PQC Migration for Connected Vehicles and Automotive Supply Chains
Vehicles sold today stay in service for 10 to 20 years, so many will still be on the road when a CRQC could be operational. Over-the-air update signing is the most urgent migration case: if OTA signing keys are compromised, an attacker could push malicious firmware to an entire fleet. V2X communication, in-vehicle network security, and supplier cryptographic requirements are also in scope.
This course covers PQC migration for automotive OEMs, tier-1 suppliers, and the companies that provide connected vehicle services.
Course Outline
Module 1 Automotive Cryptographic Exposure
Where cryptography is used in connected vehicles: OTA update signing, V2X communication, telematics, in-vehicle networking, diagnostic interfaces, and key fob systems. The 10–20 year vehicle lifetime, and how long the onboard cryptography must stay secure.
Module 2 OTA Update Signing Migration
The most urgent automotive PQC use case. Code signing key migration strategies. Dual-signature approaches during transition. Managing signing infrastructure across vehicle generations. Recall and remediation planning.
Module 3 V2X and Connected Services
V2X communication security and PQC migration. Telematics data protection. Connected service API security. Fleet management cryptographic dependencies.
Module 4 Standards and Supply Chain
ISO/SAE 21434 cybersecurity requirements. UNECE WP.29 implications. Tier-1 supplier cryptographic requirements. Managing PQC migration across the automotive supply chain.
Prerequisites
None. Sector experience is helpful but not required. For a broader PQC foundation, consider starting with Post-Quantum Foundation.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CISM and CRISC holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Who this course is for
Vehicle security architects, over-the-air and backend platform leads, V2X and connectivity engineers, and product cybersecurity staff who own ISO/SAE 21434 work. It is for both OEMs and tier-1 suppliers.
If your interest is the manufacturing plant, Quantum-Safe OT and Critical Infrastructure covers it.
What you’ll be able to do afterward
- Treat over-the-air update signing as the first migration case and plan it before the others
- Map cryptographic dependencies across in-vehicle networks, the backend, and V2X
- Separate the fleet that can receive a cryptographic update from the fleet that cannot
- Make post-quantum requirements part of your ISO/SAE 21434 engineering work
- Write supplier cryptographic requirements into the next platform’s specifications
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Nothing is required. Post-Quantum Foundation covers the algorithm vocabulary if you want it first. The Quantum-Safe Automotive Intensive is a full-day private workshop. PQC Vendor Governance covers supplier requirements.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework. Its author, Marin Ivezic, is one of the practitioners who teach here. The framework is published openly under Creative Commons at pqcframework.org. The people who teach this course run migration programs inside organizations today. The course covers the problems they meet in that work.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.