Post-Quantum Crypto Readiness Checklist

Your organization is likely evaluating post-quantum cryptographic algorithms as part of long-term data protection planning. The recent discovery of a quasipolynomial-time distinguisher against the McEliece cryptosystem, a candidate for NIST's post-quantum standardization, highlights an important point: post-quantum doesn't mean invulnerable.

This checklist helps you assess your current cryptographic posture and build a transition plan that accounts for evolving post-quantum research. Use it to guide discussions with your cryptography team, vendors, and compliance stakeholders.

Purpose of This Checklist

This guide helps you systematically review your cryptographic dependencies and prepare for the transition to post-quantum algorithms. It's designed for risk and compliance teams who need to:

• Document current cryptographic implementations across payment flows
• Identify systems with long-lived encrypted data exposure
• Evaluate vendor claims about post-quantum readiness
• Build a phased migration plan that doesn't disrupt operations

The McEliece findings, showing a distinguisher running in time n^(O(log n)) applicable to all Classic McEliece parameter sets in the NIST process, illustrate why "wait and see" isn't a strategy. Your encrypted data today may be harvested and stored for future decryption once quantum computers become practical.

Prerequisites

Before using this checklist, gather:

• Cryptographic inventory: List systems that encrypt, sign, or hash sensitive data (cardholder data, authentication credentials, or personally identifiable information)
• Data retention schedules: Determine how long encrypted data remains valuable to an attacker
• Vendor documentation: Review current cryptographic libraries, key management systems, and Hardware Security Module (HSM) specifications
• Compliance requirements: Identify any regulatory mandates referencing specific cryptographic standards (FIPS 140-3, PCI DSS cryptographic controls)

You don't need a cryptography PhD to complete this assessment, but you'll want someone who understands your key management architecture involved.

The Checklist

Current State Assessment

Cryptographic Algorithm Inventory

• Document every algorithm currently protecting data at rest (AES-256, RSA-2048, etc.)
• Document every algorithm protecting data in transit (TLS 1.3 cipher suites)
• Identify all digital signature implementations (transaction signing, API authentication)
• List key exchange mechanisms (RSA, ECDH) and where they're used
• Note which systems use symmetric vs. asymmetric cryptography

Data Longevity Risk

• Identify data encrypted today that must remain confidential beyond 10 years
• Flag any "harvest now, decrypt later" exposure (archived transaction logs, backup tapes, long-term customer records)
• Document regulatory retention requirements that extend data lifetime
• Assess whether historical encrypted data can be re-encrypted under new algorithms

Vendor and Infrastructure Dependencies

• List all HSMs and their firmware versions
• Document cryptographic libraries (OpenSSL, BoringSSL, vendor-specific)
• Identify payment processors and their stated post-quantum roadmaps
• Note any hardware that hard-codes cryptographic algorithms

Post-Quantum Readiness Evaluation

NIST Standards Tracking

• Assign someone to monitor NIST's post-quantum standardization process
• Review current NIST-approved algorithms (CRYSTALS-Kyber for key exchange, CRYSTALS-Dilithium for signatures)
• Understand which candidate algorithms have been withdrawn or challenged
• Track when NIST expects to finalize standards (target dates, not guarantees)

Cryptographic Agility Assessment

• Test whether you can swap algorithms without application code changes
• Verify that key management systems support algorithm negotiation
• Check if your HSMs can be firmware-updated to support new algorithms
• Identify any hard-coded algorithm identifiers in stored data formats

Hybrid Approach Planning

• Evaluate whether your systems can run classical and post-quantum algorithms simultaneously
• Design a transition period where both algorithm families protect the same data
• Plan for increased key sizes and computational overhead
• Test performance impact of hybrid encryption on payment authorization latency

Migration Strategy

Phased Rollout Plan

• Prioritize systems with the longest data confidentiality requirements
• Identify low-risk environments for initial post-quantum testing (development, staging)
• Define rollback procedures if new algorithms cause operational issues
• Set migration milestones tied to NIST finalization, not arbitrary dates

Vendor Engagement

• Request post-quantum roadmaps from all cryptographic vendors
• Ask for specific timelines, not vague commitments
• Verify that vendors plan hybrid implementations (not rip-and-replace)
• Confirm that updates won't break existing integrations

Compliance and Documentation

• Update your cryptographic standards document to reference post-quantum plans
• Notify auditors and assessors of your transition timeline
• Document any temporary dual-algorithm implementations for compliance reviews
• Prepare justification for why certain systems migrate before others

Customization Tips

For Payment Processors: Focus on transaction signing and cardholder data encryption. Your migration timeline may be constrained by card network requirements. Document when Visa, Mastercard, and others mandate post-quantum support.

For Banks with Long-Lived Records: Prioritize re-encryption of archived data. If you retain transaction records for seven years under the Bank Secrecy Act, data encrypted in 2024 must survive potential quantum attacks through 2031.

For Fintechs Using Cloud HSMs: Verify that your cloud provider's HSM service will support NIST-approved post-quantum algorithms. AWS CloudHSM and Azure Dedicated HSM have different update cycles than on-premises hardware.

For Organizations with Embedded Systems: Payment terminals, point-of-sale devices, and hardware tokens may not support firmware updates. Plan for hardware refresh cycles aligned with post-quantum migration.

Validation Steps

After completing this checklist:

1. Confirm you have a complete cryptographic inventory. If you discover algorithms during migration that weren't documented, your inventory process failed.

2. Test algorithm swaps in a non-production environment. Attempt to replace one symmetric or asymmetric algorithm with a different approved algorithm. If this breaks your application, you lack cryptographic agility.

3. Review your plan with external auditors. QSAs and compliance assessors will eventually ask about post-quantum readiness. Preview your strategy before it becomes a finding.

4. Set a calendar reminder to revisit this checklist every six months. Post-quantum research moves quickly. What's secure today may face new challenges tomorrow, just as McEliece's security assumptions have evolved under scrutiny.

The McEliece distinguisher doesn't mean post-quantum cryptography is broken. It means that even well-studied candidates face ongoing cryptanalysis, and your migration plan must account for evolving threat models. Start now, while you still have time to make deliberate choices instead of emergency pivots.