The post-quantum transition, mapped

Moving off RSA and elliptic curves is a multi-year engineering programme, not a library upgrade. This page maps each step to the package that does the work and to the deadlines that set the pace.

How do the steps connect?

flowchart LR
    subgraph D[1 · Discover]
        A[Source code] -->|pqblocks-scan<br/>pqblocks-lint| B[Inventory]
        T[TLS endpoints] -->|pqblocks-tls-interop| B
    end
    subgraph S[2 · Assess]
        B -->|pqblocks-scan| C[CycloneDX 1.6 CBOM]
        C -->|pqblocks-cbom| C2[Classified CBOM]
        C -->|pqblocks-agility| R[Readiness score]
    end
    subgraph G[3 · Govern]
        C2 -->|pqblocks-policy| P[CI policy gate]
        C2 -->|pqblocks-cnsa-evidence| E[CNSA 2.0 evidence pack]
    end
    subgraph M[4 · Migrate]
        P --> K[pqblocks-primitives<br/>pqblocks-core]
        K --> J[pqblocks-jose<br/>tokens]
        K --> F[pqblocks-files<br/>files]
    end
    subgraph I[5 · Interoperate]
        K --> W[pqblocks-wire<br/>pqblocks-jwe]
        K --> X[pqblocks-csr-pop<br/>certificates]
        K --> L[pqblocks-tls-interop<br/>TLS 1.3]
    end
    subgraph V[6 · Verify]
        K --> AC[pqblocks-acvp<br/>NIST vectors]
        W --> FC[pqblocks-fips-check<br/>boundary checks]
    end

What happens at each step?

Step	Question it answers	Packages
1. Discover	Where do we use RSA, ECC, weak hashes and post-quantum algorithms, in code and on the wire?	scan, lint, tls-interop
2. Assess	How exposed are we, and how hard will the change be?	cbom, agility
3. Govern	How do we stop new classical-only code and prove progress to auditors?	policy, jwe-audit, cnsa-evidence
4. Migrate	What replaces the old primitives in tokens, files and key exchange?	primitives, core, jose, files
5. Interoperate	How do larger keys, ciphertexts and signatures travel through protocols and formats?	tls-interop, wire, jwe, csr-pop
6. Verify	Is the new implementation correct, and did the migration actually land?	acvp, fips-check

Which deadlines drive the timeline?

Date	Milestone	Source
Aug 2024	ML-KEM, ML-DSA and SLH-DSA published as final standards (FIPS 203, 204, 205)	NIST
2025	CNSA 2.0: software and firmware signing, web browsers, servers and cloud services should support and prefer CNSA 2.0 algorithms	NSA CNSA 2.0
2026–2027	CNSA 2.0: traditional networking equipment (2026) and operating systems (2027) should support and prefer CNSA 2.0	NSA CNSA 2.0
End of 2026	EU member states start the transition and complete first inventories	EU coordinated PQC roadmap (2025)
2030	112-bit quantum-vulnerable algorithms (for example RSA-2048, P-256) deprecated. CNSA 2.0: software/firmware signing and networking equipment use CNSA 2.0 exclusively. EU: high-risk use cases migrated	NIST IR 8547 (draft), NSA CNSA 2.0, EU roadmap
2033	CNSA 2.0: browsers, servers, cloud services and operating systems use CNSA 2.0 exclusively	NSA CNSA 2.0
2035	All quantum-vulnerable public-key algorithms disallowed; national security systems quantum-resistant	NIST IR 8547 (draft), NSM-10

Read the primary sources

Deadlines differ by sector and system type, and drafts change. Plan against the documents themselves: NIST IR 8547, NSA CNSA 2.0 and the FIPS 203, 204 and 205 standards.

Where do I start?

Start with step 1. A complete inventory turns a vague mandate into a list of concrete changes. Follow How to check if my app still uses RSA or ECC, then work through the steps in order.