PQC Migration Roadmaps

Post-quantum migration is a systems and risk-management problem, not a library swap. For long-retention public-sector data, the difficult question is how to address the $7.1B federal migration scope and reduce harvest-now-decrypt-later exposure while preserving operational continuity.

I authored five-phase migration roadmaps intended for federal agency deployment scenarios, moving from governance and cryptographic discovery through hybrid pilots, infrastructure rollout, and ongoing crypto-agility. The roadmap mapped NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) to deployment decisions rather than presenting the standards as an isolated algorithm list.

The framework used CBOM discovery aligned with CycloneDX to expose cryptographic dependencies, then applied Mosca’s Theorem to prioritize assets based on the relationship between migration time, required confidentiality shelf-life, and the quantum-threat horizon. It explicitly defined the transitional hybrid pattern (RSA-3072 ∥ ML-KEM-768) to ensure compliance while mitigating immediate exposure.

The most valuable part of the roadmap was its analysis of ten critical deployment loopholes. Instead of assuming a seamless algorithm swap, I mapped the specific failure modes that federal agency deployment scenarios must avoid: HSMs whose external APIs support PQC but whose internal boot firmware still relies on classical ECC, the bandwidth tax of 2.7KB ML-KEM keys on legacy infrastructure, and the reality of crypto-agility anti-patterns hardcoded into third-party supply chains.

This public summary omits agency names, organization-specific architecture, inventory data, and internal timelines. The work demonstrates strategic roadmap and technical-writing capability; it does not claim production deployment or implementation of the PQC primitives themselves.