Preparation for the Post-Quantum Certified Architect Exam
Every PQC migration comes down to architecture decisions. Which algorithms for which systems. How to handle hybrid deployments during transition. Where to place cryptographic boundaries. How to design PKI hierarchies that support both classical and post-quantum certificates. How to build in agility so the next transition costs less than this one.
PQCA Architect Training develops the design competencies needed to make these decisions well. The curriculum covers end-to-end migration architecture: from assessing the current cryptographic estate through algorithm selection, hybrid implementation design, PKI migration, and cryptographic agility. Each module combines conceptual frameworks with applied design exercises using realistic enterprise scenarios.
Where PQCS Training builds the foundational competence to assess and plan, and PQCM Training develops program leadership, PQCA focuses on the technical design layer — the decisions that determine whether an implementation is correct, performant, and maintainable.
Who Should Take This Course
Security architects, enterprise architects, solutions architects, principal engineers, cryptographic engineers, and senior technical consultants who design cryptographic systems or lead the technical direction of PQC migration programs.
You should take this course if you:
- Are responsible for selecting algorithms and designing implementations for PQC migration
- Need to design PKI migration strategies for enterprise certificate infrastructures
- Must evaluate hybrid implementation approaches and decide which pattern fits your environment
- Design cryptographic architectures that need to remain agile after the initial PQC migration
- Produce architecture documentation and technical specifications that implementation teams follow
What You Will Learn
After completing this course, you will be able to:
- Assess existing cryptographic architectures for quantum vulnerability, mapping every cryptographic dependency and trust relationship
- Select PQC algorithms for specific deployment contexts based on performance characteristics, key and signature sizes, security assumptions, and operational constraints
- Design hybrid implementation architectures for both key exchange and digital signatures, selecting between concatenation, combiner, and nested approaches
- Evaluate migration patterns — in-place upgrade, parallel deployment, and gateway-based — for different system types and risk profiles
- Design PKI migration strategies including dual-certificate hierarchies, cross-signed trust anchors, and HSM upgrade paths
- Assess certificate chain-size consequences of post-quantum certificates and design mitigations
- Apply cryptographic agility principles at the protocol, application, and infrastructure layers
- Produce implementation-ready architecture decision records (ADRs) and technical specifications
Course Outline
Module 1 — Cryptographic Architecture Assessment
Analyzing the current state: mapping every place cryptography is used, how keys are generated and managed, where trust anchors live, and which dependencies cross system boundaries. Going beyond the CBOM produced in PQCS to build a full architectural view that captures trust relationships, data flows, and the interaction between different cryptographic layers. Identifying the architectural constraints that will shape the migration: legacy systems that cannot be upgraded, performance-critical paths, regulatory requirements, and vendor dependencies that limit options.
Module 2 — Algorithm Selection for Specific Contexts
The PQCS course covers algorithm fundamentals. This module applies that knowledge to design decisions. When ML-KEM is the default and when it is not. When SLH-DSA’s conservative security assumptions justify the larger signatures. When FN-DSA’s compact signatures are worth the implementation complexity. How to assess the tradeoff between key/signature size and performance for each deployment scenario. Algorithm selection for constrained environments (IoT, embedded systems, smart cards). How to document algorithm selection decisions in a way that survives audit and future review.
Module 3 — Hybrid Implementation Design
Hybrid cryptography is the consensus transition approach, but there are multiple ways to implement it, each with different security properties, performance characteristics, and operational implications. This module covers concatenated hybrid key exchange (the approach deployed in TLS 1.3 at scale), combiner-based approaches with formal security proofs, nested signature schemes, and dual-certificate strategies. You will assess the performance and bandwidth implications of each approach, design fallback and negotiation strategies, and plan for “hybrid exit” — the eventual removal of the classical algorithm once confidence in post-quantum algorithms is established.
Module 4 — Migration Pattern Selection
Different systems require different migration approaches. In-place algorithm upgrade works for systems with clean cryptographic abstraction layers. Parallel deployment (running classical and post-quantum systems side by side) suits environments where availability is critical and rollback must be fast. Gateway-based approaches allow migration of internal systems while maintaining classical compatibility with external partners. This module provides a decision framework for selecting the right pattern for each system in the estate, considering risk tolerance, testing requirements, performance constraints, and organizational readiness.
Module 5 — PKI Migration Architecture
PKI is the infrastructure bottleneck for most enterprise PQC migrations. Post-quantum certificates are larger (ML-DSA signatures are approximately 2.4 KB versus 256 bytes for ECDSA), which has cascade effects on certificate chain validation, OCSP response sizes, TLS handshake latency, and HSM storage. This module covers dual-capability PKI design (supporting both classical and post-quantum certificates during transition), trust anchor migration strategies, HSM inventory and firmware upgrade paths, certificate lifecycle management during the transition period, and the architectural decisions that determine whether PKI migration is a smooth evolution or a disruptive flag day.
Module 6 — Cryptographic Agility Architecture
The PQC migration will not be the last cryptographic transition. Cryptographic agility means designing systems that can change algorithms with bounded effort. This module distinguishes architecture patterns that genuinely achieve agility from those that only claim it. You will examine protocol-layer agility (algorithm negotiation in TLS, SSH, IPsec), application-layer agility (abstraction patterns, configuration-driven algorithm selection), and infrastructure-layer agility (key management systems, HSMs, certificate management). Testing agility in practice: verifying that a system designated as “agile” can actually switch algorithms under realistic conditions.
Module 7 — Migration Design Documentation
Producing architecture artifacts that implementation teams can follow. Architecture decision records (ADRs) that capture the reasoning behind algorithm and pattern selections. Technical specifications with enough detail for implementation without over-constraining the approach. Design review processes: what to review, who should review it, and how to handle disagreements between security requirements and operational constraints. Communicating architectural trade-offs to non-architectural stakeholders.
Format and Delivery
Online (self-paced) — US$2,499. Approximately 40 hours including design exercises and architecture reviews. 180-day access.
Live online (instructor-led) — US$2,499. Multi-day sessions with collaborative design exercises.
In-person (instructor-led) — US$3,499. Multi-day at scheduled locations. Small-group format.
Corporate delivery — Custom training for organizational teams of 10+. Contact training@quantumacademy.com.
Prerequisites
- Active PQCS — Post-Quantum Certified Specialist certification
What Comes Next
After completing this course, you are eligible to sit for the PQCA certification exam. Earn PQCM + PQCA + PQCV → automatically awarded PQCX — Post-Quantum Certified Expert.
Pricing
| Option | Price |
|---|---|
| Online (self-paced) | US$2,499 |
| In-person (instructor-led) | US$3,499 |
| Online training + PQCA exam bundle | US$2,999 |
| In-person training + PQCA exam bundle | US$3,999 |
All prices are in US dollars.