From Standards to Systems: A Crypto-Agility Framework for Post-Quantum Cryptography Migration in Enterprise and Internet Infrastructure

Abstract

Background: In August 2024, the U.S. National Institute of Standards and Technology (NIST) finalized the first three post-quantum cryptography (PQC) standards — FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) — and, in November 2024, published the initial public draft of NIST IR 8547, which schedules the deprecation of classical public-key cryptography by 2030 and its disallowance after 2035. Organizations therefore face, for the first time, a regulator-defined deadline for a global cryptographic transition. Objective: This paper characterizes the state of PQC deployment as of the end of 2024 and develops a structured, reusable migration framework that converts the new standards into an actionable organizational process. Methods: We apply a design-science methodology combining (i) documentary analysis of the 2024 standards and transition guidance, (ii) a structured synthesis of publicly documented, at-scale PQC deployments in transport, messaging, and shell protocols during 2022–2024, (iii) characterization of wire-size and throughput overheads using published benchmark data, and (iv) construction and cross-validation of a five-phase Crypto-Agility Migration Process (CAMP) against NIST transition guidance and NCCoE migration practices. Results: Deployment evidence shows that hybrid key establishment (X25519 + ML-KEM-768) is already operational at Internet scale, adding approximately 1.2 KB to the TLS 1.3 handshake with negligible latency impact, whereas post-quantum signatures remain the dominant constraint (ML-DSA-65 signatures are 3309 bytes versus 256 bytes for RSA-2048). We identify four systemic migration bottlenecks — FIPS validation lead times, embedded device lifecycles, PKI signature-size pressure, and organizational cryptographic invisibility — and operationalize CAMP to address them, anchoring prioritization in Mosca's inequality and the 2030/2035 deadlines of NIST IR 8547. Conclusions: The 2024 finalization of the PQC standards transforms post-quantum readiness from a research question into an engineering and governance problem. Organizations that establish cryptographic inventory, hybrid piloting, and crypto-agile library interfaces during 2025 will be positioned to meet the 2030 deprecation horizon; organizations that do not will face compressed, higher-risk migrations later in the decade.