Quantum-Ready Networks: Building Infrastructure for a Post-Quantum Era

Building infrastructure for the post-quantum era might sound challenging and overwhelming. Sure, this process requires some knowledge to make the transitions. That’s why we decided to share a helpful plan regarding every needed step.

According to NIST (National Institute of Standards and Technology), the deadline for shifting towards PQC (post-quantum cryptography) will be around 2030. That’s why now is the ideal time to start planning and thinking about this transition.

Let’s take, for instance, blockchain, which fully relies on asymmetric cryptography. Right now, digital signatures are secure, but they will be so only until the quantum computer. That’s why, without the quantum-safe algorithms, there won’t be any trust in the blockchain anymore.  

PQC Migration: A Structured Step-by-Step Plan

Transition to quantum-safe algorithms will directly impact the security standards and make them much higher. The whole process might sound overwhelming, but it is possible to divide it into a couple of manageable steps. So, let’s proceed to the actual process that consists only of 4 major steps.

Step 1: Monitor and Document PKI Assets

The most basic step that should be taken is checking all the necessary PKI. When you have a full awareness of all the processes, you can make more informed decisions regarding updates and other tasks.

Also, additional attention should be given to IoT devices, the root CA, and apps used in various environments. This may help to specify some additional vulnerabilities in the system. Here are the major steps that should be done:

• If you have a complex system, it is highly important to use automated PKI tools.
• Classify certificates based on the used algorithms, expiration data, and risk level.
• To find additional weaknesses, it is recommended to document PKI dependencies.   

Step 2: Evaluate and Prioritize Asset Risks

Every company has different security priorities based on the most sensitive data. Here, you need to clearly understand the quantum risk per asset. This means that the whole approach will be oriented on the securing of the most vital assets, and other data can be protected with the most standard approaches.

To the information that requires immediate quantum-safe protection, we can relate identification data, financial information, and other sensitive data. Other lower-risk data can be safeguarded by legacy PKI.

Here is a list of the high-priority sensitive data systems:

• Cloud-based authentication.
• Identity management systems.
• Governmental interactions.
• Financial systems.

Medium-priority systems can be the following:

• Encrypted email.
• Enterprise VPNs.
• Secure interaction.
• Authentication certificates.

To the low-priority information, we can relate apps with limited encrypted needs. Depending on the individual risks and requirements, these systems can be prioritized in a different way.

Step 3: Implement Hybrid PKI for a Secure Transition

Once you have completed the evaluation of the current PKI and have chosen the needed priorities for the protection, the following step is the introduction of a post-quantum hybrid PKI.

Understanding a PQC-Ready Hybrid PKI 

Hybrid PKI means that both PQC and traditional cryptography are united to guarantee total protection for the devices and systems that cannot be upgraded at the same time.

The best solution relates to the support of RSA/ECC together with PQC algorithms. This approach is the most suitable for triaged protection when you have high and low priorities.

Best Practices for Hybrid PKI Deployment

• Deployment of hybrid certificates that suit both PQC and RSA/ECC.
• Choose certificate authorities that offer quantum-safe variants.
• Check quantum-resistant TLS.

Step 4: Define and Achieve Incremental Migration Goals

Transition can be a long process, and it cannot happen overnight. Even when planning a hybrid PKI, it may require some time and effort, but it is definitely worth doing.

We have only a couple of years till the deadline in 2030 for the protection of the highest-priority assets. Here is a simple roadmap for all the companies that want to start now and know where they are moving in the long run:

• 2025-2027: During this period of time, it is crucial to begin testing hybrid PKI and upgrading the highest-risk assets.
• 2028-2030: Change all the critical standard-dependent algorithms with quantum-safe options. Then, also schedule audits for the regular checks.
• 2031-2035: The final stage of migration, where it is needed to create the future course for the next improvements.