Marin Ivezic
In August 2024, NIST published three finished post-quantum standards: ML-KEM (formerly CRYSTALS-Kyber) for key establishment, ML-DSA (formerly CRYSTALS-Dilithium) and SLH-DSA (formerly SPHINCS+) for signatures. Choosing algorithms is no longer the hard part for a carrier. The hard part is that in most operator organizations, no single person can look at a network diagram and say which lines on it depend on RSA or elliptic-curve cryptography, which of those carry data with a long confidentiality life, and which of them the operator can change without a vendor’s permission.
That is the real starting condition, and it explains why so many programs stall in month three. This piece describes what we think the first move should be, and why it is a capability decision rather than a tooling decision.
The gap between the scan and the plan
Most quantum readiness programs open with discovery. Scanners crawl the estate and produce a cryptographic bill of materials, or CBOM: a structured inventory of the cryptographic assets in a system, listing algorithms, key lengths, protocols, certificates, and the places each one is used. It borrows its shape from the software bill of materials (SBOM), which lists components rather than cryptography. The format is real and available; CycloneDX supports cryptographic asset types.
Then the output lands, and it is a very long list with no priority order attached. A scanner can tell you that an interface negotiates TLS 1.2 with an elliptic-curve key exchange. It can’t tell you whether that interface carries subscriber identifiers with a twenty-year confidentiality life, whether the vendor can ship a hybrid key exchange in a supported release, or whether changing it depends on a 3GPP specification that doesn’t exist yet. Those three judgments are human, and they are the ones that turn an inventory into a plan.
Priority in particular isn’t a technical property of the finding. It follows from data lifetime, because of harvest now, decrypt later: an adversary records encrypted traffic today and stores it, expecting to decrypt it once a cryptographically relevant quantum computer exists. A session key that expires in an hour is a weak target. An identifier that stays valid for the life of a subscription is a strong one. Nobody can make that call from a scan report alone.
A worked example from the 5G core
Take one line that will appear in almost every carrier CBOM, and follow it out.
In 5G, the permanent subscriber identifier is not sent over the air in the clear. The SUPI, or subscription permanent identifier, is encrypted by the handset into a SUCI, the subscription concealed identifier, using the home network’s public key stored on the SIM. The scheme is ECIES, the elliptic curve integrated encryption scheme. 3GPP TS 33.501 defines two non-null concealment profiles. Profile A uses Curve25519 and Profile B uses secp256r1. Both are elliptic curve, so both are exposed to Shor’s algorithm, which lets a large enough quantum computer solve the discrete-logarithm and factoring problems that elliptic-curve cryptography and RSA rest on.
One line in the inventory, and acting on it needs four separate pieces of knowledge.
Where the key lives. The concealment public key sits on the SIM. Changing it is a SIM estate exercise with a device tail behind it, not a software patch to a network function. That single fact changes the cost and the timeline by orders of magnitude.
How long the secret has to hold. A subscriber identifier persists. Traffic captured today still points at the same subscriber years from now, which puts concealment high on any list ordered by data lifetime.
What is not affected. Subscriber authentication itself, 5G-AKA, rests on a symmetric key shared between the SIM and the home network. Shor’s algorithm doesn’t break it. Grover’s algorithm offers a speedup against symmetric keys, and the standard response there is key length rather than algorithm replacement. Teams that miss this distinction spend budget re-engineering the part that is already fine, which is a common and expensive mistake.
Who can actually fix it. A post-quantum or hybrid concealment profile has to be specified in 3GPP, then implemented by SIM vendors, then supported across a device population the operator does not own. The operator’s job here is influence and sequencing, not engineering.
Now multiply that by every interface in the service-based architecture, every IPsec tunnel between sites, every certificate in the OSS and BSS layers, and every management plane login. The inventory is long. The reasoning is the scarce resource.
The five readers a carrier needs
A CBOM becomes a roadmap when five people can read it together and disagree productively. In our experience these are the roles, and the gap is usually that two or three of them have never been in the same room on this topic.
The network architect maps a finding onto a real interface and names the specification, the release, and the vendor that owns it. Without this, findings float free of the network they came from.
The PKI and key management lead owns certificates, hardware security modules (HSMs), issuance hierarchies, and key lifetimes. This role answers the question everything else depends on: can the existing issuing hierarchy carry a second algorithm at all? Crypto-agility, meaning the ability to change algorithms without redesigning the systems built around them, is won or lost here rather than in the radio network.
The vendor manager turns a finding into a contract question. Which release, what test evidence, what happens if the date slips, and is the roadmap commitment written anywhere binding. This role needs enough cryptography to tell a real answer from a brochure, and that is a training gap far more often than a competence gap.
The risk and compliance lead connects findings to obligations and sets the data-lifetime thresholds that drive ordering. NSA’s Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) sets a transition timeline for national security systems, which matters to any operator with government customers. Sector regulators are adding their own dates.
The executive sponsor funds a decade rather than a quarter, and holds the line when the second year produces no visible feature.
What the 2G sunset already taught carriers
Operators have run an estate-wide, vendor-gated, multi-year technology swap before. Shutting down 2G and 3G took years, ran market by market, and slipped repeatedly. The delays were rarely radio engineering, which was understood from the start. They came from what was still attached to the old network: alarm panels, lift emergency phones, payment terminals, vending machines, fleet telematics, and a long tail of embedded modules that nobody had inventoried because nobody had needed to. Several of those devices outlived the companies that made them.
Post-quantum migration has the same shape. The core network work is visible, plannable, and comparatively well understood. The tail is embedded certificates and hard-coded algorithms in equipment that has no current product manager, and the tail sets the completion date. Carriers that learned this the first time can apply it directly: inventory the tail early, because the tail is the schedule.
Sequencing the first ninety days
- Name the owner and the sponsor. One accountable owner, one funded sponsor, both written down.
- Bring the five roles to a shared baseline. They need the same vocabulary, the same threat model, and the same understanding of what a CBOM entry means before the first scan runs.
- Inventory one domain end to end. The externally facing PKI is a good candidate, because it is bounded and the findings are immediately actionable. Learn what discovery costs at small scale before committing to the estate.
- Write the prioritization rule before the data arrives. Agree the data-lifetime thresholds now. Doing it afterwards means arguing about them with ten thousand findings on the table.
- Put crypto-agility into procurement immediately. Every contract signed this year should require algorithm change without hardware replacement, and evidence that the vendor has tested it.
Nothing on that list requires a quantum computer to exist, a 3GPP release to land, or a budget cycle to turn. Steps one, two, four, and five are almost entirely organizational.
Building the capability
Quantum readiness in a carrier is a coordination problem wearing a cryptography costume. The technical decisions are real, but they are made by a group of people who mostly don’t share a background, and the programs that move are the ones where that group was trained together before the discovery phase, not during it.
That is the gap Quantum Academy’s certification programs are built to close: a common baseline across network, PKI, vendor management, risk, and leadership, so that a shared inventory produces a shared plan. You can review the current certification paths at quantumacademy.com/.
For migration methodology in more depth, the PQC Framework sets out the phase structure and governance model. For the underlying analysis this article draws on, including the wider view of where cryptography sits in a telecom estate, see Marin Ivezic’s telecom quantum readiness overview on PostQuantum.com.