PQ Migration Workbench
Inventory your crypto, size the post-quantum swap, map NIST deadlines and export a plan.
Sizing your Harvest Window
Reading your saved inventory.
Years run left to right from today. Each bar is one row of your inventory: secrecy life plus migration time for data, migration time for signing keys. Red is what outlives your Q-Day. Grey lines are NIST IR 8547 or OMB dates. Click a bar to open the row; click empty space to clear. Your own inputs, stored in this browser.
The year a code-breaking quantum computer exists. Rankings ignore it.
Background readingPost-quantum cryptoSymmetric vs asymmetricThe TLS handshake
Your inventory
Migration order
Key and signature sizes
| Type | Standard and status |
|---|
Bytes. Category is the NIST post-quantum security category; classical schemes have none.
Handshake and cert chain calculator
TLS 1.3 bytes for one full handshake against packet and congestion window limits.
Assumed non-key bytes
Names, extensions and DER framing. Measure your own and adjust.
| Item | This setup | Classical |
|---|
Your rows against the deadline
| Data or system | Algorithm | Rule | Done by | Status |
|---|
Done by is today plus migration years. Set algorithms on the Inventory tab.
Transition timeline
NIST IR 8547 Tables 2 and 4
| Scheme | Use | Parameters | Transition |
|---|---|---|---|
| ECDSA | Signature | 112 bits or more | Deprecated after 2030, disallowed after 2035 |
| EdDSA | Signature | 128 bits or more | Deprecated after 2030, disallowed after 2035 |
| RSA | Signature | 112 bits or more | Deprecated after 2030, disallowed after 2035 |
| Finite field DH and MQV | Key establishment | 112 bits or more | Deprecated after 2030, disallowed after 2035 |
| Elliptic curve DH and MQV | Key establishment | 112 bits or more | Deprecated after 2030, disallowed after 2035 |
| RSA | Key establishment | 112 bits or more | Deprecated after 2030, disallowed after 2035 |
Every strength gets the same dates. Source: NIST IR 8547, section 4.1.
Migration plan
Priority takes the worse of harvest exposure and the deadline status.
| Next actions |
|---|
Where RSA and ECC live
0 of 10 inventoriedHow the workbench works
Harvest Window = x + y, or 0 when x is 0
Exposure ends = 2026 + x + y
Secrecy owed on Q-Day z = min(x, max(0, x + y − (z − 2026)))
Signing key start-by year = z − y
x is years the data must stay secret; y is years until migration completes. Signing keys face forgery from Q-Day on. CBOM import reads CycloneDX 1.6 cryptographic-asset components.
Standards and dates
Checked 3 Nov 2026| Standard | What it does | Status |
|---|---|---|
| ML-KEM (FIPS 203) | Key encapsulation from CRYSTALS-Kyber. NIST names ML-KEM-768 the default. | Final, 13 Aug 2024 |
| ML-DSA (FIPS 204) | Lattice signatures from CRYSTALS-Dilithium. | Final, 13 Aug 2024 |
| SLH-DSA (FIPS 205) | Hash-based signatures from SPHINCS+, the conservative backup. | Final, 13 Aug 2024 |
| FN-DSA (FIPS 206) | Compact lattice signatures from Falcon. | FIPS 206 in development |
| HQC | Code-based key encapsulation, a backup to ML-KEM. | Selected 11 Mar 2025; standard in development |
| LMS, XMSS (SP 800-208) | Stateful hash-based signatures for firmware and code signing. | Final, Oct 2020 |
| RFC 10024 | Hybrid TLS 1.3 key agreement, including X25519MLKEM768. | Standards Track, Aug 2026 |
| NIST IR 8547 | RSA, ECDSA, EdDSA, DH and ECDH at every strength: deprecated after 2030, disallowed after 2035. | Final, 27 Oct 2026 |
PQ migration FAQ
What is the Harvest Window?
Mosca's inequality in years: how long data must stay secret (x) plus how long you keep sending it under RSA or ECC (y). Records copied before migration ends matter until 2026 + x + y.
Why do signing keys have no Harvest Window?
A recorded signature has nothing to decrypt. The risk is forgery from Q-Day, so signing rows get a start-by year: Q-Day minus migration years.
Which Q-Day year should I pick?
Nobody can date it, so treat the slider as a sensitivity test; the ranking does not change. NIST IR 8547's 2035 cutoff is a common planning year.
What does NIST IR 8547 set for RSA and ECC?
RSA, ECDSA, EdDSA, finite field DH and elliptic curve DH at 112 bits or more: deprecated after 2030, disallowed after 2035.
How much bigger is a post-quantum TLS handshake?
X25519MLKEM768 key shares grow from 32 to 1,216 (client) and 1,120 (server) bytes. A full ML-DSA-65 chain can pass the 14,600-byte initial window and cost a round trip.
Is my inventory uploaded anywhere?
No. Rows, checklist and settings stay in local storage, and CBOM, CSV and JSON are handled in the page.
Lifetimes are planning figures. Q-Day is your assumption. Planning aid only.