Chapter 34 — Quantum and post-quantum security: integration

Chapter 34 — Quantum and post-quantum security: integration

Lesson map

Lesson 34 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["34.1 Integration map"]
  N2["34.2 Partner integration"]
  N3["34.3 Sequencing"]
  N4["34.4 End-to-end tests"]
  N5["34.7 Integration readiness checklist"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["34.1 Integration map"]
  N2["34.2 Partner integration"]
  N3["34.3 Sequencing"]
  N4["34.4 End-to-end tests"]
  N5["34.7 Integration readiness checklist"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX067"]

[Learning outcomes]
    |
    v
[34.1 Integration map]
    |
    v
[34.2 Partner integration]
    |
    v
[34.3 Sequencing]
    |
    v
[34.4 End-to-end tests]
    |
    v
[34.7 Integration readiness checklist]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) integrate PQC across TLS, VPN, PKI, code signing and data formats; (2) manage partner and vendor integration; (3) sequence integration to manage dependencies; and (4) run integration tests end to end. It builds on Chapters 16, 28 and 30.

34.1 Integration map

The dependency column explains most of the schedule: BPA controls its CDN and edge proxy, so web TLS moves first, while documents depend on partner and customs software that BPA cannot change. Reading the map row by row also shows which integration points share a dependency, such as the HSM serving both PKI and code signing, so one delay affects two domains.

34.2 Partner integration

Partners move at their own pace. Publish a migration notice with timelines, supported algorithms and test endpoints; offer an interoperability test environment; keep classical paths available with dated sunset. The customs agency, for example, may accept ML-KEM-wrapped exports only after its own upgrade; parallel recipients in CMS (classical and PQC) bridge the gap.

The test environment is the most useful item, because partners can try their software against BPA's new configuration without risk to production. Dated sunsets give partners a deadline to plan against, and BPA reminds them at fixed intervals before each date.

34.3 Sequencing

Sequence by dependency and value: edge TLS first (independent, high value); PKI root and HSM next (long lead time, enabler for signatures); firmware signing as devices are refreshed; documents with partners; internal services by data lifetime.

The PKI root and HSM come early despite low immediate risk because their lead times are long: procurement, certification and distribution of a new root can take years. Edge TLS goes first because BPA controls both the configuration and the measurement, and its value is immediate against harvest. Firmware signing follows device refresh cycles rather than a calendar date. This order follows dependency, not the order in which teams asked for work.

34.4 End-to-end tests

Integration tests exercise whole flows: a partner client connecting through the edge to an API that signs a document with ML-DSA, stored and replicated over hybrid TLS, verified by a customs test system. Failures in such tests reveal interface mismatches no unit test finds.

For example, a partner client might negotiate the hybrid group correctly while the API rejects the larger signed document because of a size limit in a database field. Only a test that follows the full flow finds this kind of mismatch between components that each passed their own tests.

34.5 Worked example

BPA's integration plan has 14 work packages. A dependency graph shows that the HSM upgrade gates five of them; procurement is therefore started in month one even though signatures are not urgent until month nine.

The HSM gates five work packages because PKI, code signing and document signing all need its new key types. Starting procurement in month one gives about eight months of lead time before signatures become urgent, which matches typical procurement and certification delays. Without the dependency graph, the HSM would likely have been ordered when the signature work began, delaying five packages at once.

34.6 Common errors and limits

• Integrating domains in isolation.
• Forgetting partner sunset dates.
• No end-to-end tests.

Integrating domains in isolation misses flows that cross them, such as a signed document travelling from the API through replication to customs. Forgotten sunset dates leave classical paths open indefinitely, undoing the migration's protection. Without end-to-end tests, interface mismatches surface in production as outages that each team blames on another. BPA's plan therefore names an owner for each cross-domain flow, keeps a sunset register reviewed monthly, and runs the full partner-to-customs test before each major change.

34.7 Integration readiness checklist

Before BPA switches a partner link to hybrid key exchange, the integration owner confirms four items: the partner's stack advertises the same hybrid group, both sides log the negotiated group, a classical fallback is still allowed only where the agreed exception list permits it, and a joint test window is booked with a rollback contact on each side. A link that fails any item stays on its current configuration and is rescheduled rather than forced.

Rescheduling costs a few days; forcing a failed link costs partner trust.

Exercises

• EX067 — Dependency graph. Draw (or list) the dependency graph for BPA's 5 domains. Rubric: 3 = HSM and partner dependencies visible.
• EX068 — Partner notice. Write a migration notice for shipping-line partners. Rubric: 3 = algorithms, test endpoints, timeline, sunset, contact.

Synthesis

Integration spans protocols, PKI, signing and documents; partners need notices and test environments; sequencing follows dependencies; end-to-end tests catch interface mismatches.

Continue studying — chapter 34 of 50

← Chapter 33 (draft) · Course chapter index · Chapter 35 (draft) →