Migration to PQC: Hybrid Approaches

Transitioning from classical to post-quantum cryptography is the largest cryptographic migration in history — more complex than the 2048-bit RSA upgrade or SHA-1 deprecation. It requires updating protocols, libraries, HSMs, certificates, and code simultaneously.

Hybrid KEM = Classical KEM + PQC KEM. Shared secret = KDF(classical_secret || pqc_secret). Security: requires breaking both. A quantum adversary breaks ECDH but not Kyber. A classical adversary breaks neither. Provides defense-in-depth during the transition period.

Google Chrome and Cloudflare deployed X25519Kyber768 (combining ECDH X25519 + Kyber-768) in TLS 1.3 in 2023. The IETF draft draft-ietf-tls-hybrid-design defines the framing. Both sides negotiate the combined key share in the existing TLS ClientHello extension.

X.509 certificates currently use RSA or ECDSA public keys. Migration path: (1) issue dual-algorithm certificates (classical + PQC), (2) intermediate CAs use PQC keys, (3) root CAs transition last. CA/Browser Forum is developing PQC certificate profiles.

Many HSMs cannot be firmware-updated to support PQC algorithms. Hardware refresh cycles are 5-10 years. Organizations must audit HSM firmware roadmaps, plan hardware replacement, and consider software-based PQC bridges for legacy HSMs during transition.

Step 1: conduct a cryptographic inventory. Identify: every RSA/ECC key and certificate, every DH key exchange, every protocol version. Tools: cipher suite scanners, certificate inventory tools, static code analysis for crypto calls. Document all asset lifetimes.

Highest urgency: long-lived data (classified, medical records) — vulnerable to harvest-now-decrypt-later today. Next: key exchange in protocols (TLS, SSH, VPN) — migrate first with hybrid KEMs. Lowest urgency: signatures on short-lived data (session tokens).

Python: use pyca/cryptography with liboqs backend for ML-KEM. Java: BouncyCastle PQC module. Rust: pqcrypto crates. Replace: rsa.generate_private_key() → ML-KEM keygen; ecdh_key_agreement() → ML-KEM encap/decap. Abstract via crypto agility layer.

Crypto agility: design systems to swap algorithms without code changes. Use algorithm identifier fields, key type registries, and pluggable backends. Avoid hardcoded algorithm names in serialization formats. This enabled SHA-1→SHA-256 migration and will enable RSA→PQC.

Test with known-answer test vectors from NIST PQC reference implementations. Validate against OQS-OpenSSL interoperability test suite. Test hybrid TLS with oqs-provider for OpenSSL. Monitor NIST FIPS 203/204/205/206 errata pages for implementation guidance updates.

NIST/NSA recommendations: (1) stop deploying new RSA/ECC systems now. (2) Deploy hybrid key exchange in TLS and VPNs by 2025-2026. (3) Migrate certificates to PQC by 2028-2030. (4) Complete full migration (including HSMs) by 2035 before CRQC risk materializes.

PQC migration uses hybrid KEMs (classical + PQC) during transition. Prioritize long-lived data and key exchange. Conduct crypto inventory, update hardware, enforce crypto agility. NIST recommends full migration by 2035. Next: blockchain cryptography — Merkle trees and PoW.