Secrets Management & PQC
Master PQC migration for secrets managers: classify secrets by risk, simulate Vault transit with ML-KEM, design rotation policies, and integrate into CI/CD pipelines.
Why this matters: A secret stored in Vault today with a 5-year rotation policy needs a PQC migration plan now, not when the rotation comes due — harvest-now-decrypt-later risk doesn't wait for your rotation schedule.
Start here: Design a PQC-aware rotation policy in step 3: each secret type gets a recommended TTL based on its risk level and HNDL exposure.
For your role
- Developer / Engineer
- Classify secret types by HNDL exposure, simulate Vault transit operations with PQC algorithms, and integrate PQC-safe secrets into Kubernetes, GitHub Actions and Terraform in the Pipeline Integration Lab.
- Security Architect
- The Rotation Policy Designer with automated TTL recommendations and the cloud provider comparison across AWS, Azure, GCP and Vault are the design decisions; a five-year rotation policy needs a plan now.
- Researcher / Academic
- The provider comparison records current PQC readiness of the secrets managers, and the Vault transit simulator shows the operations with PQC algorithms.
- IT Ops / DevOps
- The rotation policy designer and the pipeline integration steps are the operational changes; the classification step says which secrets go first.
Organizations manage two distinct categories of sensitive material: secrets (API keys, credentials, tokens, seed phrases) and cryptographic keys (KEKs, signing keys, DEKs). Understanding the distinction matters for PQC migration because they have different protection mechanisms and different risk profiles.
Secrets themselves are often not directly encrypted with asymmetric cryptography — they are stored in vaults that use envelope encryption. In envelope encryption, a Data Encryption Key (DEK) encrypts the secret, and a Key Encryption Key (KEK) wraps the DEK. The KEK is the quantum-vulnerable component when it uses RSA-OAEP or ECDH-ES. Migrating to for the KEK protects all secrets in the vault without touching the secrets themselves.
| Secret Type | Classical Protection | PQC Protection | Priority |
|---|---|---|---|
| API Keys / Tokens | AES-256 DEK wrapped with RSA-OAEP KEK | ML-KEM-768 KEK → AES-256 DEK | High |
| DB Credentials | Vault master key (RSA unsealed) | ML-KEM vault seal + dynamic secrets TTL 8h | Critical |
| TLS Private Keys | PKCS#12 encrypted with 3DES/AES | ML-DSA key pair + HSM storage | Critical |
| Signing Keys | RSA-2048 / ECDSA P-256 | ML-DSA-65 or ML-DSA-87 | Critical |
| OAuth JWT Signing | RS256 (RSA-2048) | ML-DSA-65 JWK (JOSE PQC draft) | High |
| AES-256-GCM DEKs | AES-256-GCM (direct) | AES-256-GCM (unchanged, already safe) | Low |
Key insight: The problem — how do you securely introduce an application to the vault without hardcoding a first credential? — is addressed by SPIFFE/SPIRE injecting verified workload identity. For the vault itself, migrating the master seal key to ML-KEM cascades PQC protection to all stored secrets.
Related Resources
Products shown here are a representative selection — not an exhaustive list. For the full vendor landscape with PQC readiness status, visit the Tools & Products tab in this module or browse the Migrate catalog →
Classify secrets by risk, simulate Vault transit PQC, design rotation policies, and compare cloud providers.
Check off all sections and mark this reading done.
Related modules
- Operating System & Platform Crypto PQCSame track · Software Infrastructure · Same migration phase · Shares ML-DSA, ML-KEM, NIST SP 800-227
- Ops Quantum ImpactShares ML-DSA, ML-KEM, NIST SP 800-57
- Confidential Computing & TEEsSame migration phase · Shares ML-DSA, ML-KEM, NIST SP 800-227
- Web Gateway PQCSame migration phase · Shares ML-DSA, ML-KEM, NIST SP 800-227
Check your understanding
15 questions on Secrets Management & PQC, each with its answer and the reason.
Take the quizNext step
Produce the artifact: Infrastructure Modernization PlannerThis module belongs to phase 6 (Infrastructure & Performance); Infrastructure Modernization Planner produces a deliverable of that phase in the Command Center.
Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.