Research area · Cryptography
Post-Quantum Cryptography: from cryptographic inventory to crypto-agility
A sufficiently large quantum computer breaks RSA and elliptic curves — and “Harvest now, decrypt later” already makes long-lived data vulnerable today. Vami Research puts the threat, the NIST standards, and the EU and BSI deadlines in context and shows the way from cryptographic inventory through the CBOM to crypto-agility as an architectural principle.
- Quantum readiness
- Harvest now, decrypt later
- Mosca test
- CBOM
- ML-KEM & ML-DSA
- Crypto-agility
- BSI TR-02102-1
- Deep Dives
- 1
- Whitepapers
- 1
- Solutions
- 0
The standards are in place — what is missing is visibility
The migration affects asymmetric schemes almost exclusively: on a cryptographically relevant quantum computer, Shor's algorithm breaks RSA, Diffie-Hellman, and elliptic curves, and with them almost every TLS key establishment; AES-256 and SHA-384 are still considered secure. Because attackers can record traffic today and decrypt it later, what matters is not the date of Q-Day but the shelf life of the data. The BSI bases its planning on the working hypothesis that such a machine cannot be ruled out in the early 2030s.
The technology is here: ML-KEM, ML-DSA, and SLH-DSA have been final NIST standards since August 13, 2024, and hybrid key establishment is the default in Chrome, Edge, and Firefox. The EU roadmap of June 2025 provides for national plans by the end of 2026 and quantum-safe high-risk use cases by the end of 2030; the BSI recommends purely classical key establishment only until the end of 2031. What is usually missing is visibility, prioritization, and a program.
Vami Research brings together verified facts with primary sources; the Mosca test, migration waves, and CBOM as thinking tools; and the roadmap from the CISO whitepaper “Quantum Readiness for CISOs” (as of September 2026). The Christmas special of the VamiGRC Christmas Bootcamp on December 12, 2026, in Sankt Augustin and live on LinkedIn and YouTube, focuses on the CBOM: first make visible which cryptography is used where, then migrate.
Open questions in practice
- 01
Which data is already exposed today through “Harvest now, decrypt later”?
Our approach
We run the Mosca test per data class: if shelf life x plus migration time y exceeds the time z until a cryptographically relevant quantum computer exists, data intercepted today can be decrypted before its shelf life expires. Typically exposed are financial and health data, contracts, design data, identities, and PKI root keys.
- 02
Which cryptography is used where — and how does that become a reliable inventory?
Our approach
We survey cryptography with tool support across network and protocols, PKI and certificates, code, HSM and KMS, cloud, and supply chain — as a discovery project rather than an email survey. The result is a CBOM, for example in CycloneDX format. For mid-market companies, a first reliable inventory is feasible in four to six weeks.
- 03
How does the next algorithm change become routine instead of a project?
Our approach
We embed crypto-agility as an architectural principle: algorithms and key lengths in central policies instead of application code, a crypto abstraction layer, and centralized key management anchored in HSMs. The practical test is a single question: how long does it take to change the key establishment on all externally reachable services?
- 04
Which deadlines apply to the migration — and how binding are they?
Our approach
We check every system against both timelines: the EU roadmap aims for completion as far as possible by the end of 2035, while BSI TR-02102-1 provides for the switchover in cases of very high protection requirements by the end of 2030 and the replacement of classical signature schemes by the end of 2035. Formally, both are recommendations; in practice, they are the benchmark against which supervisors and auditors measure the state of the art.
Key takeaways
- 01
Long-lived data is already exposed today, without any alarm going off
Attackers are recording encrypted traffic and copied data stores today in order to decrypt them once a cryptographically relevant quantum computer becomes available; NIST and CISA warn about this pattern. Even Perfect Forward Secrecy does not help, because ephemeral Diffie-Hellman handshakes fall just the same. For long-lived data, migration is a present-day issue.
Source: Post-Quantum Cryptography
- 02
Crypto obligations already apply today — not just from 2030
Regardless of the 2030 and 2035 deadlines, crypto obligations already apply: since January 2025, DORA has required documented policies for encryption and key management, including a certificate register; NIS2 names cryptography as a mandatory measure in line with the state of the art; and since March 2025, PCI DSS 4.0.1 has required an annually reviewed inventory of cipher suites and protocols.
Source: Post-Quantum Cryptography (PQC)
- 03
No reliable prioritization without a CBOM
You can only migrate what you know about. A Cryptography Bill of Materials inventories algorithms, key lengths, certificates, and libraries, including where they are found, in machine-readable form, for example in CycloneDX format. Unlike an Excel list, it can be versioned, diffed, and checked in CI/CD — and serves migration, compliance, and procurement from a single source.
Source: Post-Quantum Cryptography
- 04
Crypto-agility is an architectural decision
The standards remain in motion: NIST has selected HQC as a backup scheme whose standard is expected in 2027, FN-DSA is being finalized, and NIST's draft IR 8547 classifies RSA-2048 and P-256 as “deprecated” from 2030. Controlling algorithms through configuration instead of hardcoding turns the next change into routine instead of a project.
Source: Post-Quantum Cryptography (PQC)
How we work
We treat post-quantum cryptography as a program, not an algorithm swap: first visibility, then risk, then architecture — backed by primary sources from NIST, the EU, and the BSI.
Mosca test per data class
Calculate shelf life plus migration time against the time until a cryptographically relevant quantum computer exists — this determines which data flows migrate first.
Cryptographic inventory as discovery
Survey network and protocols, PKI, code, HSM and KMS, cloud, and supply chain with tool support — not by questionnaire.
CBOM in CycloneDX format
Inventory cryptographic components in machine-readable form: versionable, diffable, and verifiable in CI/CD.
Migration waves
From quick wins such as switching off SHA-1, 3DES, and RSA-1024 through hybrid key establishment to encapsulated legacy with an expiry date by 2035.
Deadline and obligation mapping
Check the EU roadmap, BSI TR-02102-1, DORA, NIS2, and PCI DSS for each system and separate obligations from time-bound recommendations.
Crypto assets in the GRC graph
Link crypto assets with systems, suppliers, risks, and controls so that PQC does not remain an isolated project.
How to get started
- 1Create visibilityImplement the cryptographic inventory and CBOM v1, governance with crypto owners, and the first quick wins.
- 2Assess risk, set the roadmapShelf lives, HNDL exposure, and Mosca analysis; target architecture and roadmap through 2030/2035, including a supplier and HSM roadmap.
- 3Pilot and roll outMeasure hybrid TLS on live services, roll out in waves, and introduce CI/CD gates against shadow cryptography.
Deep dives, whitepapers, and analyses
Whitepapers 1
From research area to implementation
Services
Related research areas
Where does your cryptography stand against the 2030 and 2031 deadlines?
In an initial consultation, we map your landscape against the EU roadmap and BSI TR-02102-1 and identify the first steps with the greatest leverage — from the cryptographic inventory to the hybrid pilot.