Why Telecom PQC Migration Is Harder Than Enterprise Migration

An X25519 public key is 32 bytes. The ML-KEM-768 key that replaces it is 1,184 bytes, and the ciphertext that comes back is another 1,088. Inside a data centre, that difference is a rounding error. Inside a mobile network it is a design constraint, because several of the messages that have to carry those bytes were sized when their specifications were written and have not grown since.

The size problem is real. It is also the smallest of the three problems an operator has.

An enterprise migrating to post-quantum cryptography has an inventory problem. Find the keys, find the certificates, find the libraries and the hardware security modules, replace them in dependency order, and prove the replacement worked. Operators have that problem too, at a larger scale. They also have two problems that most enterprises don’t. Most of their cryptography is implemented by someone else, in firmware they cannot patch. And nearly every cryptographic relationship they hold has a counterparty they do not employ, do not own, and often cannot compel.

This article walks that difference for network architects. What the inventory actually contains, why the negotiation problem sets the schedule rather than the engineering, where the byte counts genuinely bite, and how to sequence work that will outlast several planning cycles.

The Algorithms, Briefly

NIST finalized three post-quantum standards in August 2024. FIPS 203 specifies ML-KEM, a key encapsulation mechanism formerly known as Kyber. A KEM is the mechanism two parties use to agree on a shared secret across an open channel, and it takes the place of the Diffie-Hellman exchanges that sit inside TLS and IKEv2 today. FIPS 204 specifies ML-DSA, a signature algorithm formerly known as Dilithium. FIPS 205 specifies SLH-DSA, a hash-based signature scheme formerly known as SPHINCS+, useful where a very conservative security assumption is worth a very large signature.

The sizes are the part architects need in working memory. ML-KEM-768 uses a 1,184-byte public key. An ML-DSA-65 signature runs to roughly 3.3 kilobytes against 64 bytes for ECDSA over P-256. The smallest SLH-DSA parameter set produces a signature of around 7.9 kilobytes. Every one of those numbers is fine on a server-to-server link with a large maximum transmission unit and no radio bearer underneath. Not all of them are fine everywhere in a telecom network.

Symmetric cryptography is the part that does not break. Doubling a symmetric key length restores the security margin against a quantum adversary, so the air interface ciphers degrade gracefully. The public-key mechanisms are the ones that fail outright, and they are the ones threaded through authentication, identity concealment, transport security, certificate enrollment, and code signing.

The Inventory Is Not Yours

Start with what a 5G network actually protects with public-key cryptography, and who would have to change each piece.

What it protects	Mechanism today	Who has to move first
Subscriber identity on the radio (identity concealment)	ECIES over Curve25519 or NIST P-256	3GPP, then the USIM supplier and the core vendor
gNB to core control and user plane (N2, N3)	IPsec with IKEv2, elliptic-curve key exchange	RAN vendor and core vendor, in step
Interfaces inside the 5G core (service-based architecture)	TLS 1.2 or 1.3, mutually authenticated	Every network function supplier
Roaming interconnect (N32, between SEPPs)	TLS, or the PRINS application-layer protocol	Both operators, plus the IPX carrier between them
IMS signalling and media	TLS for SIP, keying for SRTP	Session border controller and IMS vendors
Base station certificate enrollment	CMPv2 with RSA or ECDSA keys	RAN vendor and the operator’s certificate authority
Firmware and software integrity	RSA or ECDSA code signing	Every supplier, independently
Lawful intercept handover	TLS or IPsec to the receiving agency	LI vendor and the agency
OSS, BSS, partner APIs	TLS, token signing	Operator IT and every integrated partner

Three things are worth pulling out of that table.

SUPI concealment is a standards dependency, not an engineering choice. The SUPI is the permanent subscriber identifier, the 5G successor to the IMSI. Sending it in the clear over the radio is what allowed IMSI catchers to work, so 5G conceals it as a Subscription Concealed Identifier (SUCI) using an elliptic-curve integrated encryption scheme, with the public key provisioned onto the USIM and the private key held in the home network. Replacing that scheme with a post-quantum KEM is not something an operator can do unilaterally, because the concealment format is specified in 3GPP and implemented in a card an operator ships to customers. 3GPP’s security working group, SA3, has study work underway. Until it lands in a specification, the honest position for most operators is that SUCI concealment stays classical.

The service-based architecture multiplies the vendor problem. In a 5G core, network functions talk to each other over HTTP/2 with mutual TLS. A single operator’s core may contain functions from four or five suppliers. Post-quantum TLS is genuinely easy to enable when both ends support it. The difficulty is that both ends have separate roadmaps, separate release trains, and separate views on whether their customers are asking for this yet.

Code signing is the quietest item and the one with the longest tail. Every supplier signs its own firmware with its own key hierarchy, on its own schedule, using its own hardware root of trust. An operator can require post-quantum signing in a contract. It cannot deliver it.

Negotiated Cryptography

In an enterprise, most cryptographic decisions have one owner. In a network, most of them have two, and the weaker of the two sets the outcome.

TLS and IKEv2 both negotiate. When a network function that supports a hybrid key exchange meets one that doesn’t, they agree on the classical exchange, and the connection comes up. Nothing breaks, nothing alerts, and the operator has spent budget on a capability that is switched off by the peer. The inverse case is worse. Configure a node to require post-quantum key exchange before its peers can offer it, and the connection fails closed, which is exactly what the protocol should do and exactly what a change advisory board will not authorise twice.

Roaming makes this concrete. N32 is the interface between two operators’ security edge protection proxies, the SEPPs that sit at the boundary of each core network, usually with an IPX carrier providing the interconnect in between. A tier-one operator may hold several hundred roaming agreements. Every one of those is a bilateral cryptographic relationship with a partner running a different vendor stack on a different upgrade cycle in a different regulatory jurisdiction. There is no version of this where an operator finishes its roaming migration before its slowest partner does.

The precedent is IPv6. The specification dates to the mid-1990s. Dual-stack operation was designed as a transitional measure, and thirty years on, most large networks still run both, because a transition of this shape completes only when the last counterparty moves, and nobody controls the last counterparty. The parallel holds for hybrid cryptography with one difference in emphasis. Hybrid key exchange, which combines a classical exchange with a post-quantum one so that the session survives if either holds, is cheap to turn on and expensive to turn off. Turning it off is what eventually removes the classical exposure. Plan the switch-on with the switch-off already scheduled, or the network ends up in the IPv6 position: permanently transitional, permanently paying for two stacks, and permanently unable to say the migration is done.

That is where the parallel ends. IPv6 had no adversary collecting traffic for later. Post-quantum migration does, and the exposure is asymmetric: data captured today under classical encryption can be decrypted whenever a capable machine exists. This is the harvest now, decrypt later problem, and it applies hardest to traffic with long confidentiality requirements. For an operator, that means signalling that reveals subscriber identity and location, intercept material under retention obligations, and enterprise VPN traffic sold under multi-year contracts.

Where the Bytes Actually Hurt

Apologies in advance, this next part is the least interesting section of any migration plan and the one that decides its schedule. Four places in a carrier network where post-quantum object sizes stop being an academic point.

The USIM and its provisioning channel

The USIM is the application on the SIM card that holds subscriber credentials and the home network public key used for SUCI concealment. Cards have constrained memory and constrained processors, and the over-the-air provisioning channel that updates them was designed around small payloads. Pushing kilobyte-scale public keys to an installed base of tens of millions of cards is a different exercise from pushing a configuration change to a server fleet. For most operators the realistic path to post-quantum USIM credentials is card replacement on the natural churn cycle, which means the answer to “when is this done” is set by handset upgrade behaviour rather than by engineering.

Certificate enrollment at base stations

Base stations enroll for operator-issued certificates using CMPv2, the certificate management protocol profiled by 3GPP for exactly this purpose. It was not designed with multi-kilobyte keys and signatures in mind. A national RAN might contain tens of thousands of cells, each enrolling and renewing against a certificate authority, each carrying a chain that grows by several kilobytes per post-quantum signature in it. The protocol work is progressing in the IETF and in 3GPP. The operational question, which is separate, is whether the operator’s certificate authority, its renewal windows, and its management-plane bandwidth absorb a chain that has grown by an order of magnitude.

TLS handshakes and the equipment in the middle

A post-quantum ClientHello no longer fits in a single packet. That has two consequences architects should test for rather than assume. The handshake may spill past the initial congestion window, which adds a round trip on lossy or high-latency paths. And middleboxes that make assumptions about handshake size or about unrecognised parameters can drop the connection outright. Firewalls, load balancers, TLS-inspecting proxies and older SBCs are all candidates. Chrome’s rollout of hybrid X25519Kyber768 across 2023 and 2024 surfaced exactly this, with servers and middleboxes dropping connections once the ClientHello no longer fitted in one packet. The failure is ordinary rather than exotic, and it stays invisible until something in the path is exercised with a larger handshake, which is an argument for testing early against the real equipment rather than in a lab that contains only the new gear.

Long-lived signatures

SLH-DSA is the conservative choice for signatures that must remain trustworthy for decades, which describes firmware roots of trust reasonably well. Its smallest signatures run to about eight kilobytes. On a constrained device with a small secure boot partition, that is a hardware decision rather than a software one, and hardware decisions arrive with the next silicon generation.

The Fleet Problem

Enterprises replace laptops. Operators replace the cryptography inside equipment that belongs to their customers.

Customer premises equipment, meaning home gateways, business routers and fixed-wireless units, is bought in volume, deployed for years, and replaced when it fails or when a service changes. Handsets follow their own replacement cycle. IoT devices on a cellular plan may sit in a meter cabinet for a decade with no expectation of a firmware update. Each of these fleets has its own arithmetic, and none of that arithmetic is under the security team’s control.

Two implications follow. First, an operator’s honest migration plan contains a line saying which classical mechanisms will still be running in 2035 and why that risk is accepted. Older network generations are the obvious case. Retrofitting post-quantum cryptography into 4G is possible in places and unlikely to be worth it against a decommissioning date, but the decision should be written down as a decision rather than left as a gap.

Second, procurement is a security control here in a way it rarely is elsewhere. The requirement to write into every RFP and every renewal is not “supports post-quantum cryptography.” It is crypto-agility with dates attached: the algorithms the product supports today, the mechanism by which algorithms are added or removed without a hardware change, the release in which hybrid key exchange becomes available, and the release in which classical-only mode can be disabled. Suppliers answer the question they are asked. Asking for a checkbox produces a checkbox.

PKI at Carrier Scale

Operators run some of the largest private public-key infrastructures in existence, and most of them grew by accretion rather than design. Base station certificates, network function certificates, IMS element certificates, VPN credentials for enterprise customers, code signing hierarchies, subscriber authentication material, API tokens, and the certificate authorities behind each of them.

Migration touches four things at once.

Certificate formats and profiles. X.509 accommodates new algorithm identifiers, but the profiles in use across a carrier network were written against RSA and elliptic-curve key sizes. Hybrid certificates, carrying both a classical and a post-quantum key or signature, are still being settled in the IETF, and operators moving before that settles should expect to redo the work once.

Hardware security modules. The HSMs protecting root and issuing keys need firmware that implements the new algorithms and, in regulated contexts, certification against the new standards. HSM refresh cycles are long and the certification queue is not under anyone’s control. Of everything in this article, this is the item most likely to be the binding constraint on a 2028 target, and it is the one most often discovered late.

Key lifecycle tooling. During hybrid operation many entities hold two key pairs. Inventory systems, renewal automation, revocation distribution and audit reporting all need to represent that cleanly. Systems that assume one active key per identity will need changing, and they are usually the systems nobody has touched in five years.

Stateful signatures, if they appear. Some hash-based signature schemes are stateful, meaning a private key must never sign twice with the same internal state. Reuse is catastrophic rather than merely weakening. If any part of the estate adopts a stateful scheme, key management stops being an administrative function and becomes a correctness requirement with a specific failure mode. Most operators will avoid this. The ones that don’t should know before they do.

The prerequisite for all four is a cryptographic inventory that reaches into vendor products rather than stopping at the operator’s own code. That inventory is the first deliverable of any credible plan, and it takes longer than teams expect because a large share of the answers have to be requested from suppliers rather than discovered by scanning.

Lawful Interception

Lawful interception is the capability operators are legally required to provide so that authorised agencies can access communications or metadata under warrant. It rarely appears in migration plans, and it should.

Interception in a telecom network does not work by breaking encryption. It happens at a point inside the operator’s own infrastructure, where traffic is available to the operator anyway. Stronger transport cryptography does not obstruct it. What post-quantum migration does affect is the cryptography protecting the interception system itself.

The handover interface that carries warrant instructions and intercepted material from the operator to the agency is secured with TLS or IPsec. The internal interfaces between network functions and the mediation platform are secured the same way. The 5G interception architecture is specified in 3GPP TS 33.128, and the internal handover interfaces borrow ETSI’s X1, X2 and X3 structure. Every one of those links needs the same treatment as any other operator interface, with two aggravating factors. The counterparty on the handover interface is a government agency with its own procurement cycle and its own approval process. And intercept material is often retained for years, which places it squarely in the harvest now, decrypt later category.

An operator that migrates its core to hybrid key exchange while the handover link to an agency still runs classical elliptic-curve key exchange has moved its weakest point rather than removing it. Sequence the LI systems alongside the core, not after it, and open the conversation with the receiving agencies early, because that conversation has a longer lead time than any vendor discussion in this article.

Standards, Jurisdictions, and What Diverges

Three bodies set the pace for operators. 3GPP defines what the mobile specifications permit. ETSI’s quantum-safe cryptography work, in its Industry Specification Group on Quantum-Safe Cryptography (ISG QSC), produces the profiles and guidance that European deployments reference, and its lawful interception committee owns the handover interface structure described above. The GSMA’s Post-Quantum Telco Network Taskforce, formed in 2022, produces operator-facing guidance on inventory, risk assessment and migration sequencing, and acts as the channel through which operator requirements reach 3GPP and the IETF. Architects planning multi-year work should be reading all three rather than one.

Government direction is where a global operator’s problem gets genuinely awkward. The NSA’s CNSA 2.0 suite sets exclusive-use dates by category: 2030 for software and firmware signing and for traditional networking equipment, 2033 for web browsers, servers, cloud services and operating systems, and 2035 for national security systems as a whole (NSA, CNSA 2.0 FAQ, September 2022). Those dates propagate through suppliers who sell to government. European authorities have published coordinated migration timelines with their own milestones. Germany’s BSI recommends conservative parameter choices and takes a favourable view of FrodoKEM and Classic McEliece, neither of which NIST selected. France’s ANSSI has pressed for hybrid deployment rather than post-quantum-only for an extended period, on the reasoning that the new algorithms have not yet had enough cryptanalytic attention to stand alone.

For a group operating in fifteen countries, this is not a philosophical disagreement. It is a product requirement. Either the estate supports several algorithm suites and selects per market, which increases test surface and operational complexity, or the group standardises on the intersection of what every regulator will accept, which in practice means hybrid, high parameter sets, and higher overhead than any single jurisdiction demands. Most large operators will choose the second and should cost it accordingly.

A Sequence That Holds Up

The ordering below reflects what we teach operator teams, and it is deliberately conservative about what can be parallelised.

1. Inventory, including the vendor estate. Not just your own code and certificates. Written answers from each supplier on algorithms in use, agility mechanism, and roadmap dates.
2. Classify by exposure duration. Rank by how long the data must stay confidential, not by traffic volume. Subscriber identity signalling, intercept material and long-term enterprise contracts come first. Ephemeral management traffic comes last.
3. Fix procurement before fixing the network. Every contract signed with a classical-only requirement extends the tail by the length of that equipment’s life.
4. Migrate the interfaces you control on both ends first. Intra-core service-based interfaces, internal transport, your own OSS. These need no counterparty negotiation and they surface the middlebox problems early, while there is still time to work around them.
5. Open the bilateral conversations in parallel. Roaming partners, IPX carriers, interception agencies, large enterprise customers. These have the longest lead times and the least engineering content.
6. Follow 3GPP for the specified mechanisms. SUCI concealment and the authentication procedures move when the standard moves. Track the work, contribute requirements, and do not build a proprietary version you will have to unwind.
7. Schedule the switch-off with the switch-on. For every hybrid mode enabled, record the condition under which classical support is removed and who owns the decision. Without it, hybrid becomes the permanent state.

None of these steps is technically difficult on its own. The programme is difficult because the steps have different owners, different funding lines, and different clock speeds, and because the slowest of them determines when the operator can honestly report the work as complete.

Building the Team That Runs This

Operators who are making real progress tend to have the same asset: a small internal group that can read a 3GPP security specification, argue with a vendor about a roadmap date without being managed off the topic, and write a procurement requirement that survives contact with a supplier’s legal team. That combination is scarcer than the market assumes. Cryptography training generally produces people who understand algorithms. Telecom security training generally produces people who understand the architecture. This work needs both, plus the programme discipline to run a migration across a decade and several vendor generations.

Quantum Academy builds that combination directly. The post-quantum curriculum covers the NIST standards and their practical properties, cryptographic inventory methods, hybrid deployment and its operational costs, PKI and key management redesign, and the procurement and governance work that decides whether an engineering plan actually executes. It is written for practitioners who have to produce a defensible migration plan, not for an audience being introduced to the topic.

You can review the certification programs at quantumacademy.com/. For migration methodology in depth, the PQC Framework sets out the phased approach in full, and PostQuantum.com carries the deeper technical treatment of the telecom-specific challenges discussed here.