# What can go wrong in a post-quantum migration?

Mostly compatibility and performance, rarely the mathematics. Post-quantum keys are larger, so a TLS ClientHello carrying X25519MLKEM768 no longer fits in a single network packet; some older firewalls, load balancers and intrusion-prevention appliances mishandle that and drop or reset the connection. Hardware security modules, smart cards and embedded devices may lack the memory or firmware for the new algorithms. Signatures of several kilobytes enlarge certificate chains and slow down constrained links. Young implementations can contain bugs, which is one reason to use hybrid methods and well-maintained libraries. Interception proxies that decrypt TLS may not support the new groups and quietly push connections back to classical key exchange. Plan for it: test with real traffic in a staging segment, keep the classical fallback during the transition, check that middleboxes are updated, and measure afterwards which connections actually use hybrid key exchange. A view of the handshakes on the wire shows regressions that configuration files do not.

FAQ: [Post-quantum cryptography](https://netsenx.com/en/faq/pqc) · https://netsenx.com/en/faq/what-can-go-wrong-in-a-post-quantum-migration

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/features
- https://netsenx.com/en/blog/2026-10-27_harvest-now-decrypt-later

## Related questions

- [What is crypto-agility?](https://netsenx.com/en/faq/what-is-crypto-agility)
- [Do SSH and VPNs support post-quantum key exchange?](https://netsenx.com/en/faq/do-ssh-and-vpns-support-post-quantum-key-exchange)
- [How can we find where we use quantum-vulnerable cryptography?](https://netsenx.com/en/faq/how-to-find-quantum-vulnerable-cryptography)
- [Can a network sensor build a cryptographic inventory?](https://netsenx.com/en/faq/can-a-network-sensor-build-a-cryptographic-inventory)
- [How do I find which connections already use hybrid key exchange?](https://netsenx.com/en/faq/which-connections-already-use-hybrid-key-exchange)