Question 1

What is post-quantum cryptography (PQC)?

Accepted Answer

Post-quantum cryptography refers to cryptographic algorithms designed to resist attacks from both classical and quantum computers. These algorithms rely on mathematical problems — such as lattice structures, hash functions, and error-correcting codes — that remain hard even for quantum computers. The PQC 101 module walks through the core concepts and why migration is urgent.

Question 2

What is ML-KEM and what FIPS standard covers it?

Accepted Answer

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) is standardized in FIPS 203, published by NIST in August 2024. It is a lattice-based KEM that replaces classical ECDH and RSA key exchange for establishing shared secrets. The Algorithms page provides parameter details for ML-KEM-512, ML-KEM-768, and ML-KEM-1024.

Question 3

What is ML-DSA and what FIPS standard covers it?

Accepted Answer

ML-DSA (Module-Lattice-Based Digital Signature Algorithm) is standardized in FIPS 204, published by NIST in August 2024. It is a lattice-based digital signature scheme that replaces RSA and ECDSA for authentication and integrity. The Algorithms page compares ML-DSA-44, ML-DSA-65, and ML-DSA-87 across security levels and performance.

Question 4

What is SLH-DSA (SPHINCS+)?

Accepted Answer

SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), formerly known as SPHINCS+, is standardized in FIPS 205, published in August 2024. It offers 12 parameter variants across three security levels with fast and small optimization profiles, serving as a conservative hash-based fallback. The Algorithms page details all 12 variants with their signature and key sizes.

Question 5

What is FN-DSA (Falcon)?

Accepted Answer

FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm) is the name NIST plans to use for a standard based on Falcon. FIPS 206 remains in development; NIST has not published an Initial Public Draft or final standard. Falcon produces more compact signatures than ML-DSA, making it attractive for bandwidth-constrained environments like smart cards, though its implementation is more complex due to floating-point arithmetic. The Algorithms page compares the Falcon-512 and Falcon-1024 candidate parameters.

Question 6

What is a hybrid cryptographic approach?

Accepted Answer

A hybrid cryptographic approach combines a classical algorithm (such as ECDH or RSA) with a post-quantum algorithm (such as ML-KEM) so that the combined scheme remains secure as long as either algorithm is unbroken. This hedging strategy is recommended by ANSSI, BSI, and other agencies during the transition period while confidence in PQC algorithms matures. The Hybrid Crypto module covers composite certificates, dual key exchange, and deployment patterns.

Question 7

What is the difference between a KEM and traditional key exchange?

Accepted Answer

A Key Encapsulation Mechanism (KEM) uses a recipient's public key to encapsulate a randomly generated shared secret, producing a ciphertext that only the private key holder can decapsulate. Traditional Diffie-Hellman key exchange, by contrast, derives a shared secret through an interactive exchange of public values. The Algorithms page explains how KEMs simplify protocol design and why NIST chose the KEM paradigm for post-quantum key establishment.

Question 8

What NIST security levels exist?

Accepted Answer

NIST defines five security levels for PQC algorithms: Level 1 targets at least AES-128 equivalent security, Level 2 targets SHA-256 collision resistance, Level 3 targets AES-192, Level 4 targets SHA-384, and Level 5 targets AES-256. Most deployments use Level 1 (ML-KEM-512, ML-DSA-44) or Level 3 (ML-KEM-768, ML-DSA-65) to balance security and performance. The Algorithms page maps each algorithm variant to its security level and includes side-by-side performance benchmarks that compare each PQC algorithm directly against its classical counterpart (e.g., ML-KEM-768 versus X25519, ML-DSA-65 versus ECDSA P-256).

Question 9

What classical algorithms are quantum-vulnerable?

Accepted Answer

RSA, ECDSA, ECDH, DSA, and Diffie-Hellman are all vulnerable to quantum attack because they rely on the hardness of integer factoring or the discrete logarithm problem, both of which Shor's algorithm solves efficiently. Symmetric algorithms like AES and hash functions like SHA-256 are weakened but not broken by Grover's algorithm. The Quantum Threats module explains the mathematical basis and timelines for each vulnerability.

Question 10

Why is RSA vulnerable but AES is not?

Accepted Answer

Shor's algorithm can factor large integers and compute discrete logarithms in polynomial time on a quantum computer, directly breaking RSA and elliptic curve cryptography. Grover's algorithm, the best known quantum attack on symmetric ciphers, only provides a quadratic speedup — halving the effective key length — so AES-256 retains 128-bit security even against a quantum adversary. The Quantum Threats module illustrates these attack complexities side by side.

Question 11

When should I use ML-KEM vs ML-DSA vs SLH-DSA?

Accepted Answer

Choose the algorithm based on operation type: ML-KEM (FIPS 203) is the right choice for key exchange and establishing shared secrets — it replaces ECDH and RSA key encapsulation. ML-DSA (FIPS 204) is the primary choice for digital signatures, offering the best balance of signature speed, key size, and security; prefer it for general-purpose authentication, code signing, and certificate issuance. SLH-DSA (FIPS 205) is a conservative hash-based fallback when algorithm diversity matters more than performance — its security relies only on hash function properties, providing a hedge if lattice assumptions are weakened. FN-DSA (FIPS 206, pending) is preferred when compact signatures are critical, such as for smart cards or bandwidth-constrained IoT devices. The Algorithms page provides a side-by-side comparison of all parameter sets.

Question 12

What are LMS and XMSS, and how do they differ from SLH-DSA?

Accepted Answer

LMS (Leighton-Micali Signature) and XMSS (eXtended Merkle Signature Scheme) are stateful hash-based signature schemes standardized in NIST SP 800-208. They are highly efficient but require the signer to maintain reliable state — each private key can only be used a fixed number of times, and reusing a state breaks security. This makes them well-suited for controlled environments like firmware signing where state tracking is manageable. SLH-DSA (FIPS 205), by contrast, is stateless — it derives one-time keys internally and has no reuse risk, making it safer for general-purpose use at the cost of larger signatures. The Reference Library includes SP 800-208 alongside the FIPS 205 specification.

Question 13

What is a "Harvest Now, Decrypt Later" (HNDL) attack?

Accepted Answer

In an HNDL attack, an adversary intercepts and stores encrypted communications today with the intent of decrypting them once a sufficiently powerful quantum computer becomes available. Data with long confidentiality requirements — such as state secrets, health records, and financial data — is especially at risk. The Threats dashboard quantifies HNDL exposure windows across industries.

Question 14

What is HNFL (Harvest Now, Forge Later)?

Accepted Answer

Harvest Now, Forge Later (HNFL) is a threat where an adversary collects signed artifacts and public keys today, waiting until a quantum computer can forge valid digital signatures to impersonate trusted entities. This threatens long-lived code signing certificates, firmware authentication, and legal non-repudiation. The Threats dashboard models HNFL risk timelines alongside HNDL.

Question 15

What is a CRQC and when might one exist?

Accepted Answer

A Cryptographically Relevant Quantum Computer (CRQC) is a quantum computer capable of running Shor's algorithm against production key sizes, requiring on the order of thousands of stable logical qubits. Expert surveys (GRI 2025 Quantum Threat Timeline) put a CRQC most likely in the mid-2030s, though breakthroughs could accelerate this. The Threats dashboard tracks expert timeline estimates and updated forecasts.

Question 16

What industries face the highest quantum risk?

Accepted Answer

Financial services, healthcare, government and defense, and critical infrastructure face the highest quantum risk due to their combination of long data confidentiality requirements, strict regulatory obligations, and high-value targets. Industries handling data with decades-long sensitivity windows are most exposed to HNDL attacks. The Threats dashboard ranks industry-specific risk levels with mitigation strategies.

Question 17

What is the quantum threat to Bitcoin and Ethereum?

Accepted Answer

Bitcoin and Ethereum rely on ECDSA signatures (secp256k1) for transaction authorization, which Shor's algorithm would break by recovering private keys from exposed public keys. Ethereum co-founder Vitalik Buterin has published a defense roadmap that includes account abstraction and PQC signature migration. The Digital Assets module covers the specific vulnerabilities and proposed countermeasures for both blockchains.

Question 18

How does Grover's algorithm affect symmetric encryption?

Accepted Answer

Grover's algorithm provides a quadratic speedup for brute-force search, effectively halving the security level of symmetric ciphers — AES-128 drops to 64-bit security and AES-256 drops to 128-bit security. Because 128-bit security remains computationally infeasible, AES-256 is considered quantum-safe, while AES-128 may need to be phased out for high-security applications. The Quantum Threats module visualizes these security reductions.

Question 19

What is Mosca's Theorem?

Accepted Answer

Mosca's Theorem states that if the sum of your data's required confidentiality period and your organization's migration timeline exceeds the estimated time until a CRQC is available, then you must begin migrating now. It provides a simple inequality — shelf life + migration time > time to quantum — for deciding migration urgency. The PQC 101 module includes an interactive Mosca calculator.

Question 20

How many industries does the PQC Today Threats dashboard cover?

Accepted Answer

The Threats dashboard covers over 20 industries, each with detailed threat criticality levels, HNDL and HNFL risk assessments, and actionable mitigation strategies. Industries span financial services, healthcare, government, telecom, energy, automotive, aerospace, IoT, payment card, supply chain, media/DRM, legal/eSignature, and more. The dashboard allows filtering by industry to see sector-specific threat profiles and compliance requirements.

Question 21

What is the difference between physical and logical qubits?

Accepted Answer

Physical qubits are the raw hardware units in today's quantum processors — they are extremely noisy and error-prone, making them unsuitable for long computations on their own. Logical qubits are error-corrected qubits built from many physical qubits using quantum error correction codes, providing the reliability needed to run algorithms like Shor's. The conversion ratio is steep: current estimates require roughly 1,000 physical qubits per logical qubit for fault-tolerant operation, meaning a CRQC capable of attacking RSA-2048 would need millions of physical qubits — far beyond today's largest devices (Google's Willow chip reached 105 physical qubits in 2024, a milestone but orders of magnitude short of CRQC scale). The Quantum Threats module contextualizes hardware progress against CRQC thresholds.

Question 22

What are the four FIPS standards for PQC?

Accepted Answer

NIST has published three PQC FIPS standards: FIPS 203 (ML-KEM, lattice-based key encapsulation), FIPS 204 (ML-DSA, lattice-based digital signatures), and FIPS 205 (SLH-DSA, stateless hash-based signatures). All three were published in August 2024. A fourth, planned FIPS 206 for FN-DSA, remains in development with no published Initial Public Draft or final text. The Reference Library has the published standards and related source material.

Question 23

What is NIST IR 8547?

Accepted Answer

NIST IR 8547 (Interagency Report) provides transition guidance for migrating federal cryptographic systems to post-quantum algorithms, recommending that classical algorithms like RSA and ECDSA be deprecated by 2030 and disallowed by 2035. Note: it is still an Initial Public Draft (published Nov 2024, not yet finalized), so its 2030/2035 dates are draft guidance rather than settled policy. It is the most widely referenced US government transition timeline and complements the FIPS algorithm standards. The Reference Library links to the full document with implementation details.

Question 24

What is CNSA 2.0?

Accepted Answer

CNSA 2.0 (Commercial National Security Algorithm Suite 2.0) is NSA guidance for protecting National Security Systems. The current FAQ version 2.2 requires compliant new NSS acquisitions from 1 January 2027, phase-out of equipment and services that cannot support CNSA 2.0 by 31 December 2030 unless excepted, and CNSA 2.0 algorithms by 31 December 2031 unless otherwise noted. Earlier category guidance places exclusive use for software and firmware signing and traditional networking at 2030. The separate 2035 date is the broader NSM-10 quantum-risk objective, not the current CNSA 2.0 algorithm mandate. The Compliance Tracker shows these milestones alongside other frameworks.

Question 25

What is SP 800-208?

Accepted Answer

NIST Special Publication 800-208 standardizes the use of LMS (Leighton-Micali Signature) and XMSS (eXtended Merkle Signature Scheme) stateful hash-based signature algorithms. These schemes are suitable for firmware signing and other use cases where the signer can reliably maintain state to prevent key reuse. The Reference Library provides the full SP 800-208 text and related implementation guidance.

Question 26

What does RFC 9629 cover?

Accepted Answer

RFC 9629 defines the generic KEMRecipientInfo mechanism for using any KEM within the Cryptographic Message Syntax (CMS); the ML-KEM-specific CMS profile is RFC 9936, enabling PQC-protected S/MIME email encryption. ML-DSA digital signatures in CMS are covered separately by RFC 9882. The Reference Library includes these RFCs alongside related email security standards.

Question 27

What is ETSI TS 103 744?

Accepted Answer

ETSI TS 103 744 is a European Telecommunications Standards Institute specification providing migration guidance for adopting post-quantum cryptography in telecom networks. It addresses the specific challenges of network function virtualization, 5G infrastructure, and subscriber identity protection during the PQC transition. The Reference Library catalogs this alongside other ETSI PQC publications.

Question 28

What does BSI TR-02102 recommend?

Accepted Answer

BSI Technical Guideline TR-02102 is the German Federal Office for Information Security's cryptographic recommendations, which include PQC algorithm guidance and transition timelines for German government and critical infrastructure systems. It recommends hybrid classical-plus-PQC approaches during the transition and specifies minimum key sizes for each security level. The Reference Library provides the guideline alongside BSI's broader PQC program.

Question 29

What is the ANSSI PQC position?

Accepted Answer

France's ANSSI (Agence nationale de la securite des systemes d'information) requires hybrid classical-plus-PQC deployment for all lattice-based algorithms as a transitional security measure, reflecting caution about the maturity of lattice hardness assumptions. ANSSI has set some of the most aggressive European timelines, requiring PQC support in qualified products. The Reference Library links to ANSSI's published position papers and technical guidance.

Question 30

What is NIST CSWP 39?

Accepted Answer

NIST Cybersecurity White Paper 39 provides practical guidance for organizations preparing their migration to post-quantum cryptography, covering cryptographic inventory, risk assessment, and phased transition planning. It complements the FIPS algorithm standards by addressing organizational and operational readiness. The Reference Library includes CSWP 39 with cross-references to related NIST publications.

Question 31

What are RFC 9881 and RFC 9882?

Accepted Answer

RFC 9881 defines algorithm identifiers for ML-DSA within the X.509 Public Key Infrastructure — specifying OIDs and SubjectPublicKeyInfo encodings for ML-DSA public keys and signatures in certificates. RFC 9882 covers the use of ML-DSA within the Cryptographic Message Syntax (CMS), enabling ML-DSA digital signatures in S/MIME, code signing, and timestamping. Together they provide the interoperability foundation for ML-DSA across PKI and messaging protocols. The Reference Library catalogs both alongside the broader suite of PQC-related RFCs.

Question 32

When does NIST plan to deprecate classical algorithms?

Accepted Answer

According to NIST IR 8547 (currently an Initial Public Draft, Nov 2024), classical public-key algorithms such as RSA and ECDSA should be deprecated by 2030 and fully disallowed by 2035 in federal systems. These draft dates create a roughly 10-year window for organizations to complete their post-quantum migration. The Timeline view plots these milestones alongside country-specific deadlines.

Question 33

Which country has the most aggressive PQC deadline?

Accepted Answer

France, through ANSSI, has set some of the most aggressive PQC timelines in Europe, requiring PQC support in qualified security products and mandating hybrid deployment as an immediate transitional measure. South Korea (KISA) and the United States (CNSA 2.0 for national security systems) also have aggressive timelines. The Timeline view lets you compare country deadlines side by side.

Question 34

What is the EU's PQC transition target?

Accepted Answer

EU Recommendation 2024/1101 calls on member states to develop coordinated national strategies for transitioning to post-quantum cryptography, emphasizing crypto agility and hybrid approaches during the migration period. The recommendation aligns with the broader NIS2 and eIDAS 2.0 frameworks to ensure interoperability across the EU. The Timeline view shows EU-level milestones and member state progress.

Question 35

When does the UK plan to complete PQC transition?

Accepted Answer

The UK's National Cyber Security Centre (NCSC) has published a PQC migration roadmap with a target completion date of 2035, aligned with NIST's disallowance timeline. NCSC recommends organizations begin with a cryptographic inventory and prioritize systems handling long-lived sensitive data. The Timeline view shows the UK's phased approach alongside other countries.

Question 36

What are Canada's PQC migration phases?

Accepted Answer

The Canadian Centre for Cyber Security published ITSM.40.001, which defines a phased PQC migration approach including discovery (cryptographic inventory), planning (risk assessment and roadmap), and migration (implementation and validation). Canada's guidance emphasizes alignment with NIST standards while accommodating Canadian-specific regulatory requirements. The Timeline view details Canada's phase structure and key milestones.

Question 37

What is Germany's QUANTITY initiative?

Accepted Answer

QUANTITY is a joint BSI and DLR (German Aerospace Center) initiative launched in March 2025 focused on quantum cryptanalysis — stress-testing PQC algorithm candidates to validate their security assumptions and inform algorithm selection, rather than deploying quantum-safe infrastructure directly. Its findings complement BSI's broader PQC transition guidance (TR-02102) and strengthen confidence in standardized algorithms. The Timeline view shows Germany's milestone dates within the European context.

Question 38

What is the CNSA 2.0 exclusive phase deadline?

Accepted Answer

There is no single current deadline accurately described as a 2033 CNSA 2.0 exclusive phase. FAQ version 2.2 requires compliant new NSS acquisitions from 1 January 2027, phases out unsupported equipment and services by 31 December 2030 unless excepted, and mandates CNSA 2.0 algorithms by 31 December 2031 unless otherwise noted. Earlier category guidance sets 2030 exclusive-use milestones for software and firmware signing and traditional networking. The separate 2035 NSM-10 objective and the draft NIST IR 8547 civilian disallowance date have different scope and authority.

Question 39

What web browsers support ML-KEM for TLS?

Accepted Answer

Chrome (default since version 131, November 2024; version 124 shipped the earlier draft X25519Kyber768Draft00), Microsoft Edge, and Firefox all support the X25519MLKEM768 hybrid key exchange in TLS 1.3, combining classical X25519 ECDH with ML-KEM-768 for post-quantum protection. Safari added X25519MLKEM768 support in Safari 26 / iOS 26 / macOS Tahoe 26 (fall 2025). The Migrate catalog tracks browser PQC support alongside other infrastructure categories.

Question 40

What is the G7 financial sector PQC target?

Accepted Answer

The G7 Cyber Expert Group has recommended that financial sector institutions begin PQC transition planning, recognizing the systemic risk that quantum computing poses to the global financial system. This recommendation influences national regulators and aligns with parallel efforts by the BIS (Bank for International Settlements) and FSB (Financial Stability Board). The Timeline view shows financial sector milestones across G7 nations.

Question 41

When did Microsoft announce PQC transition?

Accepted Answer

Microsoft has announced the integration of ML-KEM across its core infrastructure including Azure cloud services, Windows, and Microsoft 365, with hybrid PQC key exchange already available in some services. The rollout covers TLS, code signing, and internal authentication systems. The Timeline view tracks Microsoft's milestones alongside other major vendor announcements.

Question 42

What PQC timelines exist for Japan, Singapore, and Australia?

Accepted Answer

Japan's NISC (National center of Incident readiness and Strategy for Cybersecurity) has aligned its PQC guidance with NIST standards, recommending organizations begin cryptographic inventories now and prioritize systems with long data retention periods. Singapore's CSA (Cyber Security Agency) issued a quantum safety advisory in 2023 and updated its Critical Information Infrastructure protection framework to include quantum risk. Australia's ASD (Australian Signals Directorate) and ACSC published quantum risk guidance endorsing NIST-aligned PQC algorithms and recommending that government agencies begin migration planning. All three are less prescriptive on deadlines than the US or EU but are accelerating their frameworks. The Timeline view tracks APAC milestones alongside Western deadlines.

Question 43

What is FIPS 140-3 and why does the validation backlog matter?

Accepted Answer

FIPS 140-3 is the US standard for cryptographic module security certification, required for federal procurement and widely adopted in regulated industries. The validation backlog at NIST's CMVP (Cryptographic Module Validation Program) means that PQC module certifications can take 18 months or longer, creating a gap between algorithm standardization and deployable certified products. The Compliance Tracker shows validation status across PQC products.

Question 44

What is eIDAS 2.0's PQC requirement?

Accepted Answer

eIDAS 2.0 is the updated EU regulation governing electronic identification and trust services, including the European Digital Identity Wallet (EUDI Wallet). While it does not mandate specific PQC algorithms yet, it requires crypto agility and quantum-readiness in qualified trust services to ensure long-term signature validity. The Compliance Tracker details eIDAS 2.0 requirements alongside other EU frameworks.

Question 45

What is DORA and when did it take effect?

Accepted Answer

The Digital Operational Resilience Act (DORA) is an EU regulation that took effect in January 2025, requiring financial institutions to address ICT risk management including cryptographic resilience. DORA mandates that organizations assess and mitigate risks from emerging technologies, which includes the quantum computing threat to current encryption. The Compliance Tracker maps DORA requirements to PQC migration actions.

Question 46

What does NIS2 require for PQC?

Accepted Answer

The EU NIS2 Directive (Network and Information Security Directive 2) mandates comprehensive risk management for essential and important entities, requiring them to adopt appropriate and proportionate technical measures — which increasingly includes quantum-resilient cryptography. NIS2 applies to energy, transport, health, digital infrastructure, and other critical sectors. The Compliance Tracker shows how NIS2 intersects with PQC migration requirements.

Question 47

What is Executive Order 14306?

Accepted Answer

Executive Order 14306 (June 2025) streamlined its predecessor EO 14144 and removed the binding PQC procurement requirement for federal agencies. CISA's PQC product-category list (January 2026) remains advisory, while National Security System acquisitions must be CNSA 2.0-compliant from January 1, 2027 under CNSSP-15. Binding civilian deadlines now come from the June 2026 PQC Executive Order: post-quantum key establishment by 2030 and signatures by 2031. The Compliance Tracker tracks these US federal requirements and their intersection with NIST IR 8547 migration timelines.

Question 48

What is NERC-CIP's relevance to PQC?

Accepted Answer

NERC-CIP (North American Electric Reliability Corporation — Critical Infrastructure Protection) standards mandate security controls for the bulk electric system, including the protection of electronic security perimeters and communications. As quantum computing threatens the cryptographic foundations of these protections, NERC-CIP compliance will require PQC upgrades to encryption and authentication. The Compliance Tracker shows energy sector requirements.

Question 49

What is Common Criteria's role in PQC?

Accepted Answer

Common Criteria (ISO/IEC 15408) is the international framework for evaluating IT product security, and the Common Criteria Recognition Arrangement (CCRA) enables mutual recognition across 31 member nations. Protection profiles for PQC-capable products are under development, and future evaluations will require demonstrating quantum resilience. The Compliance Tracker includes Common Criteria PQC developments.

Question 50

What is ISO/SAE 21434?

Accepted Answer

ISO/SAE 21434 is the international standard for automotive cybersecurity engineering, requiring threat analysis and risk assessment throughout the vehicle lifecycle including cryptographic components. It mandates crypto agility — the ability to update algorithms without hardware replacement — which is critical given 15-year vehicle lifetimes spanning the quantum transition. The Compliance Tracker maps ISO 21434 to PQC requirements.

Question 51

What does PCI DSS 4.0 require for PQC?

Accepted Answer

PCI DSS 4.0 (mandatory compliance as of March 2025) introduced Requirement 12.3.3, which mandates that organizations maintain a documented inventory of all cryptographic cipher suites and protocols in use and have a plan to address algorithm weaknesses — effectively requiring cryptographic agility planning. While PCI DSS 4.0 does not yet mandate specific PQC algorithms, the PCI Security Standards Council is actively monitoring NIST standards and is expected to incorporate PQC requirements in a future version. Organizations subject to PCI DSS should treat the Req 12.3.3 inventory as the foundation for their eventual PQC migration. The Compliance Tracker cross-references PCI DSS requirements with NIST migration guidance.

Question 52

What are the seven phases of PQC migration?

Accepted Answer

The PQC migration lifecycle consists of seven phases: Discover (cryptographic inventory), Assess (risk evaluation), Prepare (architecture and planning), Test (validation and interoperability), Deploy/Launch (production rollout), Ramp Up (expand coverage), and Stay Agile (ongoing monitoring and algorithm updates). Each phase has specific deliverables and success criteria. The Migrate catalog organizes products and guidance by migration phase.

Question 53

What infrastructure layers does the Migrate catalog cover?

Accepted Answer

The Migrate catalog covers nine infrastructure layers — Cloud, Network, Application Servers, Libraries, Security Software, Database, Security Stack, OS, and Hardware. Each layer includes products with PQC readiness status and FIPS validation tiers. The catalog also tracks web browser PQC support as a separate category.

Question 54

What do the FIPS badges in the Migrate catalog mean?

Accepted Answer

A badge appears only where a certification record backs it. "FIPS 140-3" means the product holds a FIPS 140-3 module certificate; "FIPS 140-3 in process" means NIST lists the module as in process; "CAVP only" means its algorithms are CAVP-validated — the prerequisite for a certificate, not a certificate. No badge means no FIPS 140-3 record is linked. Open a product to see whether its certificate covers the PQC algorithms or classical ones only.

Question 55

What should organizations do first for PQC migration?

Accepted Answer

The first step in PQC migration is conducting a comprehensive cryptographic inventory — identifying every place your organization uses cryptography across code, configuration files, certificates, protocols, and third-party dependencies. This inventory becomes the foundation for risk assessment and migration prioritization. The Crypto Agility module includes tools for building a Cryptography Bill of Materials (CBOM).

Question 56

How does the PQC Risk Assessment wizard work?

Accepted Answer

The PQC Risk Assessment is a 13-step wizard that evaluates your organization across dimensions including industry, country, cryptographic usage, data sensitivity, compliance requirements, migration readiness, infrastructure maturity, and vendor dependencies. It produces a scored report with risk categories, compliance gap analysis, and a prioritized migration roadmap. The report can be exported as a PDF.

Question 57

How many PQC-ready products does the catalog track?

Accepted Answer

The Migrate catalog tracks hundreds of products across nine infrastructure layers, each assessed for PQC readiness with specific algorithm support details and FIPS validation status. Products range from open-source libraries like OpenSSL and liboqs to commercial HSMs and cloud services from AWS, Azure, and GCP. The catalog is regularly updated as vendors announce new PQC capabilities.

Question 58

Can the assessment report be exported as PDF?

Accepted Answer

Yes, the PQC Risk Assessment report can be printed or saved as a PDF directly from your browser, preserving the full compliance gap analysis, threat landscape visualization, and prioritized migration roadmap. The print layout includes a professional header with your assessment parameters and a methodology explanation. The report is designed for board-level and audit presentations.

Question 59

What is the Migration Workbench?

Accepted Answer

The Migrate page is an asset-first workbench: you start from what you actually run, pick quantum-safe replacement products, and assemble a sequenced plan aligned to NIST IR 8547 and CNSA 2.0. Tabs cover "Replace what you own", "Plan & sequence", "Vendor roadmaps", and "Vendor risk". Your selection is saved in your browser, and a Share link lets a colleague open the same plan — they can restore their own selection with one click.

Question 60

What is a Cryptography Bill of Materials (CBOM)?

Accepted Answer

A CBOM is a structured, machine-readable inventory of where and how your systems use cryptography — algorithms, key lengths, certificates, protocols, and libraries — typically formatted using the CycloneDX standard, analogous to a software bill of materials (SBOM). It enables automated detection of quantum-vulnerable components and is the foundation of crypto-agility: you cannot migrate what you cannot see. The Cryptography Bill of Materials (CBOM) module walks through building one and using it to drive a prioritized migration.

Question 61

How do I safely retire legacy cryptography at the end of a migration?

Accepted Answer

The Decommissioning & Program Closure module covers the final phase: verifying that quantum-vulnerable algorithms are fully removed, retiring classical crypto without breaking interoperability, capturing evidence that the work is complete, and handing the program over to business-as-usual operations. It closes the loop so a migration does not quietly leave vulnerable cryptography in place.

Question 62

How does ML-KEM change the TLS 1.3 handshake?

Accepted Answer

In a PQC TLS 1.3 handshake, the client includes an ML-KEM public key (or hybrid key share) in the ClientHello message, and the server encapsulates a shared secret in the ServerHello response. This adds approximately 1KB to the handshake compared to classical ECDH, primarily from the larger key and ciphertext sizes. The TLS Basics module includes a step-through handshake simulator comparing classical, hybrid, and pure PQC modes.

Question 63

What is X25519MLKEM768?

Accepted Answer

X25519MLKEM768 is a hybrid key exchange method for TLS 1.3 that combines the classical X25519 ECDH key exchange with ML-KEM-768 (NIST Level 3 security), producing a combined shared secret that is secure against both classical and quantum attacks. It is already supported in Chrome, Firefox, and Edge, making it the most widely deployed PQC mechanism on the internet today. The TLS Basics module demonstrates this handshake interactively.

Question 64

What PQC algorithms work for VPN/IPsec?

Accepted Answer

For VPN and IPsec, ML-KEM provides post-quantum key exchange within IKEv2 (supported by strongSwan and other implementations), while ML-DSA provides PQC certificate authentication for tunnel endpoints. Hybrid modes combining classical and PQC algorithms are recommended during the transition to ensure backward compatibility and defense in depth. The VPN/SSH module covers configuration for strongSwan, WireGuard, and OpenVPN.

PQC Frequently Asked Questions

PQC Fundamentals

Quantum Threats

NIST Standards & Timeline

Migration Timeline

Compliance & Regulation

Migration Planning

Protocols & TLS

Infrastructure & Operations

Industry-Specific

PQC Today Platform

Role-Specific Guidance

Interactive Tools