Nation-states are intercepting and storing encrypted traffic today, waiting for fault-tolerant quantum machines to decrypt it later. This is "Harvest Now, Decrypt Later" — and it's why migration can't wait for 2030.
NIST's finalized standards (Aug 2024):
FIPS 203 — ML-KEM (Kyber) for encryption and key exchange
FIPS 204 — ML-DSA (Dilithium) for primary signatures
FIPS 205 — SLH-DSA (SPHINCS+) as hash-based backup
FIPS 206 — FN-DSA (FALCON) for compact IoT signatures
The 4-phase migration:
Cryptographic Bill of Materials — Passive scanners catalog every TLS cipher suite, PKI cert, and code-signing key. Prioritize data with 10+ year shelf life.
Hybrid deployment — Never hard-cutover. Combine X25519 with ML-KEM-768. Attackers must break both simultaneously. Browsers and CDNs already support this.
Packet fragmentation optimization — ECDSA signatures are ~64 bytes. ML-DSA-44 is over 2,400 bytes. That 40x increase breaks legacy firewalls and MTU limits.
Cryptographic agility — Decouple algorithms from source code via OpenSSL 3.x providers or PKCS#11. If lattice math falls, swap in hash-based backups with zero downtime.
PQC vs. QKD: PQC runs on existing hardware as software. QKD needs dedicated fiber-optic lasers and single-photon equipment.
Full read: https://www.nizover.com/en/blog/tech-post-quantum-cryptography-nist-migration-guide