MODULE m8 · 8.0 HOURS

Drafting a Migration Prioritization Report

0% complete

LEARNING OBJECTIVES

Module objectives

  1. Understand risk and business impact analysis frameworks for Post-Quantum Cryptography (PQC) migration.
  2. Determine migration priorities based on cryptographic asset inventory data.
  3. Establish technical strategies to ensure Cryptographic Agility.
  4. Structure a final migration roadmap and validation report.

Migration Prioritization Strategy

Migration to NIST post-quantum standards (ML-KEM, ML-DSA) begins with a system-wide assessment of cryptographic assets. Migration priority is determined not simply by the degree of algorithm obsolescence, but by data shelf life, cryptographic exposure risk, and the strategic importance of the system [S1].

1. Assessment Criteria

To determine migration urgency, the following criteria are used:

  • Data Security Shelf Life: Impact when encrypted data is decrypted by future quantum computers (e.g., data requiring confidentiality for 10 years or more).
  • System Agility: Whether current cryptographic implementations are hard-coded or if algorithms can be replaced via configuration files.
  • Technical Debt: Dependencies using the cryptographic module and maintainability.

2. Ensuring Cryptographic Agility

The key to a migration roadmap is to minimize code changes during algorithm replacement. Using an abstraction layer to decouple business logic from the cryptographic engine, and employing a hybrid key exchange approach to ensure both the stability of existing algorithms and the quantum resistance of PQC, is the recommended strategy.

WORKED EXAMPLES

Worked examples

  1. Example 1: Priority calculation based on data lifecycle - A personal information database preserved for 20 years is evaluated with a higher PQC migration priority than log data preserved for 5 years.
  2. Example 2: Hybrid TLS configuration case - Analysis of a hybrid model designed to combine existing ECDH and ML-KEM, ensuring communication confidentiality even if only one of the two algorithms remains secure.

LAB PROTOCOL

Migration Roadmap Simulation

  1. 1

    Load the inventory CSV data created in the previous module.

  2. 2

    Write a Python script that calculates a [Risk * Criticality * Shelf Life] score for each asset.

  3. 3

    Develop hybrid implementation plans for the top 3 priority assets.

  4. 4

    Describe potential compatibility issues and countermeasures (Fall-back strategy) during migration.

Safety check
  • Perform all calculations and analysis only in an independent, isolated virtual environment.
  • Do not modify the actual cryptographic configuration of production servers.
  • Review analysis notebooks to ensure actual key material is not included.

Lab deliverables

  • Prioritized inventory CSV analysis.
  • Technical decision-making table including migration plans.

ASSIGNMENT

PQC Migration Prioritization Report

Deliverables

Rubric

  • Reasonable prioritization logic based on data shelf life and exposure risk.
  • Consideration of cryptographic agility through the introduction of hybrid cryptographic schemes.
  • Step-by-step feasibility of the migration plan.
  • Consistency with experimental results and data inventory.

KNOWLEDGE CHECK

Knowledge check

1Which data characteristic should be most considered when determining cryptographic migration priority?
2What software design approach is recommended for Cryptographic Agility?

FIELD CHECK

Completion criteria

  • Submission of an inventory analysis file with migration priorities specified.
  • Preparation of a migration roadmap report incorporating cryptographic agility considerations.
  • Completion of a reproduction package containing all lab code and measurements.

MODULE SOURCES

Module sources

  1. MIT OpenCourseWare | Free Online Course Materialsocw.mit.edu · university