Post-Quantum Crypto Migration: What to Do Before 2030
NIST finalized ML-KEM and ML-DSA in 2024, and "harvest now, decrypt later" turned quantum risk from theory into a data-retention problem you have today. If your data needs to stay confidential past 2030, the migration clock already started.
Know what's actually at risk
RSA and ECC key exchange break first under a cryptographically relevant quantum computer. Symmetric crypto (AES-256) is comparatively safe — just double the key size margin. Prioritize anything encrypted today that must stay secret for 10+ years.
Inventory before you migrate
You can't rotate what you can't see. Crypto-agility starts with a full inventory of algorithms, key lengths and libraries across every service, cert and protocol.
- Scan TLS configs and cert chains fleet-wide
- Catalog hardcoded algorithm choices in code and configs
- Flag long-lived data (backups, archives, healthcare/financial records) first
Hybrid first, pure PQC later
Run classical + post-quantum key exchange together (X25519 + ML-KEM) so a break in either alone doesn't compromise the session. Browsers and major TLS stacks already support this mode.
Watch the ecosystem lag
HSMs, smart cards and embedded devices are slowest to get PQC support. Budget for hardware refresh cycles, not just a software patch.
Tools mentioned
You don't need a quantum computer to have a quantum problem. If your data must stay secret past 2030, start the inventory now — migration is a multi-year project, not a patch.