TL;DR: Post-quantum key establishment can be made workable with hybrid approaches, according to Red Sift, but certificates and authentication are far harder because ML-DSA signatures are dramatically larger than RSA or ECDSA and can push TLS handshakes beyond TCP and QUIC transport limits. That makes certificate lifecycle, handshake sizing, and protocol compatibility the real migration constraints, not algorithm choice alone.
At a glance
What this is: This analysis argues that post-quantum migration is straightforward for key establishment but much more difficult for certificates and authentication because signature growth breaks long-standing transport assumptions.
Why it matters: IAM and PKI teams need to plan for larger certificate chains, handshake fragmentation, and compatibility risk before post-quantum algorithms reach production trust paths.
Context
Post-quantum cryptography is not a single migration problem. Key establishment can often move to hybrid designs with limited disruption, but certificates and authentication create a different constraint set because public keys and signatures become much larger.
For identity and trust programmes, that matters because PKI, TLS, certificate transparency, and revocation behaviour all sit inside operational identity flows. When signature size grows, the issue is no longer just cryptographic strength. It becomes a governance problem for transport, performance, and compatibility across workloads and services.
Key questions
Q: What breaks when organisations delay post-quantum migration for sovereign certificate authorities?
A: Delaying migration leaves the certificate authority hierarchy dependent on algorithms that may not survive future quantum attacks. Because the CA is the root of trust, any weakness can undermine issuance, signatures, and trust validation across the estate. The risk extends to electronic identities, document signing, and timestamping if those services are not planned with the CA transition.
Q: Why does post-quantum authentication create more migration risk than key establishment?
A: Key establishment can often be shifted with hybrid designs without overwhelming the handshake, but authentication depends on certificates, chains, CT data, and live signatures. Those objects are much larger under post-quantum schemes, so the migration risk shows up in transport size, compatibility, and performance rather than in the key exchange alone.
Q: How should PKI teams evaluate post-quantum readiness before changing certificate profiles?
A: They should test the full certificate chain, including intermediates and transparency artefacts, against real transport paths and workload conditions. A profile that is mathematically sound can still fail operationally if it does not fit within congestion limits or works poorly on low-bandwidth connections.
Q: Why do hybrid certificates matter during post-quantum migration?
A: They let classical and quantum-safe trust coexist while applications, devices, and partners move at different speeds. That reduces compatibility risk during migration, but only if the PKI can issue and manage them consistently. Hybrid support is a transition control, not proof that the estate is already ready.
Technical breakdown
Why post-quantum signatures change certificate economics
Traditional certificate ecosystems were built around compact public keys and signatures. ML-DSA and similar post-quantum signature schemes change that assumption by making the signed objects much larger, often by an order of magnitude compared with ECDSA. Once those larger signatures are placed into leaf, intermediate, and CT-backed certificates, the cumulative wire size rises quickly. That affects not only the certificate itself but every protocol step that depends on the certificate chain being delivered early and efficiently. The technical issue is not abstract cryptography, but packaging overhead and transport behaviour.
Practical implication: Measure certificate chain size before adopting post-quantum authentication in production trust paths.
How TLS handshake size collides with transport limits
A TLS handshake does not send one certificate. It sends a chain, plus signing material for the live exchange, plus any certificate transparency data and optional revocation artefacts. That is manageable when certificates are compact, but post-quantum sizes can exceed the initial congestion window on TCP or hit QUIC amplification limits. When that happens, the server cannot finish the exchange in one early burst and must wait for more network round trips. The result is latency, fragmentation risk, and a higher failure rate on constrained or lossy networks.
Practical implication: Test post-quantum chains against TCP and QUIC transport behaviour before changing certificate profiles.
Why hybrid certificates may still be needed during transition
Hybrid approaches combine traditional and post-quantum cryptography so organisations can reduce transition risk while trust stores, client support, and algorithm confidence mature. But hybrid authentication increases handshake size again because it effectively carries both legacy and future-era material. That creates a trade-off between assurance and transport overhead. The article also notes that additional intermediates, stronger root cryptography, and OCSP support can make the problem worse. In practice, transition design becomes a sizing exercise as much as a cryptographic one.
Practical implication: Treat hybrid certificate design as a compatibility decision, not just a cryptographic preference.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Post-quantum certificate migration exposes a transport problem, not just a cryptography problem: the biggest operational risk is no longer whether algorithms are secure enough, but whether the resulting trust objects still fit inside the network assumptions that TLS has depended on for years. Smaller signatures made identity protocols easy to scale; larger post-quantum signatures turn chain size into a first-order governance variable. The practitioner conclusion is that PKI planning now has to include protocol economics, not only algorithm selection.
Certificate size has become a control boundary for identity systems: once public keys, signatures, CT artefacts, and intermediates are combined, the handshake can exceed the initial congestion window and trigger latency or fragmentation effects. That means certificate governance is now linked to transport behaviour, especially for mobile, lossy, and constrained environments. The practitioner conclusion is that the certificate chain itself must be treated as an operational control surface.
Hybrid cryptography is a transition tactic, not a free pass: mixing legacy and post-quantum algorithms may reduce migration risk, but it also expands handshake size and can amplify exactly the transport penalties teams are trying to avoid. The article shows why post-quantum readiness must be planned alongside root hierarchy design, certificate transparency overhead, and revocation behaviour. The practitioner conclusion is to expect trade-offs, not a clean swap.
PKI teams need to reclassify post-quantum readiness as lifecycle governance: the challenge is not confined to issuing a new certificate profile. It reaches certificate issuance, chain composition, transport performance, revocation strategy, and compatibility management across the trust ecosystem. That makes post-quantum migration a governance programme for identity infrastructure, not a one-time cryptographic refresh. The practitioner conclusion is to plan the transition as an end-to-end lifecycle problem.
What this signals
Identity teams should expect certificate governance to become a transport planning exercise: post-quantum readiness is not only about selecting an approved algorithm. It also requires verifying that certificate chains, transparency data, and optional revocation material still fit the connection patterns used by production services.
The practical boundary has moved from cryptographic capability to handshake economics. That means PKI owners, IAM architects, and platform teams need to model certificate growth alongside workload type, network quality, and client diversity before they change trust profiles.
For practitioners
- Benchmark certificate chain size Measure leaf, intermediate, CT, and revocation overhead together so you know whether post-quantum profiles fit within current transport limits.
- Test handshake performance on constrained networks Validate TLS behaviour on mobile, lossy, and low-bandwidth paths before approving post-quantum certificate deployment.
- Model hybrid certificate trade-offs Compare the security benefit of hybrid authentication against the extra wire size created by carrying both traditional and post-quantum material.
- Review root and intermediate hierarchy design Check whether additional intermediates or stronger root cryptography will push chains beyond initial congestion window thresholds.
Key takeaways
- Post-quantum cryptography changes certificate operations more sharply than it changes key establishment.
- The evidence in this analysis shows that larger signatures can push TLS handshakes beyond common transport limits.
- PKI teams need to size chains, test network behaviour, and plan hybrid transitions as an operational governance programme.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-57, CSA Cloud Controls Matrix and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Part 1 — Key Management Lifecycle | The article focuses on cryptographic transition and key material sizing. |
| Recommendation — Review key lifecycle impacts when post-quantum algorithms change certificate and signature sizes. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Certificate-based authentication sits inside cloud identity and access governance. |
| Recommendation — Assess how certificate size and rotation affect cloud identity flows under IAM governance. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest Protection | Identity certificates are protected data objects whose handling affects trust operations. |
| Recommendation — Apply data protection controls to certificate material and associated trust artefacts. | ||
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Certificate and key lifecycle changes are central to non-human identity trust management. |
| Recommendation — Inventory certificate lifetimes and rotate trust material before post-quantum migration. | ||
Key terms
- Post-Quantum Certificate Chain: A certificate chain built with algorithms designed to resist quantum attacks. In practice, it refers to the full set of leaf, intermediate, and supporting trust artefacts that must still fit within transport limits and client expectations, not just the signature algorithm itself.
- Initial Congestion Window: The amount of data a server can send at the start of a TCP connection before waiting for more acknowledgements. For identity teams, it is an operational constraint that can turn oversized certificates into latency and reliability problems during TLS handshakes.
- Hybrid Authentication: Hybrid authentication is an environment where passwordless methods, passwords and MFA all coexist during migration or by design. It creates governance complexity because assurance, fallback rules and user experience must remain consistent across different applications and risk levels.
- Certificate Transparency: Certificate Transparency is a public logging system for certificates issued by major certificate authorities. It helps investigators link public keys to issued certificates, but it is a discovery layer, not a remediation control, and it does not revoke compromised material by itself.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org