Also mentioned
RSARSARivest, Shamir and AdlemanA widely used public-key algorithm for encryption and digital signatures whose security relies on the difficulty of factoring large numbers.Read the full entry (new tab), ECDHECDHElliptic Curve Diffie-HellmanElliptic Curve Diffie-Hellman, a key-exchange method using elliptic-curve mathematics to establish a shared secret with smaller keys than classical Diffie-Hellman.Read the full entry (new tab), ECDSAECDSAElliptic Curve Digital Signature AlgorithmElliptic Curve Digital Signature Algorithm, a widely deployed signature scheme based on elliptic-curve cryptography, offering strong security with compact keys.Read the full entry (new tab), ML-KEMML-KEMModule-Lattice-based Key Encapsulation MechanismModule-Lattice-Based Key-Encapsulation Mechanism, the NIST-standardized post-quantum KEM derived from CRYSTALS-Kyber and specified in FIPS 203.Read the full entry (new tab), TLSTLSTransport Layer SecurityTransport Layer Security, the protocol that encrypts and authenticates most internet traffic, including HTTPS. It uses key exchange, certificates, and symmetric encryption to protect a session.Read the full entry (new tab), NISTNISTNational Institute of Standards and TechnologyThe U.S. National Institute of Standards and Technology, the agency that develops and publishes cryptographic standards, including the FIPS series and post-quantum algorithms.Read the full entry (new tab), CBOMCBOMcryptographic bill of materialsA Cryptographic Bill of Materials, a structured, machine-readable inventory of the cryptographic assets used by a system or application, often expressed as an extension of a software bill of materials (SBOM).Read the full entry (new tab), CNSACNSACommercial National Security Algorithm SuiteThe Commercial National Security Algorithm Suite 2.0, the NSA's mandated algorithm set for US National Security Systems.Read the full entry (new tab) are defined in the glossary.
Read this first
Before you can choose a post-quantum algorithm, you have to find where the classical ones already live. That discovery step, the cryptographic inventory, is the first phase of every serious migration framework, including the Australian Signals Directorate’s LATICE model. Done well it produces a Cryptographic Bill of Materials (CBOM): every algorithm, protocol, key and certificate, mapped to the systems that depend on it and ranked by exposure. Everything downstream is built on it.
Teams often start a migration by asking which post-quantum primitive to adopt. That is the second question. The first is where asymmetric cryptography is used at all, because in most systems the honest answer is “more places than anyone has written down.”
This is not just our opinion; it is how national cyber agencies sequence the work. The Australian Signals Directorate’s Planning for post-quantum cryptography sets out a five-phase model it calls LATICE: Locate, Assess, Triage, Implement, and Communicate & educate , and the whole transition begins with Locate: “discover and document where organisations use traditional asymmetric cryptography.” The name is a fitting coincidence for us: the hardness of the lattice shortest-vector problem is exactly what secures the algorithms you migrate to.
Locate: build the inventory
The Locate phase means inventorying every component that could rely on classical asymmetric cryptography for a digital signature, an authentication flow, or encryption of data in transit, across cloud services, applications, hardware and operational technology. In practice that is a hunt for every use of RSA) and elliptic-curve cryptography, wherever it hides:
- TLS termination and internal service-to-service mTLS
- Public key infrastructure: certificate authorities, code-signing and signing pipelines, attestation chains
- Identity keys, signed prekeys and one-time prekeys in messaging systems
- Backup, archive and multi-device sync encryption
- Tokens, JWT signing, VPN and SSH keys
- Firmware, IoT and operational-technology (OT) devices, often the hardest and slowest to update
- Third-party, SaaS and vendor dependencies you rely on but do not control directly
Treating post-quantum as a single switch
A single application can use asymmetric primitives in ten distinct places, each with a different threat model and exposure window. “Going post-quantum” means addressing each of them, with appropriate parameter choices, in an order that matches the threat model, not flipping one flag.
The Cryptographic Bill of Materials (CBOM)
The artefact the Locate phase produces is a Cryptographic Bill of Materials, the cryptographic sibling of a software bill of materials. The ASD calls it “an effective method for creating an inventory of cryptographic dependencies at environment and system levels.” A mature CBOM captures the products, libraries, algorithms, protocols, parameters, versions and configurations a system relies on, in the context they are used. The CycloneDX CBOM standard gives you a machine-readable format for exactly this.
You do not need all of that on day one. The ASD is explicit that an initial CBOM can be “a simple list of critical systems and components mapped to the critical security functions they rely on,” and deepen from there. The point is to start: a partial inventory beats the mental model that everything is fine because no one has looked.
Assess and Triage: rank by exposure, not by ease
An inventory is just a list until you order it. The Assess phase weighs the value and sensitivity of each system and the impact, operational, regulatory and legal, if its integrity or confidentiality were compromised. The Triage phase then ranks systems by the risk a future quantum computer poses to them. This is where harvest now, decrypt later makes the ordering concrete: a key protecting data with a thirty-year confidentiality requirement outranks an ephemeral session key, even if the session key is easier to rotate.
The ASD lists the factors worth weighing when you triage a system for transition:
- Whether it handles sensitive or classified data
- Whether it interacts with external organisations
- How easily it is expected to transition
- Whether it implements standards for legacy interoperability
- Whether it is bespoke or commodity
- Whether relevant non-cryptographic protections already apply
- Its lifecycle and refresh cadence
The clock is concrete
The ASD recommends ceasing traditional asymmetric cryptography (RSA, Diffie-Hellman, ECDH and ECDSA) by the end of 2030, with a refined transition plan by end of 2026 and the transition commenced (critical systems first) by end of 2028. That is more aggressive than the United States’ federal target of 2035, set by National Security Memorandum 10: while NSA’s CNSA 2.0 itself requires national-security systems to complete the transition by 2033. And every one of these timelines starts with an inventory you could begin this quarter.
The inventory is not just prudent: in the US it is mandated. National Security Memorandum 10 (May 2022) requires federal agencies to deliver an annual inventory of systems that rely on quantum-vulnerable cryptography, and OMB memo M-23-02 (Nov 2022) operationalizes it: a prioritized inventory reporting the algorithm, key length, and service for each system, submitted annually through 2035. M-23-02's own definition of a "cryptographic system" (creating or exchanging keys, establishing encrypted connections, and creating or validating digital signatures) is a ready-made scoping checklist, and it matches the Locate list above almost exactly. The regulators reached the same conclusion the engineering does: the move cannot begin on cryptography you have not first enumerated.
Why the inventory is the hard part
Choosing the destination algorithm is the easy step. The standards are finished, and picking ML-KEM for key exchange is an afternoon’s reading. The multi-year work is the discovery, and then the crypto-agility to make the next migration a configuration change instead of a rewrite. It is worth remembering why the deadline exists at all: Shor’s algorithm lets a sufficiently large quantum computer factor the numbers RSA depends on and solve the discrete logarithms behind elliptic-curve crypto. The mathematics is settled; the exposure is an engineering problem.
None of it can begin before you can see your cryptography. The inventory is unglamorous, and it is the foundation the whole migration stands on. You can start a first pass today: our scanner reads your code, dependencies and TLS configuration and gives you an initial CBOM: npx @quantakrypto/qscan ./
Where to start
Run a scan for a first-pass inventory across code, dependencies and TLS config, then layer in the surfaces a scanner cannot see on its own: operational technology, hardware, and the SaaS and vendor dependencies you do not control. Those surfaces are where an audit earns its keep. Rank the result by confidentiality lifetime, and you have your roadmap.
Further reading
This article draws primarily on the Australian Signals Directorate’s guidance, published under a Creative Commons Attribution 4.0 licence. The sources below are reputable primary references for planning a post-quantum migration.
- Planning for post-quantum cryptography, Australian Signals Directorate (ACSC): the LATICE framework, CBOM guidance and 2030 timeline this article is based on
- US mandate: National Security Memorandum 10 (2022) and OMB M-23-02 (PDF): the annual federal inventory requirement and its scope.
- CISA Post-Quantum Cryptography Initiative and the Quantum-Readiness factsheet: CISA, NSA & NIST
- Post-Quantum Cryptography project, NIST
- Next steps in preparing for post-quantum cryptography, UK NCSC
- Cryptography Bill of Materials (CBOM), CycloneDX
- Wikipedia: Post-quantum cryptography, Harvest now, decrypt later, Cryptographic agility