Post-Quantum
The PQC countdown has already started — not to Q-Day, but to the date your migration must be complete.
A cryptographically relevant quantum computer has no responsible countdown. Your standards, deprecation and internal migration milestones do.
Unknown event
Cryptographically relevant quantum computer
Date unknown. It cannot be responsibly counted down to, so we treat it as a scenario, not a schedule. Plan against exposure windows and data lifetimes instead.
Known milestones
- 2030-12-31ProposedNIST target to deprecate 112-bit classical algorithms
- 2035-12-31ProposedNIST target for completed PQC migration
- 2026-03-15Effective200-day maximum TLS validity
Why now?
Migrations take years; exposure starts today
Public-key cryptography is the exposure
RSA and elliptic-curve systems fall to Shor's algorithm. They underpin every certificate chain in use today.
Symmetric cryptography is affected differently
Grover's algorithm reduces effective strength; larger key sizes are usually a sufficient response.
Harvest now, decrypt later
Traffic captured today can be decrypted after a capable machine exists — long-lived confidentiality is already at risk.
Inventory is the bottleneck
Most organizations cannot yet answer which systems use which algorithms. That answer takes months, not weeks.
Algorithm explorer
Compare classical and post-quantum algorithms
ML-KEM (FIPS 203)
- Function
- Key establishment
- Standard status
- Published standard
- Sizes
- ML-KEM-768: 1,184-byte public key, 1,088-byte ciphertext
- Likely certificate use
- TLS key exchange, typically hybrid with X25519 today
- Deployment considerations
- Larger handshake messages; check middlebox and MTU behaviour.
Size impact
What post-quantum actually costs on the wire
Signature size per algorithm
- Quantum resistant
- Quantum vulnerable
Public key size per algorithm
SLH-DSA inverts the trade: a 32-byte key with a signature measured in kilobytes.
Estimated authentication bytes in a single TLS handshake
Order-of-magnitude estimates for a two-certificate chain including transparency evidence. A roughly 8× increase is the number that breaks constrained links, embedded clients and initial-congestion-window assumptions — and the reason compact-proof designs are being explored.
Estimations
Nobody can date Q-Day. Everyone has dated the deadline.
▲ Common regulatory end-state for classical public-key cryptography
NIST IR 8547 (draft)
2030 – 2035
Deprecate 112-bit classical security by 2030, disallow after 2035.
NSA CNSA 2.0
2027 – 2033
National security systems to complete PQC transition.
EU coordinated roadmap
2026 – 2035
High-risk use cases migrated by end of 2030, remainder by 2035.
Global Risk Institute expert survey
2033 – 2043
Majority of experts place a meaningful CRQC likelihood in this band.
Optimistic hardware forecasts
2029 – 2035
Vendor roadmaps for fault-tolerant machines, treated as best case.
Ranges are published guidance and forecast bands, not predictions of a specific event. Treat regulatory dates as hard, hardware forecasts as soft.
Estimator
Mosca's inequality: are you already late?
If the time your data must stay secret plus the time your migration takes exceeds the time until a capable quantum computer exists, exposure has already begun.
Result
5 years short
X 10 + Y 7 = 17 vs Z 12
- Secrecy lifetime
- Migration time
Data you transmit today can be captured and decrypted before your migration completes. Prioritise hybrid key exchange on long-confidentiality traffic now.
Calculated in your browser. Nothing is stored.
Effort
Migration estimates by certificate population
| Population | Typical scale | Discovery | Migration | Difficulty | Primary blocker |
|---|---|---|---|---|---|
| Public TLS (internet-facing) | 10s – 1,000s | Weeks | 1 – 2 years | Hybrid key exchange is mostly a library and middlebox problem. | |
| Internal TLS / mTLS services | 1,000s – 100,000s | 3 – 9 months | 2 – 4 years | Unknown inventory and hand-rolled trust bundles. | |
| Code and firmware signing | 10s of keys, millions of artifacts | Weeks | 3 – 6 years | Verifier fleets in the field cannot be upgraded quickly. | |
| Devices, IoT and OT | 100,000s – millions | 6 – 18 months | 5 – 15 years | Secure elements with fixed algorithms and 10+ year field life. | |
| Documents, email and archives | Unbounded | Months | Ongoing | Confidentiality must hold for decades after transmission. |
Planning ranges drawn from published migration guidance and observed enterprise programmes. Your inventory quality, not your cryptography, usually sets the schedule.
Migration journey
Nine stages, run in parallel across populations
- Discover
- Classify
- Prioritize
- Design
- Experiment
- Pilot
- Deploy
- Observe
- Deprecate classical
Assessment
Crypto-agility readiness
Agility score
0%
Start with inventory. You cannot prioritize what you cannot see.
Nothing is submitted or stored. Score is calculated in your browser.
Emerging IETF work — not a deployed replacement for conventional certificates
Merkle Tree Certificates
Work in the IETF PLANTS working group explores representing certificate information inside a logged tree so a signed tree head can authenticate a batch of entries and individual credentials present compact proofs. It targets the overhead created by very short lifetimes and large post-quantum signatures. Track it; do not plan around it.