Identity & Access Management with PQC
Migrate enterprise IAM systems to quantum-safe cryptography: JWT/SAML token signing, Active Directory, LDAP, vendor roadmaps, and zero trust identity architecture.
Why this matters: Identity is the perimeter now — every JWT, SAML assertion, and OIDC token your IAM stack signs is a target, and Okta, Entra, PingFederate, and ForgeRock are all on different PQC timelines you have to track.
Start here: Migrate a SAML or JWT signature to ML-DSA in the Token Migration step: the signature sizes and header changes are compared on the same token.
For your role
- Executive / Business Leader
- Audit eight IAM components by quantum risk and migration priority, and score Okta, Entra, PingFederate and ForgeRock across PQC dimensions: the vendors are on different timelines you have to track.
- Developer / Engineer
- Migrate SAML and JWT signing to ML-DSA and compare signature sizes and headers, then simulate translating a PQC SAML assertion to classical RSA for legacy relying parties.
- Security Architect
- Design the phased roadmap across the five identity pillars in Step 5, with the AD, OpenLDAP and Entra vulnerability analysis in Step 3 behind it.
- Researcher / Academic
- The vendor scoring across PQC dimensions and the directory vulnerability analysis with HNDL exposure are explicit and repeatable; the token-migration step gives the signature sizes.
- IT Ops / DevOps
- The eight-component audit in Step 1 orders the work, and the legacy-translation step in Step 6 is what keeps old relying parties working during the cutover.
- Curious Explorer
- Every login token your systems issue is signed; the module shows which parts of an identity system a quantum computer would break and in what order to fix them.
Identity and Access Management relies on cryptography at every layer. From and SAML token signing to TLS channels and PKI certificates, a quantum computer running Shor’s Algorithm can break the RSA and ECDSA signatures that protect every identity assertion in your enterprise.
Adversaries are recording encrypted network traffic today. When a Cryptographically Relevant Quantum Computer (CRQC) becomes available, they will decrypt all captured Kerberos ticket exchanges, SAML assertions, and JWT signing key exchanges — granting retroactive access to every identity token ever issued.
Kerberos TGTs (10h) and service tickets (10h) encrypted with RSA PKINIT session keys. A quantum computer decrypting captured traffic could forge arbitrary tickets, breaking the entire domain.
SAML assertions can be replayed. Long-lived assertions (hours to days) are high-value HNDL targets. Forged SAML can grant federated access to all relying parties.
JWTs are commonly cached and reused for their full validity period. Refresh tokens (weeks/months) are the highest HNDL risk; access tokens (1h) are lower but still significant.
OIDC ID tokens carry identity claims. If an attacker captures and later decrypts an ID token, they can forge identity assertions to all OIDC relying parties that trust the issuer.
Short-lived access tokens (1h) reduce HNDL risk but long-lived refresh tokens are critical. Client credentials and device flow tokens may have longer lifetimes requiring priority migration.
| Algorithm | Sig Bytes | Sign Time | Status |
|---|---|---|---|
| RS256 | 256 B | 1ms | Vulnerable |
| ES256 | 64 B | 0.5ms | Vulnerable |
| ML-DSA-44 | 2,420 B | 1.8ms | Quantum-Safe |
| ML-DSA-65 | 3,309 B | 2.1ms | Quantum-Safe |
| ML-DSA-87 | 4,627 B | 3ms | Quantum-Safe |
Related Resources
Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →
Audit IAM crypto, migrate JWT signing, analyze directory services, and design a zero trust PQC roadmap.
Check off all sections and mark this reading done.
Related modules
In the Industry Landscape
Check your understanding
15 questions on Identity & Access Management with PQC, each with its answer and the reason.
Take the quizNext step
Practice it: Multi-Algorithm SigningMulti-Algorithm Signing is the hands-on version of this module: the same ideas, run in your browser.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.