Read this first
Before choosing a primitive, find where the primitives already live. A crypto inventory maps every use of asymmetric cryptography across your systems and orders them by exposure — it is the artefact the rest of the migration is built on.
Teams often start a migration by asking which post-quantum primitive to adopt. That is the second question. The first is where asymmetric cryptography is used at all — because in most systems the answer is “more places than anyone has written down.”
What an inventory covers
- TLS termination and any internal service-to-service mTLS
- PKI: certificate authorities, signing pipelines, attestation chains
- Identity keys, signed prekeys, and one-time prekeys in messaging
- Backup, archive, and multi-device sync encryption
- Tokens, JWT signing, and code-signing keys
Treating post-quantum as a single switch
A single application can use asymmetric primitives in ten distinct places, each with a different threat model and exposure window. “Going post-quantum” means addressing each of them, with appropriate parameter choices, in an order that matches the threat model.
The inventory is also where harvest-now-decrypt-later exposure is ranked. A key protecting data with a thirty-year confidentiality requirement is a different priority from an ephemeral session key — and the roadmap should reflect that, not treat every location as equal.
Have a system that needs this?
Secure my organization