Cryptography in the Quantum Era#

Paresh Khatri — Nokia

• Why: PQC migration affects the PM's identity/PKI portfolio (TLS, certificates, protocol auth). This is a primer, but it carries a current, vendor-neutral snapshot of the standards and policy timelines.
• What: The standard framing, done well: Shor breaks RSA/DH/ECC (breaking RSA-2048 estimated at ~4,000 logical qubits / 100M gates vs. today's hundreds of qubits); Grover only halves symmetric strength, so AES-128 remains fine; the present-day threat is HNDL — harvest-now-decrypt-later — with expert-survey "Q-Day" estimates as early as ~2030 and the explicit note that we won't be told when a CRQC first exists. Mosca's inequality (x + y > z) drives migration urgency. Standards snapshot: NIST FIPS 203 (ML-KEM), 204 (ML-DSA), 205 (SLH-DSA), HQC selected as an ML-KEM alternative; IETF hybrid PQ/T key-exchange and signature drafts for TLS 1.3 and IKE/IPsec; 3GPP PQC studies in 6G Rel-20 with normative specs targeted at Rel-21. Positioning: QKD (physics-based, point-to-point key distribution only, eavesdrop-detectable, ETSI GS 0014 interfaces) and PQC as complementary — QKD for symmetric key distribution on fixed paths, PQC for authentication and key agreement at scale. Strategy: crypto-agility plus layered defense-in-depth starting now.
• How: Explanatory, from qubit/superposition basics through HNDL attack flow to a migration decision framework.
• Where applicable: Vendor (Nokia) educational talk with an IP-transport lens — the standards/timeline content is global and vendor-neutral. For a PM already deep in identity this is closer to a checklist than news; its value is the consolidated IETF/3GPP status and the QKD-vs-PQC boundary, which is directly relevant to certificate/protocol roadmaps.