Managing Post-Quantum Cryptography

Managing  Post-Quantum Cryptography gives IT managers and senior leaders the threat framework, operational methodology, and governance structures to migrate enterprise cryptographic infrastructure before a quantum computer makes the current algorithms indefensible.
What this book covers:
• Why enterprise encryption has an expiration date: the mathematical assumptions behind RSA, ECC, and Diffie-Hellman; the harvest-now, decrypt-later threat that has already started; and how to reframe cryptographic risk for executive audiences without inducing paralysis
• How Shor's and Grover's algorithms break the cryptographic stack: which deployed protocols are broken, weakened, or unaffected—TLS, PKI, code signing, VPNs, SSH, and symmetric ciphers assessed algorithm by algorithm
• The new algorithmic landscape: lattice-based cryptography (ML-KEM, ML-DSA), hash-based signatures (SPHINCS+/SLH-DSA), code-based and multivariate approaches, and the SIDH cautionary lesson in cryptographic humility
• NIST FIPS 203, 204, and 205: what was selected, why, and how to read the standards documents for parameter sets, security levels, interoperability requirements, and deprecation timelines—plus federal mandates under NSA, CISA, OMB, and CNSS Policy 15
• The cryptographic census: discovery methodology for network scanning, application-layer analysis, certificate inventory, hardware and embedded systems, and vendor/supply chain dependencies—built into a prioritized risk register
• Hybrid cryptography as the transition bridge: hybrid KEM constructions combining X25519 and ML-KEM in TLS 1.3, composite signature schemes, protocol-specific integration guidance, and operational discipline for dual-algorithm environments
• Crypto-agility as an architecture principle: API design for algorithm negotiation, PKI and certificate infrastructure for algorithm transition, HSM firmware evaluation, and organizational practices that prevent the next forced migration
• The migration playbook: four-phase sequencing from baseline through application layer, harvest-now risk multipliers, vendor readiness scorecards, testing and rollback planning, and cross-functional change management
• Quantum resilience governance: policy architecture, cryptographic stewardship roles, GRC integration, audit readiness, workforce development, and strategic threat monitoring for algorithm deprecation events
Every chapter ends with a Manager's Checklist. This book is for the leader who is accountable for the migration—not the engineer executing it.