What can go wrong in a post-quantum migration?

Mostly compatibility and performance, rarely the mathematics. Post-quantum keys are larger, so a TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. ClientHello carrying X25519MLKEM768 no longer fits in a single network packet; some older firewalls, load balancers and intrusion-prevention appliances mishandle that and drop or reset the connection. Hardware security modules, smart cards and embedded devices may lack the memory or firmware for the new algorithms. Signatures of several kilobytes enlarge certificate chains and slow down constrained links. Young implementations can contain bugs, which is one reason to use hybrid methods and well-maintained libraries. Interception proxies that decrypt TLS may not support the new groups and quietly push connections back to classical key exchange. Plan for it: test with real traffic in a staging segment, keep the classical fallback during the transition, check that middleboxes are updated, and measure afterwards which connections actually use hybrid key exchange. A view of the handshakes on the wire shows regressions that configuration files do not.

← All 33 questions on Post-quantum cryptographyAll topics