Past Crypto Migrations Took a Decade. Why Would This One Be Faster?

Discussions of quantum migration typically focus on the time until Q-Day. However, this is a mistake for a couple of different reasons.

One is that you'll likely not know when Q-Day was until years or decades later. The organizations that have the resources to buy and motivation to use a quantum computer for cryptanalysis (NSA, etc.) have a long history of concealing their capabilities. The day that quantum computers go public will be well after the real Q-Day.

The other issue is that a focus on the end date misses the fact that a cryptographic migration takes time. If you look at the history, it's likely that most organizations are already starting too late relative to Q-Day estimates.

Crypto Migrations are Slow

The switch to PQC is far from the first time that organizations have had to retire one cryptographic algorithm in favor of another, more secure one. 3DES, MD5, and SHA-1 are prime examples of this.

Historically, these migrations took much longer than one would expect to complete:

• MD5: First hash collision was demonstrated in 2004, and researchers demonstrated a rogue CA certificate in 2008. In 2012, Flame was discovered using a forged Microsoft code-signing certificate, created with a novel chosen-prefix collision attack that CWI believed was in development before mid-2009. TLS didn't formally drop MD5 until 2021.
• SHA-1: First attacks were publicized in 2005, and priority migration was announced by NIST the next year. Officially deprecated for signatures in 2011 and disallowed in 2013, dropped by browsers in 2017, and still hasn't been fully retired for all use cases (target December 31, 2030).
• TLS 1.0/1.1: Organizations were recommended to switch away from TLS 1.0/1.1 to version 1.2 in 2008, and a practical attack (BEAST) was demonstrated in 2011. However, these versions weren't fully deprecated until March 2021.
• 3DES: The first practical attack against 3DES was announced in 2016, and NIST began restricting the algorithm in 2017 and disallowed it after December 31, 2023. A major factor that the industry cited for the long deactivation time was issued credit cards and non-upgradeable infrastructure using the algorithm.

In general, cryptographic swaps have taken 8-25 years from an attack being demonstrated to full retirement. However, these timelines are, if anything, optimistic. In the past, the NSA and other government agencies have developed attacks long before they became public (e.g. differential cryptanalysis, NOBUS backdoors, etc.), so these algorithms may have been insecure for far longer than is acknowledged publicly.

PQC Migration is Going to Be Much Harder

Historically, it's not been uncommon for cryptographic migrations to take years or decades, even after attacks have been demonstrated to be feasible. These migrations are likely easier than the PQC transition for a few reasons:

• Like-For-Like Swaps: In most cases, broken algorithms were swapped for an updated algorithm with similar parameters, such as 256-bit hash functions. PQC algorithms often have substantially larger key, signature, and ciphertext sizes than their classical counterparts. For example, ML-KEM-768 key shares are 1,184 bytes vs. 32 for X25519.
• Real-World Attacks: Many of these historical migrations were inspired by an attack that demonstrated that the algorithm was fundamentally insecure. PQC migrations are driven by the quantum threat, which has an uncertain timeline and a lower sense of urgency.

Q-Day Shouldn't Be the Focus

Many organizations are using estimates for when Q-Day will occur to determine the urgency of their quantum transitions. However, Q-Day will likely come faster than expected (estimates keep moving earlier), and the real Q-Day will likely be far earlier than the public one.

The historical record shows that cryptographic migrations generally take far longer than one might expect, even when there is a present threat driving the transition. With harvest now, decrypt later (HNDL) attacks, companies are likely facing data security threats today, even if they're not obvious or acknowledged.

Instead of focusing on Q-Day, organizations should start looking at migration timelines for their various assets exposed to the quantum threat today and start migrations for assets with the longest timeline and greatest HNDL urgency. Your CBOM, which should track all existing crypto usage and the associated use cases, is a great place to start.

Educational content, not legal, financial, investment, or professional security advice. Terms