Choosing Post-Quantum Algorithms, And Whether To Run Them Alongside The Old Ones

The algorithm standards are finished, so the hard part of the post-quantum migration is no longer which mathematics to trust. It is two engineering choices the standards deliberately leave open, and on one of them the national cryptographic authorities contradict each other. France has made running a post-quantum algorithm alongside a classical one obligatory inside its regulated scope. The NSA tells American national security systems to avoid doing it. Which post-quantum algorithms to pick is close to decided, and the NCSC will name them for you. Whether to run the new one beside the one it replaces is not decided at all. That is the choice that determines whether you budget for this migration once or twice. Key takeaways Two post-quantum algorithms cover general purpose work. ML-KEM agrees a shared secret, ML-DSA signs, and the NCSC recommends the ML-KEM-768 and ML-DSA-65 parameter sets for most cases. Every parameter set is strong enough up to OFFICIAL. Below that ceiling the choice is about power, bandwidth and size. Above it the NSA requires the largest sets on national security systems. Firmware signing is a different problem. Hash-based signatures rest on other assumptions and suit signatures that must be verified years later. LMS…