Post-Quantum Cryptography is often associated with the point at which sufficiently powerful quantum computers could threaten today’s asymmetric cryptographic methods. For organizations, however, preparation begins much earlier. The first steps are to build knowledge, understand cryptographic dependencies in critical processes, and make the existing infrastructure ready for future developments. Crypto agility and a reliable crypto inventory provide an important foundation for this work.

The Need to Act Before Q-Day

There is no specific date for when quantum computers will become powerful enough to pose a practical threat to asymmetric cryptographic methods currently in use. In discussions about Post-Quantum Cryptography, this point in time is often referred to as Q-Day.
The fact that the timing of Q-Day is still unknown does not mean that organizations should wait to prepare. One reason is the “harvest now, decrypt later” scenario: attackers can collect and store encrypted information today with the intention of decrypting it later, once the necessary technical capabilities become available. This is particularly relevant for information that must remain confidential for long periods of time.
At the same time, a cryptographic migration takes time. Organizations first need to understand which processes, systems, and applications are affected, who is responsible for them, and what technical dependencies exist. The actual transition to new methods therefore does not mark the beginning of PQC readiness.

Cryptographic Visibility as a Starting Point

Before a migration strategy can be developed, organizations need visibility into their existing cryptography.
A useful starting point is to identify the processes and information that are particularly important to the organization. From there, it is possible to determine where cryptography is used and which methods are involved.
This includes understanding where digital certificates are deployed, which algorithms are in use, and which applications, systems, or devices depend on them. The organizational perspective matters as well: Who is responsible for the individual cryptographic components and processes?
This assessment forms the basis of a crypto inventory. It helps evaluate the impact of future developments systematically and prioritize areas for a later transition. Without this overview, it is difficult to assess which parts of the environment would be affected and how much effort a migration would require.

Crypto Agility as an Infrastructure Capability

PQC readiness is closely connected to crypto agility. The term describes an organization’s ability to adapt cryptographic methods in a controlled manner and respond to changing requirements.
In the Trust.ID Talk, Sarah Zügel, Managing Director of essendi it GmbH, describes this relationship in practical terms: It starts with an inventory of cryptographic assets. Building on that inventory, processes can be automated to a greater extent and made more flexible.
This ability to adapt is not relevant to Post-Quantum Cryptography alone. It also helps when other developments require cryptographic changes, such as switching Certificate Authorities or introducing new algorithms.
PQC therefore reinforces a requirement that already exists today: Cryptographic infrastructure needs to be adaptable without turning every modification into a major manual project. Automation and visibility are prerequisites for implementing such changes in a structured way.

PQC Migration as an Infrastructure Change

Discussions about Post-Quantum Cryptography often focus on new algorithms. The transition to PQC, however, extends beyond the algorithms themselves.
In the Trust.ID Talk, Julian Weeber, Head of Professional Services essendi crypto solutions, explains the types of adjustments that providers of cryptographic infrastructure may need to address. In addition to new algorithms, databases, processes, APIs, and user interfaces may be affected. The same applies to systems and devices that use certificates and other cryptographic mechanisms.
This creates a chain of dependencies. Certificate Authorities need to support new cryptographic methods. Certificate management platforms need to handle changed algorithms, extensions, and processes. Applications, devices, and interfaces must also be able to process them.
PQC is therefore not an isolated update to individual cryptographic components. The migration can affect multiple layers of a digital trust infrastructure. The earlier these dependencies are understood, the better organizations can assess the impact and prepare appropriate migration paths.

 

Three Steps Toward PQC Readiness

At the end of the Trust.ID Talk, Sarah Zügel and Julian Weeber summarize the path toward Post-Quantum Cryptography in three fundamental steps.

Build Knowledge

The first step is to build expertise. Organizations should understand the technological developments associated with Post-Quantum Cryptography and how they could affect their own environment.
This does not mean implementing every technical development immediately. The priority is to establish PQC as a relevant topic within the organization and build the necessary expertise.
Identify Critical Processes and Cryptographic Dependencies
The second step is to examine the organization’s own processes. Which information and workflows are particularly relevant? Where is cryptography used? Which certificates, algorithms, systems, and devices depend on it?
This assessment supports the development of a reliable crypto inventory and helps define responsibilities and priorities.

Create the Conditions for Migration

Based on this information, organizations can prepare for the actual migration. Processes can be automated, technical dependencies addressed, and systems developed in a way that allows new cryptographic methods to be introduced in a controlled manner.
The transition then becomes a planned transformation process rather than a single change implemented on a specific date.

PQC Preparation

essendi it approaches Post-Quantum Cryptography from several perspectives. As a user of cryptographic infrastructure, we address the same fundamental questions as other organizations. At the same time, we develop solutions for certificate management and cryptographic infrastructure and therefore need to consider how new methods affect products, interfaces, and processes. With essendi cd, we help organizations identify digital certificates and cryptographic assets and consolidate them into a crypto inventory. essendi xc provides centralized control and automation of certificate processes. Both visibility and automation are important prerequisites for crypto agility and for adapting cryptographic infrastructure to future requirements.
As part of our own PQC preparation, essendi it has also developed a best practice approach that we are initially testing and refining within our organization. The approach combines awareness and knowledge building with the practical analysis of cryptographic dependencies and structured preparation for the transition to new methods.

Explore the Topic in GlobalSign’s Trust.ID Talk

Sarah Zügel and Julian Weeber from essendi it discuss these questions with Steve Hall in the GlobalSign Trust.ID Talk episode “The Quantum Countdown: Why Your Encryption Has an Expiration Date.”
The conversation covers topics including “harvest now, decrypt later,” crypto agility, crypto inventories, and the steps organizations can take today to prepare for Post-Quantum Cryptography.
Listen to the Trust.ID Talk episode

blank

Subscribe to the free essendi it newsletter.

SIGN UP NOW AND STAY INFORMED.