Post-Quantum Cryptography: When to Migrate?
ML-KEM, ML-DSA, harvest now decrypt later threat: a post-quantum cryptography migration guide for enterprises.
A quantum computer capable of breaking RSA-2048 does not exist yet. But the threat is already here. The "harvest now, decrypt later" (HNDL) strategy consists of collecting encrypted data today to decrypt it when a quantum computer becomes available. If your data has a sensitivity lifetime of 10 years or more, post-quantum migration must start now.
The New NIST Standards
In August 2024, NIST published the first three post-quantum cryptography (PQC) standards. These are the algorithms on which to build your migration:
ML-KEM (formerly CRYSTALS-Kyber), FIPS 203
Module Lattice-based Key Encapsulation Mechanism. This replaces RSA/ECDH key exchange for encryption. Three security levels: ML-KEM-512 (128-bit), ML-KEM-768 (192-bit), ML-KEM-1024 (256-bit). Keys are larger (about 1 KB for ML-KEM-768) but performance remains excellent.
ML-DSA (formerly CRYSTALS-Dilithium), FIPS 204
Module Lattice-based Digital Signature Algorithm. This replaces RSA/ECDSA for digital signatures. Signatures are larger (~2.5 KB for ML-DSA-65) but verification is fast. It is the default recommended algorithm for signatures.
SLH-DSA (formerly SPHINCS+), FIPS 205
A hash-based signature algorithm. Slower than ML-DSA but relies on different mathematical assumptions (hash-based), providing valuable diversification.
The "Harvest Now, Decrypt Later" Threat
Intelligence agencies are already collecting encrypted data in transit, waiting for quantum computing power to decrypt it. Particularly targeted:
-
State and diplomatic secrets: 25-50 year sensitivity
-
Intellectual property: patents, formulas, industrial plans
-
Health data: long-term sensitive medical records
-
Financial data: transactions, investment strategies
Migration Roadmap
Step 1: Cryptographic Inventory
Identify all algorithms, keys, certificates, and protocols used in your IT environment. This is the CBOM (Cryptographic Bill of Materials). ThreatClaw automates this inventory.
Step 2: Risk Assessment
Classify your data by sensitivity lifetime. If sensitivity duration + migration time > time before Q-day, migration is urgent.
Step 3: Hybrid Mode
Deploy hybrid schemes combining classical and post-quantum algorithms. TLS 1.3 already supports hybrid modes with ML-KEM. Chrome and Firefox have implemented them since 2024.
Step 4: Full Migration
Progressively replace classical algorithms with PQC standards. Test performance (key sizes, latency) in your specific context.
Immediate Actions
-
Perform your cryptographic inventory with our experts
-
Enable PQC hybrid modes on your TLS connections
-
Test ML-KEM and ML-DSA in your environment
-
Train your teams on post-quantum challenges
Discover our security approach and PQC support plans.
FAQ
When will quantum computers break RSA?
Estimates range from 2030 to 2040. NIST recommends no longer relying solely on quantum-vulnerable algorithms by 2030. With HNDL, the risk is immediate.
Is ML-KEM proven secure?
ML-KEM is based on the lattice problem, studied for over 25 years. It survived NIST's 6-year selection process. No practical attacks are known, but prudence recommends hybrid schemes.
Is my TLS already vulnerable to quantum?
If you use ECDHE for key exchange, traffic captured today could be decrypted later by a quantum computer. This is the HNDL threat.
What is the performance impact?
ML-KEM keys are larger (~1 KB vs ~32 bytes for ECDH) but operations are fast. The TLS latency overhead is about 1-2 ms, generally negligible.
Related articles
We detonated a live Phobos sample. Here is what it does, deleting shadow copies, killing the firewall, and the Sigma rule that catches it, validated across multiple samples with zero false positives.
Emotet, a notorious botnet and malware loader, remains a critical threat to SMBs. Learn how ThreatClaw’s new YARA rules help MSSPs detect and mitigate this persistent adversary.
Drokbk, a remote access trojan, evades defenses with keylogging and screen capture. ThreatClaw now detects it with zero false positives—protect SMBs and MSSP clients.
Dosia malware targets SMBs with obfuscation and tool transfer tactics. Learn how ThreatClaw’s new YARA rules help MSSPs detect and mitigate this threat effectively.