Secure the Sanctum. Guard the future.

Product entry points: CygnetSSL / Cygnus CloudFoundry API. The company site never stands in for an API, a research environment or an operator console. Full host-by-host responsibilities: directory.

1. 01

   Observe before you migrate

   You cannot rotate what you cannot see.

   Build the cryptographic inventory first: every key-establishment and signature use across hosts, certificates, protocols, firmware and vendor products. Federal guidance makes the inventory the first deliverable, and the readiness-gaps draft records exactly which observability signals operators lack today.

   OMB M-23-02Quantum-Readiness: Migration to Post-Quantum Cryptography (CISA/NSA/NIST factsheet)NIST SP 1800-38 (preliminary draft)draft-vicente-pquip-pqc-readiness-gaps

2. 02

   Price the harvest-now, decrypt-later exposure

   Confidentiality is already at risk; authentication is not yet.

   Rank data by how long it must stay secret against how long migration takes. Traffic captured today under RSA or ECDH key exchange is decryptable the day a cryptographically relevant quantum computer exists, so long-lived secrets move first and signatures can follow on a planned schedule.

   Quantum-Readiness: Migration to Post-Quantum Cryptography (CISA/NSA/NIST factsheet)EBSCO: Vermeer 2023EBSCO: Caldeira & Sabino 2024EBSCO: Mahesh & Mishra 2025

3. 03

   Replace key establishment with hybrid ML-KEM

   Hybrid first, so a defect in either half does not strip the channel.

   ML-KEM (FIPS 203) combined with ECDHE in TLS 1.3, SSH and IKEv2 closes the harvest window without betting everything on one new primitive. Published implementation studies in industrial and constrained environments show the handshake and bandwidth costs are measurable and manageable.

   FIPS 203draft-ietf-tls-ecdhe-mlkemEBSCO: Paul et al. 2022EBSCO: Rakesh Singh & Hemalatha 2026EBSCO: Horbenko & Kandiy 2025

4. 04

   Move authentication and the PKI underneath it

   Signatures, certificates and issuing CAs change together or not at all.

   ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) enter through composite certificates, CA-side rotation commitments and ACME profiles that can state post-quantum posture per order. Multi-tenant platforms need explicit rotation requirements so one tenant’s migration never degrades another’s trust.

   FIPS 204FIPS 205draft-ietf-lamps-pq-composite-sigsdraft-vicente-lamps-rotation-envelopedraft-vicente-acme-pqc-agility-profiledraft-vicente-pquip-multitenant-pki-requirements

5. 05

   Bind authorisation to the new trust

   A post-quantum certificate means little if the token it protects is checked once.

   Re-evaluate the client certificate, access token and session posture together on every transaction, so rotation at the PKI layer is enforced at the application layer instead of trusted on issuance.

   draft-vicente-oauth-apm

6. 06

   Treat QKD as a link technology, not a substitute

   QKD distributes keys; it cannot say who is on the other end.

   Quantum key distribution still needs classical or post-quantum authentication, dedicated optics and trusted repeaters whose security reduces to the node operators. NSA does not recommend it for National Security Systems; it belongs, if anywhere, inside a PQC-authenticated architecture.

   Quantum Key Distribution (QKD) and Quantum Cryptography (QC)EBSCO: Salvail et al. 2010EBSCO: Dewan & Deokar 2025

7. 07

   Engineer for the next rotation

   Deprecation after 2030 and disallowance after 2035 are the floor, not the plan.

   Crypto-agility is the operational capability to re-run steps 03 to 05 without a programme. Pin algorithms in policy rather than code, record every state change as evidence, and read security proofs critically — the literature’s own history of “another look” papers is the argument for hybrids and for agility.

   NIST IR 8547 (initial public draft)Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)EBSCO: Bhatnagar et al. 2025EBSCO: Koblitz & Menezes 2019