Quantum-Safe Networking Starts With the Network You Already Have#

Vincent Paul Celindro – Quantum Foundry

• Why: PQC migration framed for network operators, not cryptographers: keep the network, replace only the quantum-vulnerable public-key functions. Sits at the intersection of the PM's network-security and key-establishment/identity interests.
• What: A migration model with three jobs: authentication (RSA/ECDSA → ML-DSA/SLH-DSA, FIPS 204/205), key establishment (DH/ECDH → ML-KEM, FIPS 203, typically hybrid ECDH+ML-KEM), and bulk protection (AES-256-GCM retained — Grover only trims margin and is hard to parallelize). Positioning: deploy PQC broadly, add QKD only where physics/topology/risk justify it. Roadmap: inventory crypto, prioritize by confidentiality lifetime (Harvest-Now-Decrypt-Later makes long-lived tunnels urgent), build crypto-agility, test vendor interop, in the context of EO 14412.
• How: Built up from IKEv1/IKEv2 architecture — a recorded Phase 1 DH exchange can later unlock the entire captured IPsec session (Phase 2 keys and ESP), so hybrid ML-KEM in the handshake is what defuses HNDL. "Upgrade the handshake, not every packet."
• Where applicable: General technique for any operator with long-lived confidential tunnels (IPsec VPNs, MACsec-adjacent planning); QKD is explicitly selective, not the default.