TECHNICAL BLUEPRINT
A Phased Migration Framework from Classical to Post-Quantum Cryptography.
Mapped to NIST FIPS 203, 204, and 205 — the first three finalized post-quantum standards, published 13 August 2024. The algorithm replacements are no longer draft guidance. Migration planning can and should begin now.
- NIST FIPS 203 (ML-KEM), 204 (ML-DSA) & 205 (SLH-DSA)
- P1–P4 Quantum Exposure Risk Prioritization
- RBI Q-SAFE Agility Framework Aligned
CONTENTS
What This Document Covers
A definitive five-phase post-quantum cryptographic migration blueprint engineered for mission-critical enterprise perimeters and highly regulated sectors.
Phase 1 — Cryptographic Inventory (CBOM)
Before choosing replacement algorithms, you need to know every instance of RSA, ECC, and DH in use across your stack. Source code, compiled binaries, and runtime configurations each hold cryptographic material that may not appear in the others. AQRA's three-layer discovery produces the inventory this phase requires.
Phase 2 — Quantum Exposure Scoring
Each discovered primitive is scored: P1 (public-facing APIs, root CAs, digital signatures — migrate immediately) through P4 (AES-256, SHA-3 — quantum-resistant, monitor only). RSA-2048 and ECDSA P-256 are P1 across all enterprise environments.
Phase 3 — Algorithm Replacement Mapping
RSA key encapsulation → ML-KEM (FIPS 203), with ML-KEM-768 for standard enterprise and ML-KEM-1024 for CNSA 2.0 environments. RSA/ECDSA signatures → ML-DSA (FIPS 204). Stateless hash-based signatures → SLH-DSA (FIPS 205) as conservative fallback.
Phase 4 — Crypto-Agility Framework
Architecture guidance for maintaining the ability to swap algorithms without full system rebuilds — the property the RBI Q-SAFE Committee explicitly assesses. Covers: algorithm abstraction layers, certificate lifecycle automation, and key management modernisation.
Phase 5 — Migration Sequencing
P1 systems first: public-facing TLS endpoints, root and intermediate CAs, digital signature infrastructure. P2: internal authentication systems, API-to-API encryption. P3: data-at-rest encryption on long-lived sensitive records. P4: monitor and maintain.
RELATED TECHNICAL INTELLIGENCE
Explore Related Research & Specifications
Air-Gap Architecture Spec
Technical specification for zero-egress containerized deployment inside air-gapped enclaves.
Explore Spec →CBOM Guide & Specification
Complete schema guide and taxonomy for CycloneDX 1.6 Cryptographic Bills of Materials.
Explore CBOM Guide →NIST Standards Guide
Deep technical reference for finalized FIPS 203, 204, and 205 algorithms.
Read NIST Guide →NEXT STEP
Ready to apply this to your environment?
A scoping call maps the relevant standards and specifications to your specific infrastructure and regulatory obligations.