Network Security & PQC Migration
Prepare NGFWs, IDS/IPS, and network security appliances for post-quantum cryptography. Covers TLS inspection impacts, DPI with larger PQC certs, vendor migration roadmaps, and PQC-aware zero trust network architecture.
Why this matters: TLS inspection and DPI already strain under today's certificate sizes — PQC certificates are bigger still, and NGFW/IDS vendors (Cisco, Palo Alto, Fortinet, Juniper) are migrating on different schedules you have to plan around.
Start here: Switch the NGFW Cipher Policy from classical to hybrid to pure PQC: the analyzer shows the certificate-size, handshake-latency and hardware-offload impact of each.
For your role
- Security Architect
- Simulate TLS-intercept proxy behaviour with PQC certificate chains, design a quantum-safe zero-trust network access architecture, and analyse PQC payload sizes against TCP initial congestion windows.
- Researcher / Academic
- The initcwnd analysis and the DPI-with-larger-certificates simulation quantify what PQC handshakes do to inspection appliances; the vendor comparison across Cisco, Palo Alto, Fortinet, Juniper and Check Point records the schedules.
- IT Ops / DevOps
- Analyse NGFW cipher suites and the impact of enabling PQC, configure IDS/IPS rule categories for PQC traffic, and read the vendor roadmaps: the appliances migrate on different schedules you plan around.
Post-quantum cryptography introduces fundamental changes to network security operations that go beyond algorithm upgrades. Larger certificates (2.5-5KB vs RSA 1KB), heavier TLS handshakes, and new key exchange patterns challenge every component of a modern network security stack — from perimeter firewalls to inline DPI appliances.
ML-DSA-65 cert: ~2.5KB vs RSA-2048: ~1.2KB. Full hybrid chain: 5-8KB.
Classical (9 ms), Hybrid (28 ms), and Pure PQC (35 ms) overhead across boundaries.
TLS inspection certificate buffer requirements increase 4-8x for hybrid chains.
| Vendor | PQC Status | ML-KEM | Roadmap Year |
|---|---|---|---|
| Cisco | Roadmap | Roadmap | 2027 |
| Palo Alto Networks | GA | GA | 2025 |
| Fortinet | GA | GA | 2026 |
| Juniper Networks | GA | Roadmap | 2026 |
Related Resources
Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →
Analyze NGFW cipher policies, simulate TLS inspection, and design a PQC-ready zero trust architecture.
Check off all sections and mark this reading done.
Related modules
- SOC Implementation for PQCSame migration phase · Shares ML-KEM, ML-DSA, RFC 9846
- Web Gateway PQCSame track · Protocols · Same migration phase · Shares ML-DSA, ML-KEM, RFC 9846
- Crypto AgilityShares ML-DSA, ML-KEM, RFC 9370
- Quantum Key DistributionSame migration phase · Shares ML-KEM, RFC 9846, NIST IR 8547
Check your understanding
15 questions on Network Security & PQC Migration, each with its answer and the reason.
Take the quizNext step
Produce the artifact: Infrastructure Modernization PlannerThis module belongs to phase 6 (Infrastructure & Performance); Infrastructure Modernization Planner produces a deliverable of that phase in the Command Center.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.