This diagram shows why a database encrypted with a symmetric data key can still inherit quantum exposure through the public-key mechanism that establishes, transports, or protects that key. It also exposes dependencies that are easy to omit, particularly CI/CD signing and SSH administration, where the primary loss is authenticity rather than delayed confidentiality.
Once the architecture identifies each dependency, the required output is a defensible migration decision rather than a generic claim that a system is quantum ready. We must recognize which primitives Shor threatens, distinguish key establishment from signatures, and connect each exposed primitive to the asset and trust boundary it protects. NIST standardized three foundational PQC algorithms in August 2024: FIPS 203 ML-KEM for key establishment, FIPS 204 ML-DSA for digital signatures, and FIPS 205 SLH-DSA for stateless hash-based signatures.
Later lessons will build four practical capabilities:
Crypto agility is the capability to replace cryptographic algorithms, keys, and related dependencies without unacceptable disruption or loss of interoperability. It is a property of the surrounding system, including configuration, certificate handling, vendor support, and protocol negotiation, not a property supplied by an algorithm alone.
Which touchpoints risk future confidentiality loss from retained data, and which primarily risk forged identity or integrity after Q-Day? The comparison separates those decisions.
A customer record encrypted in a long-lived backup remains unreadable today, even if an attacker copied the backup from object storage years ago. The attacker did not need access to the database, the application, or the encryption key. If the backup’s data-encryption key was established or protected with RSA or elliptic-curve cryptography, a future cryptanalytically relevant quantum computer could recover that key and expose the retained data. The defender’s question is therefore not when an endpoint will be hacked. It is whether data encrypted today will still need confidentiality after quantum-capable cryptanalysis becomes feasible.
The same problem applies to TLS traffic captured from a network path. A session protected by conventional public-key key establishment can keep customer_id=48291 private while the session runs, yet a retained capture may become decryptable later if its public-key protection falls to a quantum attack. This is harvest now, decrypt later, the collection of protected data now for decryption when stronger computation becomes available. Its risk depends on the data’s confidentiality lifetime, not merely on the expected arrival date of a quantum computer.
Q-Day
Q-Day is the point at which a cryptanalytically relevant quantum computer, or CRQC, can practically defeat the public-key assumptions a system still depends on. For a system owner, Q-Day is a planning boundary, not a prediction of a calendar date. NIST notes that CRQC estimates vary widely, while cryptographic transitions historically take years to integrate across products, services, and infrastructure.
This course treats the threat narrowly and precisely. Shor’s algorithm threatens RSA and elliptic-curve public-key operations used for key establishment and digital signatures. It does not mean that every encrypted byte becomes equally weak. Symmetric encryption, hashes, key storage, protocol configuration, certificate lifecycle, and data retention still determine whether a quantum-vulnerable public-key dependency exposes an actual asset.
Because the backup and TLS capture are only two paths into the same system, migration begins by locating every place where public-key cryptography establishes trust. In a typical service, a browser reaches a web frontend, the frontend calls an API, and the API reads a database. The architecture also includes backup storage, administrative access, build signing, logs, and external integrations. A cryptographic inventory must record which protocol, algorithm, library, certificate, key owner, and data lifetime belong to each path.
TLS commonly uses RSA or ECC for authentication and, depending on the deployed protocol configuration, for key establishment. JWT signing keys can use RSA or elliptic-curve signatures to let an API verify a token’s origin and integrity. Code-signing certificates establish whether a release artifact came from an authorized publisher. SSH host keys authenticate the server that administrators reach. These controls serve different security goals, so replacing them is not one uniform algorithm swap.
The architecture below separates public-key touchpoints from symmetric protection, which is the distinction an inventory must preserve: