Post-Quantum Cryptography Support Action

WP3: Migration Roadmap

This work package drafts the roadmap for migration to post-quantum cryptography.
The objectives of this work package are as follows:

3.1 Prepare the supply chain for the demand in PQC solutions.
3.2 Provide stakeholders with a roadmap of how to migrate to PQC.
3.3 Establish that the PQCSA migration to PQC roadmap is fit for purpose.
3.4 Demonstrate that the versatility of the PQCSA migration to PQC roadmap on at least one sector.

Global PQC Roadmaps and Guidelines

Governments and cybersecurity agencies worldwide have established competence centers and published strategic roadmaps to guide the transition to post-quantum cryptography. While timelines vary, the consensus requires immediate cryptographic inventory, hybrid approaches and crypto-agility. Notable regional initiatives include:

United States: The transition is driven by NIST's standardized algorithms (FIPS 203, 204, 205). The NSA's CNSA 2.0 mandates PQC for National Security Systems by 2035, while CISA provides operational readiness roadmaps for critical infrastructure.
Europe (EU): ENISA coordinates the EU approach with a goal of full transition by 2035. National agencies such as Germany's BSI and France's ANSSI strongly advocate for hybrid cryptographic schemes for critical infrastructure (targeted for 2030-2032).
United Kingdom: The NCSC UK has published a three-phase roadmap moving from discovery (2028) to priority migration, aiming for full adoption by 2035.
Canada & Australia: Canada's CCCS sets a 2031 high-priority migration deadline. Australia's ASD advises against relying solely on classical asymmetric cryptography post-2030.
Japan: CRYPTREC evaluates PQC algorithms for national use, providing technical guidelines aligned with a 2035 transition target.
India: Driven by the National Quantum Mission (NQM), India targets cryptographic sovereignty with strict milestones for Critical Information Infrastructure (CII) foundational readiness by 2029 and full migration by 2033.
China: The Office of State Commercial Cryptography Administration (OSCCA) focuses on domestic standards and cryptographic sovereignty, actively exploring the integration of PQC with Quantum Key Distribution (QKD) technologies.

Required Building Blocks for PQC Migration

Migration to post-quantum cryptography requires specific building blocks across cryptographic libraries, providers and hardware. Here the author outlines building blocks that provide quantum-security. As an implementation reference, guidance on secure protocol implementations can be found via the NIST NCCoE FAQ on Secure Protocol Implementations.

Interoperability and Commercial Tools

A comprehensive overview of commercial and non-commercial tools is maintained by the PKI Consortium in their PQC Capabilities Matrix (PQCCM). In particular, it tracks software applications, libraries and hardware that include support for post-quantum cryptography. The NIST SP 1800-38C Preliminary Draft contains first results of interoperability tests between different PQC tools. The NIST NCCoE Migration to PQC project provides guidance on transitioning these building blocks and ensuring interoperability. Note that the overviews serve as lists of existing PQC solutions.

Furthermore, interoperability requires standardizing post-quantum cryptography across network protocols and certificate formats. Key standards include:

TLS: RFC 9954 and RFC 10024 define hybrid key exchange mechanisms for TLS 1.3, which are supported by major web browsers (e.g., Chrome 131+, Edge 131+, Firefox 132+).
Cryptographic APIs: Interfaces such as PKCS#11 (version 3.2) and the Java Cryptography Extension (starting with Java 24) support ML-KEM and ML-DSA.
Certificates (X.509): Several RFCs standardize the use of stateful hash-based signatures (XMSS/LMS via RFC 9802) and lattice-based algorithms (ML-KEM via RFC 9935, ML-DSA via RFC 9881 within X.509 certificates.
S/MIME and CMS: RFC 9882 for the Cryptographic Message Syntax (CMS) supports ML-DSA for secure email and document signing.
OpenPGP: RFC 9980 defines post-quantum public-key encryption and digital signatures for the OpenPGP protocol.
IPsec/IKEv2: RFC 9370 specifies multiple key exchanges in IKEv2 for PQC, while RFC 8784 details the integration of IKEv2 with Post-Quantum Pre-Shared Keys (PSK).

Operating Systems with PQC Support

Major operating systems integrate post-quantum algorithms into their core cryptographic libraries and network stacks:

Windows: Microsoft introduced native PQC support (ML-KEM, ML-DSA and hybrid composite PQC) via the Cryptography API: Next Generation (CNG) starting with the November 2025 updates for Windows Server 2025 and Windows 11 (24H2/25H2). It supports quantum-safe TLS handshakes, code signing and Active Directory Certificate Services (AD CS).
macOS / Apple Platforms: Native PQC support was introduced in Apple's CryptoKit starting with macOS 26 (and iOS 26). It provides APIs for ML-KEM and ML-DSA. Furthermore, it enables default hybrid key exchange in TLS 1.3 for system services and applications using URLSession. Native VPN (IKEv2) and SSH implementations have been extended with quantum-safe key exchange.
Red Hat Enterprise Linux (RHEL): RHEL introduced PQC as a Technology Preview in RHEL 10.0, moving to default post-quantum key exchange for major libraries (OpenSSL, GnuTLS, OpenSSH) and hybrid package signing starting in RHEL 10.1.
Ubuntu: NIST-standardized PQC algorithms are available starting with Ubuntu 26.04 LTS (OpenSSL, OpenSSH).

Open-Source Cryptographic Libraries

Established open-source cryptographic libraries integrate support for NIST-standardized PQC algorithms (e.g., ML-KEM, ML-DSA and SLH-DSA). Repositories such as the IETF-Hackathon PQC Certificates provide sample post-quantum cryptography certificates for development and interoperability testing.

OpenSSL: Native PQC support starting in version 3.5 (earlier versions support PQC via the oqs-provider plugin).
Bouncy Castle: PQC algorithms are supported in Java starting from version 1.79 and in C# .NET from version 2.5.0.
Botan: PQC support was introduced with the 3.0 release series.
wolfSSL: Native PQC support is available starting from version 5.9.0.
BoringSSL: Uses a rolling release model without traditional version numbers; ML-KEM support has been integrated since late 2024.

PQC Transitioning Tools & Cryptographic Inventory

A necessary step in the migration process involves identifying and cataloging existing cryptographic assets. In particular, these assets are documented via a Cryptographic Bill of Materials (CBOM). Several open-source tools and projects facilitate this discovery and transition:

CryptoDeps: Analyzes software dependencies (e.g., Go, Python, npm, Maven) to identify the use of quantum-vulnerable cryptographic algorithms and assess quantum-risk exposure.
CBOMkit: Performs static analysis of source code and bytecode to identify cryptographic API usage and generate CycloneDX-compliant CBOMs.
CryptoScan and TLS Analyzer: Scan codebases, infrastructure and TLS/SSL configurations to evaluate compliance with transition timelines and identify vulnerable components.

Funding acknowledgement:

The PQCSA project funded under Grant Agreement No. 101190512 is supported by the European Cybersecurity Competence Centre under the DIGITAL- ECCC-2024-DEPLOY-CYBER-06-STANDARDPQC call.

Disclaimer:

Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Cybersecurity Competence Centre. Neither the European Union nor the European Cybersecurity Competence Centre can be held responsible for them.
The information on this website is provided as is, and no guarantee or warranty is given or implied that the information is fit for any particular purpose. The user thereof uses the information at its sole risk and liability.

Last modified: 2026.09.03.