Post-Quantum Readiness for Identity and PKI

Much of identity security rests on public-key cryptography that a large enough quantum computer could break. TLS and mTLS certificates, code signing, SAML and JWT signatures, SSH keys, smart cards, passkeys and device identities all rely on RSA or elliptic curve algorithms. NIST published its first post-quantum cryptography (PQC) standards in 2024 and has proposed retiring quantum-vulnerable algorithms by 2035, and national agencies have set migration timelines. Nobody knows exactly when a cryptographically relevant quantum computer will exist, but migrating identity infrastructure takes years. This guide explains what is at risk, what the standards say, and how to prepare identity and PKI systems now.

Key takeaways

• Encryption and signatures face different risks. Encrypted data can be captured now and decrypted later; signatures only need replacing before attackers can forge them.
• NIST's first PQC standards are FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).
• Start with a cryptographic inventory of where identity systems use RSA and ECC.
• Build crypto-agility: the ability to change algorithms without redesigning systems.
• Prioritise long-lived trust anchors, such as root CAs, device identities and firmware signing keys.

What is at risk in identity

Symmetric cryptography and hash functions, such as AES and SHA-2, are much less affected; larger key and output sizes are generally considered sufficient.

The standards and timelines

• NIST standards (August 2024): FIPS 203 ML-KEM for key establishment, FIPS 204 ML-DSA for signatures and FIPS 205 SLH-DSA, a hash-based signature scheme. NIST selected HQC as an additional key establishment algorithm in 2025, and FN-DSA (based on Falcon) is being standardised as FIPS 206.
• NIST transition: NIST IR 8547 proposes deprecating quantum-vulnerable algorithms such as RSA and ECC after 2030 and disallowing them after 2035, with earlier dates for weaker parameters.
• UK: the NCSC has set milestones for organisations: define migration goals and complete discovery by 2028, complete the highest-priority migrations by 2031, and complete migration by 2035.
• US national security systems: the NSA's CNSA 2.0 suite sets earlier deadlines for national security systems.
• Protocols: hybrid key exchange combining ML-KEM with a classical algorithm is already widely deployed in major browsers and TLS libraries, while standards for PQC certificates and signatures in TLS, X.509, SSH and FIDO are still maturing.

Building a cryptographic inventory

• List certificate authorities, issued certificates and their algorithms. The Machine Identity, PKI and Certificate Lifecycle Guide covers certificate discovery.
• List token signing keys at identity providers and applications, and the algorithms they use.
• List SSH, code signing, firmware signing and device identity keys. See the Cryptographic Key Management Guide.
• Record which libraries, HSMs, KMS services and vendors provide the cryptography, and their PQC roadmaps.
• Consider a cryptographic bill of materials (CBOM), which records algorithms and keys used by each system, alongside software and AI bills of materials. See the AI Supply Chain and AI-BOM Guide.

Prioritising migration

1. Long-lived trust anchors: root and intermediate CAs, and device and firmware roots that stay in the field for many years.
2. Data with a long confidentiality life sent over TLS today, where hybrid key exchange reduces harvest-now risk.
3. Token signing at identity providers: central, high impact and relatively easy to change if clients follow published keys.
4. Code signing: signatures must stay verifiable for the life of the software.
5. Everything else, in line with vendor support and normal refresh cycles.

Crypto-agility for identity systems

• Avoid hard-coding algorithms; make them configuration.
• Publish keys in formats that allow multiple algorithms side by side, such as JWKS.
• Automate certificate issuance and renewal, which you will need anyway as TLS certificate lifetimes fall to 47 days by 2029.
• Choose vendors, HSMs and libraries with committed PQC roadmaps. See the Certificate Lifecycle Management Buyer's Guide.
• Test larger key and signature sizes in constrained environments such as IoT devices and smart cards. See the Device and IoT Identity Guide.

Common mistakes

• Treating a vendor scan as the whole inventory.
• Waiting for certainty about quantum timelines before starting discovery.
• Replacing algorithms without automation, so the next change is just as hard.
• Forgetting non-web uses such as SSH, SAML, code signing and device identity.

Practitioner checklist

• Assign an owner for PQC migration and link it to key and certificate management.
• Build a cryptographic inventory covering PKI, token signing, SSH, code signing and devices.
• Enable hybrid post-quantum key exchange for TLS where your platforms support it.
• Make algorithms configurable and automate certificate and key rotation.
• Ask vendors for PQC roadmaps and include PQC in procurement requirements.
• Plan trust anchor and long-lived device migrations first.
• Track national timelines, such as NIST's 2030 and 2035 dates and the NCSC's 2028, 2031 and 2035 milestones.

Standards and references

• FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (2024)
• FIPS 204: Module-Lattice-Based Digital Signature Standard (2024)
• FIPS 205: Stateless Hash-Based Digital Signature Standard (2024)
• NIST IR 8547: Transition to Post-Quantum Cryptography Standards (initial public draft)
• UK NCSC: Timelines for migration to post-quantum cryptography (2025)

Related NHI Mgmt Group resources: Machine Identity and PKI Guide · Cryptographic Key Management Guide · CLM Buyer's Guide · SSH Key Management Guide