with status]
|
v
[20.4 Migration as a programme]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) explain the quantum threat to deployed cryptography precisely; (2) apply Mosca's inequality to prioritize systems; (3) summarize the standards and policy landscape with status; and (4) frame BPA's migration as an engineering programme. This chapter opens the PQC core and builds on all foundations.
20.1 What breaks and what does not
Shor's algorithm breaks RSA, finite-field Diffie–Hellman, DSA, ECDSA, EdDSA, ECDH and X25519 — every widely deployed public-key algorithm. Grover's algorithm weakens symmetric ciphers and hashes only modestly; AES-256 and SHA-384/SHA-512 remain conservative choices. So migration is about public-key cryptography: key establishment and digital signatures.
This divides BPA's inventory into two lists. Every RSA, ECDSA, ECDH and X25519 use needs replacement or a hybrid. AES-256 and SHA-384 uses need no change, and AES-128 can move to AES-256 during routine refresh. Keeping the lists separate stops the programme spending its first year on symmetric changes that reduce little risk.
20.2 Prioritizing with Mosca
For each system, estimate x (how long its data or signatures must remain secure), y (how long migration will take) and treat z (time until a CRQC) as a range. If x + y > z for plausible z, the system is already late (Mosca 2018). BPA's customs data (x = 25) is late under any plausible range; the container-tracking feed (x ≈ 0.1) can follow the normal technology cycle.
For customs data, x = 25 and migration may take y = 5 years, so any CRQC arriving before thirty years from now exposes some of today's records.
20.3 Standards and policy, with status
NIST published ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) in August 2024; stateful hash-based signatures are in SP 800-208; KEM usage guidance is SP 800-227 (September 2025). HQC was selected in March 2025 as a backup KEM (IR 8545); FN-DSA is being standardized. The draft NIST IR 8547 proposes deprecating 112-bit quantum-vulnerable algorithms after 2030 and disallowing them after 2035. The IETF has standardized hybrid TLS groups (RFC 10024) and hybrid terminology (RFC 9794). Statuses change — re-verify.
20.4 Migration as a programme
The NCCoE's Migration to Post-Quantum Cryptography project runs two workstreams with industry collaborators — cryptographic discovery (inventory tools that support risk-based prioritization) and interoperability testing of the standardized algorithms in common protocols. Engineering work packages for BPA: inventory (CBOM), requirements, architecture, vendor engagement, pilots, rollout, verification and agility.
The work packages run partly in parallel: inventory and vendor engagement start immediately because they set the pace for everything else. Pilots begin as soon as one library and one partner are ready, while verification is planned from the start.
20.5 Worked example
BPA's initial priority list: (1) customs replication and exports — confidentiality, x = 25; (2) partner VPNs — recorded traffic includes commercial terms, x = 10; (3) PKI root and firmware signing — long-lived trust; (4) public portal — hybrid TLS available cheaply; (5) internal short-lived telemetry — later.
The order follows x: the 25-year customs data first, then the 10-year commercial terms on the VPNs. The PKI root ranks third despite less sensitive data because it must be distributed long before use. The portal ranks fourth only because hybrid TLS there is cheap and quick. Telemetry with short lifetimes waits for normal library updates.
20.6 Common errors and limits
- Migrating symmetric cryptography first.
- Treating policy dates as quantum forecasts.
- Using vendor names ("Kyber") for final standards ("ML-KEM").
Symmetric-first migration spends effort where Grover has little effect while Shor-vulnerable key exchange keeps leaking recorded traffic. Policy dates such as CNSA 2.0 deadlines reflect planning, not predictions of a CRQC, and should not be read as forecasts. Draft names cause interoperability errors because draft Kyber and final ML-KEM differ, so inventories record final names and the standard each refers to, such as FIPS 203 for ML-KEM.
Exercises
- EX039 — Mosca table. Build a Mosca table (x, y, verdict across z = 10–30) for five BPA systems. Rubric: 3 = values justified, verdicts consistent.
- EX040 — Status brief. Write a 150-word status brief of PQC standards with citations. Rubric: 3 = correct statuses and dates.
Synthesis
Quantum computers threaten public-key cryptography; Mosca's inequality orders the work; standards exist for KEMs and signatures with more coming; migration is a multi-year programme.
Continue studying — chapter 20 of 50
← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →