Cryptographic Discovery and Post-Quantum Migration Risk Assessment: A Review of Approaches and Open Gaps

Author

Aravala Satvik, Avula Yaswanth Sai Charan Reddy, Allamsetti Rohith, Annepu Laxmi Prasanna Rao

Abstract

 Moving to post-quantum cryptography (PQC) is hard for organizations that still rely on RSA and elliptic-curve cryptography (ECC), both of which a sufficiently capable quantum computer could break with Shor's algorithm. The Harvest Now, Decrypt Later (HNDL) threat adds urgency, because data collected today may still need protection when such computers arrive. Planning a migration requires knowing where cryptography is used, how exposed it is, and what to replace first. This paper reviews research that addresses these needs, organized into five areas: hybrid and quantum-resistant protocols, cryptographic discovery and software analysis, cryptographic inventories and the Cryptographic Bill of Materials (CBOM), quantum threat and risk assessment, and PQC migration frameworks and standards. We summarize what each area has achieved, compare the reported results side by side, and point out where the pieces do not yet fit together. The main gap we find is the lack of a single, evidence-based workflow that connects discovery, inventory, risk scoring, and migration planning. We outline a conceptual reference pipeline for such a workflow and discuss open challenges, including incomplete discovery, evidence quality, score validation, and evaluation methodology.

Keywords

Post-Quantum Cryptography (PQC), Harvest Now, Decrypt Later (HNDL), Application Security Posture Management (ASPM), Cryptographic Bill of Materials (CBOM), Quantum Risk Assessment, Cryptographic Discovery, Literature Review.

Full Text:

Download Paper PDF

References

Complete citation details (authors, title, venue, year, DOI) still need to be added for each entry below. The list follows the numbering used in the text.

[1] Rubio García et al. Triple-hybrid key establishment (classical, ML-KEM-1024, QKD) in TLS 1.3 and IKEv2.

[2] Kwon et al. Compact hybrid digital signatures combining ECDSA P-256 and Falcon-512.

[3] Rattanavipanon et al. QED toolchain for identifying quantum-vulnerable software executables.

[4] Baseri et al. Quantum-related threats across infrastructure layers and PQC migration considerations.

[5] Baseri et al. Quantum-security risks across network protocols (TLS, IPsec, SSH, DNSSEC, PGP).

[6] Chethana et al. Review of block ciphers under quantum attacks.

[7] Wang and Ismail. Review of PQC applications and migration trade-offs.

[8] Kagai et al. Harvest Now, Decrypt Later as a temporal security risk.

[9] González de la Torre et al. Wireless-based Kyber adaptation for resource-constrained devices.

[10] Birgin and Celiktas. Sector-agnostic operational framework for PQC migration.

[11] Baseri et al. Risk-assessment framework using STRIDE-based threat analysis.

[12] Olushola and Meenakshi. Authenticated post-quantum session protocol.

[13] El Bizri et al. Comparison of institutional PQC migration strategies.

[14] Ricci et al. Hybrid key combiner with classical key exchange, post-quantum KEM, and QKD.

[15] Gupta and Mittal. Staged hybrid migration strategy for legacy SCADA environments.

[16] Buruaga et al. Hybrid quantum-safe TLS in a software-defined networking environment.

[17] NIST. Transition guidance for quantum-vulnerable public-key mechanisms.

[18] NIST. Guidance on key generation.

[19] CISA. Strategy for automated cryptographic discovery and inventory.

[20] Hess. CycloneDX CBOM evaluation on Keycloak and an nginx container image.

[21] NIST. FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). New entry: replaces the Introduction's earlier [1].

[22] CycloneDX. Cryptographic Bill of Materials (CBOM) specification. New entry: replaces the Introduction's earlier [2].

 

 

Share your valuable work from Social Media Buttons