Topic starter
24/06/2026 7:17 pm
TL;DR: NIST’s draft quantum-safe standards for CRYSTALS-KYBER, CRYSTALS-DILITHIUM and SPHINCS+ start the transition from theory to implementation, with a 90-day comment period and protocol work already underway for TLS, S/MIME and SSH, according to DigiCert. Crypto inventories and upgrade planning now matter because long-lived data and signatures are already exposed to harvest now, decrypt later risk.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “NIST Releases Quantum-safe Cryptography Standards: What Happens Now?”.
Key questions
Q: How should security teams start a post-quantum migration program?
A: Start by inventorying where cryptography is actually used, then measure external exposure first.
Q: Why do long-lived certificates and signed data matter in quantum planning?
A: Because the risk is tied to lifespan, not just current exposure.
Q: Where do organisations most often lose control of cryptographic migration?
A: They lose control when certificate ownership is fragmented, inventory is incomplete and protocol dependencies are undocumented.
Practitioner guidance
- Inventory all cryptographic assets Build a central view of certificates, keys, signature dependencies and protocol usage so you know where RSA and ECC still support trust decisions.
- Prioritise long-lived trust assets Rank assets by sensitivity, business impact and expected lifespan, with special attention to records, code signing and devices that persist for years.
- Plan for crypto agility Use automation and central PKI management to reduce manual certificate work and shorten the time needed to swap algorithms when standards finalise.
Bottom line: Quantum-safe standards turn cryptographic migration into a governance issue because trust, retention and algorithm choice now move together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:30 am
Crypto agility is now an identity governance requirement, not a PKI housekeeping task. The article shows that quantum-safe migration is really about governing trust dependencies across certificates, signatures and key exchange. Once those assets underpin identity and access, the problem becomes lifecycle control across the whole trust estate. Practitioners should treat cryptographic agility as a core part of identity security architecture.
A question worth separating out:
Q: What should security teams do with TLS, S/MIME and SSH now?
A: They should map which services use those protocols, identify the current key and certificate dependencies, and decide which parts of the environment need early migration because of long retention or high trust value. The objective is to avoid last-minute replacement under operational pressure.
👉 Read our full editorial: NIST quantum-safe standards put crypto agility on the clock