PQC Migration Guide

Post-quantum cryptography (PQC) protects against the threat of quantum computers breaking classical encryption. 4Quays makes PQC migration a policy change, not a code change.

Why PQC Matters

The Quantum Threat

Quantum computers threaten current cryptographic algorithms:

Harvest Now, Decrypt Later

Adversaries may be collecting encrypted data today to decrypt when quantum computers become available. Sensitive data with long-term value should use PQC now.

NIST PQC Standards

NIST has standardized post-quantum algorithms:

• ML-KEM (formerly CRYSTALS-Kyber) — Key encapsulation
• ML-DSA (formerly CRYSTALS-Dilithium) — Digital signatures

4Quays supports these NIST-standardized algorithms.

PQC in 4Quays

Supported PQC Algorithms

Key Encapsulation (ML-KEM)

Digital Signatures (ML-DSA)

How It Works

PQC in 4Quays follows the hybrid encryption pattern:

1. Payload encryption: AES-256-GCM (quantum-resistant with 256-bit keys)
2. Key encapsulation: ML-KEM replaces RSA key wrapping
3. Digital signatures: ML-DSA replaces RSA/ECDSA signing

Classical:  AES-256-GCM + RSA-2048 key wrapping
PQC:        AES-256-GCM + ML-KEM-768 key encapsulation

Migration Path

Step 1: Assess Current State

Review your current policies:

const policies = await fetch('https://api.4quays.com/admin/policies', {
  headers: { 'Authorization': `Bearer ${adminKey}` },
});

// Identify policies using classical algorithms
policies.filter(p => p.algorithm.keyWrapping.startsWith('RSA'));

Step 2: Coordinate with External Services

PQC migration requires coordination:

1. Confirm external service supports PQC
2. Obtain their PQC public key
3. Agree on migration timeline
4. Plan testing phase

Step 3: Import PQC Keys

Import the service's PQC public key:

await fetch('https://api.4quays.com/admin/keys', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${adminKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    type: 'ML-KEM-768',
    publicKey: '-----BEGIN PUBLIC KEY-----\n...',
    serviceId: 'service_id',
    description: 'Bank A ML-KEM-768 production key',
  }),
});

Step 4: Create New Policy Version

Create a new version of your policy with PQC:

await fetch('https://api.4quays.com/admin/policies/policy_id/versions', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${adminKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    algorithm: {
      encryption: 'AES-256-GCM',
      keyWrapping: 'ML-KEM-768',  // Changed from RSA-2048
    },
    activationDate: '2026-06-01T00:00:00Z',
    description: 'Upgrade to post-quantum key encapsulation',
  }),
});

Step 5: Test in Staging

Before the activation date:

1. Create a staging policy with PQC
2. Test with the external service
3. Verify payloads are processed correctly
4. Check performance impact

Step 6: Monitor Activation

On the activation date:

1. Watch audit logs for the new algorithm
2. Monitor error rates
3. Verify external service is accepting payloads
4. Have rollback plan ready

Zero Code Changes

The key benefit: your application code doesn't change.

// Before PQC migration
const protected = await fourq.protect(payload, 'BANK-TRANSFER-001');

// After PQC migration - SAME CODE
const protected = await fourq.protect(payload, 'BANK-TRANSFER-001');

The policy determines the algorithm. When the policy updates to PQC, subsequent operations automatically use the new algorithm.

Hybrid Approach

For extra security during transition, consider hybrid encryption:

Hybrid: AES-256-GCM + RSA-2048 + ML-KEM-768

This provides protection if either algorithm is compromised. Contact support to enable hybrid mode.

Monitoring Migration Progress

Track algorithm adoption:

const stats = await fetch('https://api.4quays.com/admin/audit/algorithms', {
  headers: { 'Authorization': `Bearer ${adminKey}` },
  params: {
    from: '2026-01-01T00:00:00Z',
    to: '2026-12-31T23:59:59Z',
  },
});

// {
//   "AES-256-GCM+RSA-2048": 45000,
//   "AES-256-GCM+ML-KEM-768": 55000
// }

Generate compliance reports showing PQC adoption percentage.

Rollback Procedure

If issues occur after PQC activation:

1. Create emergency policy version reverting to classical
2. Set immediate activation (no scheduled date)
3. Monitor for resumed normal operations
4. Investigate the issue in staging
5. Re-attempt migration after resolution

// Emergency rollback
await fetch('https://api.4quays.com/admin/policies/policy_id/versions', {
  method: 'POST',
  body: JSON.stringify({
    algorithm: {
      encryption: 'AES-256-GCM',
      keyWrapping: 'RSA-2048',  // Rollback to classical
    },
    activationDate: null,  // Immediate activation
    description: 'Emergency rollback from PQC',
  }),
});

Timeline Recommendations

Performance Considerations

PQC algorithms have different performance characteristics:

ML-KEM is generally faster but produces larger payloads.

What's Next

• Supported Algorithms — Complete algorithm reference
• Security Best Practices — Security recommendations