Architect Quantum Impact
Understand how the quantum threat impacts system architecture, key management, and infrastructure design decisions.
Why this matters: Architecture decisions made today — KMS, HSM, PKI topology — outlive any single algorithm; get crypto-agility wrong now and every future PQC transition costs far more to retrofit.
Start here: Model the Strangler Fig migration in step 5: a legacy monolith moves behind a PQC API gateway one route at a time.
For your role
- Security Architect
- Score your architecture across nine criteria in the Architecture Readiness step, then model a legacy monolith's gradual migration behind a PQC abstraction layer: the action plan runs from crypto mapping to a reference architecture.
For the Security Architect
“Architecture decisions have 10-20 year lifespans. Every system you design today must be quantum-safe by design.”
Why This Matters for You
As a security architect, your designs define the cryptographic foundation for systems that will operate well into the quantum era. Key management infrastructure, certificate hierarchies, and protocol choices made now will be the hardest and most expensive components to migrate later. Crypto-agile architecture is not optional — it is a survival requirement.
Key Threat Impacts
Key Management Infrastructure
KMS, HSM, and key hierarchy designs are the most complex and expensive components to migrate to PQC.
2025-2030 design window
Certificate Chain Size Explosion
PQC certificates are roughly 4-7x larger than ECC certificates (SLH-DSA-based certificates can run considerably larger still), impacting TLS handshakes, embedded systems, and storage.
Immediate design impact
Hybrid Deployment Architecture
The 5-10 year transition period requires architectures supporting both classical and PQC algorithms simultaneously.
2025-2035
Algorithm Selection Complexity
Different use cases require different PQC algorithms (ML-KEM for KEM, ML-DSA for signing, SLH-DSA for long-lived signatures).
2025-2028
Knowledge Domains
Core Architecture
Design crypto-agile, algorithm-independent systems from the ground up.
Key & Certificate Infrastructure
Architect PQC-ready key management and PKI hierarchies.
Algorithm Depth
Understand algorithm trade-offs for informed selection decisions.
Specialized Infrastructure
Address quantum-safe requirements for TEEs, IoT, and constrained environments.
Workshop: 6 Steps
See how each quantum threat affects your role, with its severity and timeframe, and open an example scenario for each.
Rate your current knowledge of each skill to see your readiness score and priority gaps, with links to the modules that cover each skill.
Work through a phased action plan (this week, 30 days, 90 days and 6 months) with quick wins and success metrics for your role, and export it.
This workshop also includes: Architecture Readiness Self-Assessment, Strangler Fig, Trust Hardware Selector.
Quick Wins to Start Today
Map your crypto touchpoints
Spend 30 minutes diagramming where cryptography lives in your architecture.
Check your HSM vendor’s PQC roadmap
Thales, Entrust, and Utimaco ship PQC firmware, with different algorithm sets. Check what yours supports.
Calculate your PQC certificate chain size
Multiply your chain depth by the 1952-byte public key plus the 3309-byte signature of each ML-DSA-65 cert. Does it fit your budget?
Related modules
- Researcher Quantum ImpactSame track · Role Guides · Same migration phase · Shares ML-DSA, ML-KEM, SLH-DSA
- PQC GRCSame migration phase · Shares ML-KEM, ML-DSA, SLH-DSA
- Skills & Team StructureSame migration phase · Shares ML-KEM, ML-DSA, SLH-DSA
- Cryptographic APIs & Developer LanguagesSame migration phase · Shares Falcon, ML-DSA, ML-KEM
Check your understanding
18 questions on Architect Quantum Impact, each with its answer and the reason.
Take the quizNext step
Continue the Role Guides track: Ops Quantum ImpactOps Quantum Impact is the next module in the Role Guides track.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.