PQC Migration: Technical Architecture & CBOM
Every cryptographic migration fails if it starts with algorithm replacement instead of asset discovery. In large banking architectures, cryptographic primitives are embedded across legacy COBOL runtimes, Java microservices, API gateways, database encryption layers, and third-party vendor appliances.
The Six-Stage Migration Lifecycle
- Automated Discovery & CBOM Synthesis: Generate a CycloneDX 1.6 Cryptographic Bill of Materials covering all active keys, certificates, algorithms, and cryptographic dependencies.
- Exposure & Risk Prioritisation: Score every cryptographic asset against data confidentiality longevity requirements (e.g. 10-year mortgages vs. sub-second quotes).
- Hybrid TLS 1.3 Gateway Deployment: Establish dual-mode TLS tunnels combining classical ECDHE (X25519) with post-quantum ML-KEM-768 (FIPS 203).
- Hardware Security Module (HSM) Firmware Modernisation: Transition key generation and storage pipelines to FIPS 140-3 validated HSMs capable of handling lattice-based keys.
- Payment Rail Envelope Re-engineering: Update ISO 20022 message parsers and digital signature verifiers to process ML-DSA-65 (FIPS 204) signatures.
- Continuous Cryptographic Regression Testing: Automate CI/CD verification to prevent accidental introduction of deprecated asymmetric algorithms.
Standardized NIST PQC Algorithms
| Standard | Algorithm | Function | Key Size | Banking Use Case |
|---|---|---|---|---|
| FIPS 203 | ML-KEM (Kyber) | Key Encapsulation | 800–1,568 B | Session keys, TLS 1.3 tunnels, API encryption |
| FIPS 204 | ML-DSA (Dilithium) | Digital Signatures | 1,312–2,592 B | SWIFT transaction signing, wire authorisations |
| FIPS 205 | SLH-DSA (SPHINCS+) | Stateless Signatures | 32–64 B keys / 7–49 KB sigs | Root CAs, firmware signing, long-term archiving |