up:: Quantum Risk Models MOC

The Two-Lane Split

The two-lane split is the triage rule that turns a post-quantum migration into two tracks moving at two speeds, because public-key cryptography does two different jobs and those jobs fail on two different schedules. Lane 1 is the urgent lane: key establishment protecting data with a long secrecy lifetime, which is exposed to harvest-now-decrypt-later collection today. Lane 2 is the deliberate lane: digital signatures and PKI, which fail only once a cryptographically relevant quantum computer exists, so they migrate on a planned track with a hard completion date. A third lane, monitor, holds symmetric encryption and hashing, which survive the quantum era with bigger parameters. The split is the first sort every cryptographic inventory feeds, and it’s what keeps a multi-year program from trying to boil the ocean.

The short version:

• Public-key cryptography does two jobs. It lets two systems that have never met agree on a secret key (key establishment), and it proves who signed what (signatures). A quantum computer breaks the math under both, and the two failures arrive on different schedules.
• Lane 1, urgent: key establishment guarding long-shelf-life data. It races a harvesting clock that started in the past, because traffic recorded today gets decrypted whenever the machine arrives, and traffic already recorded is beyond saving.
• Lane 2, deliberate: signatures and PKI. They race a forgery clock that starts the day a capable machine exists, so they migrate on a planned track. That track ends at a cliff: the day forgery becomes possible, every classical signing key is exposed at once.
• Monitor lane: symmetric encryption and hashing survive with larger parameters. AES-256 and SHA-384 are the standing answers, and the fix ships with normal refresh cycles.
• The lanes sort by clock. Blast radius ranks items within a lane, and Mosca’s theorem dates each item’s individual deadline.

Picture a facilities manager handed two building problems in the same week. Water is seeping into the records basement right now, so every day of delay ruins more of the archive, quietly and irreversibly. The seismic retrofit, meanwhile, guards against an earthquake that hasn’t happened yet: the building is fine today and fine tomorrow, but the retrofit takes years, and on the day the quake finally hits, an unfinished retrofit protects nothing. A sane manager pumps the basement first and schedules the retrofit with a completion date well ahead of the risk. Sorting the two is the whole discipline, because one problem is causing damage today and the other is a race you have to finish before a future event arrives.

What are the two lanes?

The split assigns every entry in a cryptographic inventory to one of three lanes based on which job the cryptography is doing and which schedule its failure follows. The lane decides the pace of the work; the ranking inside each lane comes later.

Lane	What lives there	The clock it races	Why it’s in this lane	First moves
Lane 1 · urgent	Key establishment protecting long-shelf-life data: the RSA key transport, Diffie-Hellman, and ECDH exchanges under TLS, VPNs, and SSH, plus RSA-wrapped keys sitting on stored data	A harvesting clock that started in the past; recorded ciphertext opens when the machine arrives	HNDL collection works today, and traffic already recorded is beyond saving	Inventory key establishment on long-lived data paths, replace it with ML-KEM (usually through a hybrid step), and rank the queue by data shelf life
Lane 2 · deliberate	Signatures and trust: ECDSA and RSA signing keys, certificate authority hierarchies, code signing, firmware signing, and identity-token signing	A forgery clock that starts the day a CRQC exists; zero accumulating exposure until then, and zero grace period after	A forgery must be committed live against a running system, so nothing an attacker records today helps them	Plan the signing and PKI migration to ML-DSA and SLH-DSA, start the longest-lead trust anchors first, and set completion ahead of any credible CRQC arrival
Monitor	Symmetric encryption and hashing: AES, SHA-2, SHA-3	A security margin to maintain rather than a countdown	Grover’s algorithm halves effective key strength, and a larger key restores it	Standardize on AES-256, retire AES-128 for decades-scale secrets, and keep an eye on the research

Source: NIST, “Module-Lattice-Based Key-Encapsulation Mechanism Standard,” FIPS 203, August 2024, csrc.nist.gov/pubs/fips/203/final; NIST, “Module-Lattice-Based Digital Signature Standard,” FIPS 204, August 2024, csrc.nist.gov/pubs/fips/204/final; NIST, “Report on Post-Quantum Cryptography,” NISTIR 8105, April 2016, csrc.nist.gov/pubs/ir/8105/final.

Three boundaries define where the split applies and where it stops:

1. It’s the first sort, run at the program level. The output is lanes, and a lane is a pace. Turning a lane into a ranked queue takes a second pass: data shelf life and blast radius inside Lane 1, blast radius and lead time inside Lane 2.
2. It sorts cryptographic functions rather than systems. A single protocol usually holds rows in more than one lane. TLS establishes session keys (Lane 1) and validates certificate signatures (Lane 2) in the same handshake, so the unit of triage is the job the cryptography performs, never the box it runs on.
3. It sets sequencing, and Mosca’s theorem sets deadlines. The split tells you which track an item rides; Mosca’s arithmetic (X + Y > Z) tells you whether that specific item is already late. The two work together, and neither replaces the other.

Why does public-key cryptography split into two lanes?

Because the same mathematics is doing two jobs with two different relationships to time, and the attack against each job has a different shape.

Job 1 is key establishment. Two systems that have never met agree on a shared secret over an open channel, using RSA key transport, Diffie-Hellman, or ECDH, and every byte of confidentiality in the session hangs on that agreed key. Shor’s algorithm running on a large enough quantum computer solves the underlying math and recovers the session keys.

Source: P. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,” SIAM J. Computing, 1997, quant-ph/9508027.

Job 2 is authentication. A signature made with a private key proves identity and integrity to anyone holding the matching public key: certificates, code signing, firmware, identity tokens. The same Shor’s algorithm computes the private signing key from the public one, which lets an attacker forge anything the key would sign.

The break is the same; the failure modes diverge on one question: can the attacker stage the attack before the machine exists?

1. For key establishment, yes. An adversary records encrypted traffic today, stores the ciphertext, and decrypts it years later once the key-establishment math falls. Confidentiality fails retroactively, reaching back to the day the traffic was captured. That staging is the entire mechanism of harvest now, decrypt later, and it makes the exposure a present-tense problem for any data whose secrecy must outlast the migration.
2. For signatures, no. A forgery has to be presented live to a verifier while the session or transaction is happening. Nobody retroactively forges a 2026 login in 2033, because the session ended years earlier. And the attacker’s raw material, the public key, is already published by design, so recording anything in advance buys them nothing. The forge-later attack waits entirely on the hardware.

That asymmetry is the whole derivation. One job’s exposure accumulates while you read this; the other job’s exposure arrives all at once on a future day. Two schedules, two lanes. NIST IR 8547 organizes the federal transition along exactly this functional line, treating key establishment and digital signatures as separate migration categories with their own tables.

Source: NIST, “Transition to Post-Quantum Cryptography Standards,” NIST IR 8547 (Initial Public Draft), November 2024, csrc.nist.gov/pubs/ir/8547/ipd.

Why is Lane 1 urgent today, before a quantum computer exists?

Because for Lane 1, collection and exploitation are separate events, and the collection half is available to any adversary right now. Recording encrypted traffic requires storage and patience rather than a quantum computer, and CISA, NSA, and NIST jointly warned in 2023 that “harvest now, decrypt later” operations mean data with a long secrecy lifetime is already exposed, which is why their guidance says the planning has to begin before the machine exists.

Source: CISA, NSA, and NIST, “Quantum-Readiness: Migration to Post-Quantum Cryptography,” joint factsheet, August 21, 2023, CSI_QUANTUM_READINESS_MIGRATION_TO_PQC.PDF.

The urgency has a sharp edge that changes behavior: migration protects traffic from the changeover date forward, and nothing protects traffic that was recorded before it. Every month of delay converts another month of long-lived secrets into ciphertext an adversary may already hold. That’s the meaning of “recorded traffic is already unrecoverable,” and it’s why Lane 1 ranks by data shelf life: a record that must stay confidential for 15 years is at risk from harvesting today, while a session token that expires in an hour carries almost none.

The full mechanics, the conditions that have to line up, and the historical precedent live in Harvest Now, Decrypt Later (HNDL), and the per-data-class urgency question, how long each kind of record actually has to stay secret, is The Shelf-Life Question with the exposure map in What Data Is Vulnerable to Harvest Now, Decrypt Later.

If signatures fail only later, why plan the migration now?

This is the timing layer of the split, and getting it right is what separates “deliberate” from “deferred.” Encrypted data races a harvesting clock: recordings accumulate value the longer they sit, so the damage compounds daily. Authentication races a forgery clock: a forgery must be committed live, so there’s no accumulating risk today, and also no grace period at the end. The day forgery becomes possible, every classical signing key you still operate is exposed at once, simultaneously, with nothing in between. The signature lane is deliberate, and it ends at a cliff rather than a runway.

Three facts turn that cliff into a present-day planning problem:

1. Signing and PKI migrations carry the longest lead times in the whole program. Moving a PKI means new trust stores, new roots, rebuilt certificate hierarchies, and vendor-controlled signing services, and migration duration scales hard with the size of the estate. Baseline estimates run 5 to 7 years for a small enterprise, 8 to 12 for a medium one, and 12 to 15 for a large one, with pessimistic cases at 8 to 10, 12 to 15, and 15 to 20+ respectively. A straight Mosca argument follows: if the migration takes longer than the runway to a credible CRQC, the deliberate lane is already late. For a large enterprise the baseline alone runs past the 2028–2033 arrival window those same estimates assume, so the lane is late before it starts.
2. The worst case is the biggest failure in the estate. A broken root certificate authority key makes every certificate beneath it forgeable at once, which is PKI Collapse, the highest-consequence outcome in the entire threat model. Deliberate pacing exists so that migration finishes before the cliff, with the highest-blast-radius anchors first.
3. The mandates themselves run the two lanes on a stagger. Executive Order 14412 requires federal high value assets and high impact systems to use post-quantum key establishment by December 31, 2030 and post-quantum signatures by December 31, 2031. The government’s own binding deadlines put key establishment a full year ahead of signatures, which is the two-lane split written into federal law.

Source: Michele Mosca, “Cybersecurity in an Era with Quantum Computers, Will We Be Ready?” IEEE Security & Privacy, 2018, ieeexplore.ieee.org. Migration-duration estimates by enterprise size from Robert Campbell, “Enterprise Migration to Post-Quantum Cryptography: Timeline Analysis and Strategic Frameworks,” Computers 2026, 15(1), 9, published 27 December 2025, doi.org/10.3390/computers15010009, Table 2. Campbell is an independent researcher; the paper declares no external funding and no conflicts of interest, and states that “no new data were created or analyzed in this study,” so the estimates are a synthesis of the literature rather than measured migrations. Size definitions are Campbell’s: small is ≤500 employees or within SBA small-business thresholds, medium is roughly 500 to 5,000 employees, and large is multi-jurisdictional with more than 5,000 employees. NIST’s own practice guide gives the qualitative anchor: “Previous initiatives to update or replace installed cryptographic technologies have taken many years,” NIST SP 1800-38, nccoe.nist.gov.

Source: Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks,” 91 FR 38483, June 25, 2026, federalregister.gov.

Deployment data now shows the two lanes running at those two speeds on public infrastructure, with the deliberate lane sitting at zero. An active scan of 4,665 UK organizations across 10 sectors on June 30, 2026 probed both the web and the email side of each estate and recorded the signature algorithm on every certificate it collected. 44.0% of the 4,063 reachable HTTPS endpoints negotiated a post-quantum key-exchange group. Of the 7,921 leaf certificates gathered across both protocols, every single one carried a classical signature algorithm, mostly SHA-256 with RSA, and no post-quantum certificate signature appeared anywhere in the sample.

Source: K. Loizou and E. Ghadafi, “Measuring Post-Quantum TLS Deployment Across UK Internet Sectors,” School of Computing, Newcastle University, arXiv:2608.02147, submitted August 3, 2026, arxiv.org/abs/2608.02147. A preprint rather than peer-reviewed work. The scan covers publicly observable HTTPS and SMTP endpoints of UK organizations on a single day, so it establishes a baseline and cannot establish a trend, and the commercial-sector samples are the first 500 eligible records from a company database rather than probability samples.

Breaking that scan out by industry sharpens the contrast, because the 2 lanes behave differently across sectors. Lane 1 varied a lot: web support ranged from 26.4% of reachable endpoints in the university sector (39 of 148) to 56.0% in government (255 of 455), a spread of 29.6 percentage points across the 10 measured sectors. Lane 2 varied not at all, sitting at 0 in every sector, because the whole 7,921-certificate sample carried 0 post-quantum signatures.

An uneven urgent lane beside a uniformly empty deliberate lane is what the split predicts. Lane 1 moves wherever a hosting provider flips a default, so it advances at whatever pace each estate’s providers set. Lane 2 waits on certificate authorities and trust stores, which no individual sector can move on its own, so it sits at the same place for everyone. Per-sector web rates are computable because the study published reachable endpoint counts per sector for the web; the same breakdown for email is unavailable, since it published mail support counts per sector without the matching reachable counts. The full per-sector table lives in Cloud and Browser PQC Status.

Read that as the sequencing being observed rather than as a verdict on any one organization. It says nothing about private PKI, internal trust stores, or pilots that never face the public internet, and a public certificate can only carry an ML-DSA signature once the certificate authorities and trust stores it depends on have moved, which is the long-lead work Lane 2 exists to schedule.

The full mechanism of the signature-side threat, including why nothing harvested in advance speeds it up, lives in Forge-Later Attack and Non-HNDL.

What happens to symmetric encryption and hashing?

They survive, and the monitor lane exists to keep that sentence honest. Grover’s algorithm gives a quantum attacker a square-root speedup on brute-force key search, which halves the effective strength of a symmetric key: AES-128 drops to roughly 64 bits of effective resistance while AES-256 retains roughly 128, which stays comfortably beyond any buildable machine. NIST assesses even that halving as conservative, because Grover parallelizes poorly and demands enormous circuit depth. The fix is a parameter, and CNSA 2.0 already writes it down for national-security systems: AES-256 and SHA-384.

Source: NIST, “Report on Post-Quantum Cryptography,” NISTIR 8105, April 2016, csrc.nist.gov/pubs/ir/8105/final; NSA, “Announcing the Commercial National Security Algorithm Suite 2.0,” CSA U/OO/194427-22, September 2022.

“Monitor” is a verb, though, and two live items justify it:

1. AES-128 on decades-scale secrets is the one symmetric change worth scheduling. Its post-Grover margin is the thin one, so long-lived archives standardize up to AES-256 during normal re-encryption cycles. Grover on AES carries the full arithmetic.
2. Quantum cryptanalysis of symmetric constructions is an active research field. In April 2026 a team including BSI researchers demonstrated a proof-of-concept hardware run of Simon’s algorithm against the Even-Mansour construction, a minimal cipher design, on a real quantum machine. That result says nothing about the security of AES, which rests on entirely different foundations, and it’s exactly the kind of movement the monitor lane exists to watch rather than panic over. Quantum Attacks Beyond Shor and Grover maps the wider family.

Source: Köhler, Murauer, Heine, Rosemann, and Hemmert, “Simon’s Algorithm for the Even-Mansour Cipher on Quantum Hardware,” 28 April 2026, arXiv:2604.25509. Authors are affiliated with the University of Oxford, the University of the Bundeswehr Munich, the German Aerospace Center (DLR), and Germany’s Federal Office for Information Security (BSI); key recovery was demonstrated for N = 3 and N = 4 on the ibm_miami processor.

How do you run the two-lane split on an inventory?

Take a generic mid-sized company: a customer-facing product, two data centers, a cloud footprint, an internal PKI, and roughly 10 cryptographic surfaces that a first-pass discovery effort would find. Here’s the sort, run end to end.

Inventory entry	Cryptographic job	Lane	Where it lands, and why
Customer API and web TLS carrying financial records	ECDH key exchange	1	Top of Lane 1. Regulated data with a 10-year-plus secrecy lifetime crossing collectible networks daily
Site-to-site VPN replicating databases between data centers	DH key exchange	1	High in Lane 1. Bulk long-lived records on a path a harvester would love
Backups whose data keys are wrapped with RSA-2048	RSA key transport at rest	1	High in Lane 1. A stolen backup is a harvest event; the AES payload holds, the RSA wrap around its key falls
Admin SSH into production	SSH key exchange	1	Lower in Lane 1. The mechanism is exposed and the session content is mostly short-lived
Marketing site TLS serving public content	ECDH key exchange	1	Bottom of Lane 1. Same vulnerable handshake, nearly nothing secret behind it
Internal root and issuing CAs (ECDSA)	Certificate signing	2	Top of Lane 2. Everything chains to it, and root rotation is the longest-lead item in the estate
Code-signing keys for shipped software	Code signing	2	High in Lane 2. A forged release signature becomes signed malware on every customer system
Identity-provider token signing (SAML, OIDC)	Token signing	2	High in Lane 2. One signing key mints tokens for every identity in the company
Employee passkeys (FIDO2)	Authentication signatures	2	Lower in Lane 2. Live-forgery surface with per-credential consequence
Databases and archives encrypted with AES-256, integrity on SHA-256	Symmetric encryption, hashing	Monitor	Holds with current parameters; one legacy AES-128 archive gets scheduled up to AES-256 at its next re-encryption cycle

Four things about the finished sort are worth noticing, because they’re the pattern every real estate repeats:

1. The same protocol shows up in both lanes. TLS contributed key-exchange rows to Lane 1 and its certificate chain to Lane 2, which is why the split sorts functions instead of systems.
2. Within Lane 1, shelf life sets the order. The customer API outranks the marketing site even though both run the identical handshake, because urgency belongs to the data, never to the protocol.
3. Within Lane 2, blast radius and lead time set the order. The root CA leads because everything trusts it and rotating it takes the longest, then code signing, then token signing.
4. The monitor lane still produced an action item. The AES-128 archive gets a scheduled, unhurried fix riding a refresh cycle, which is exactly the pace that lane is for.

The sort is deliberately cheap. A first pass over the crown-jewel scope takes days, and re-running it as discovery uncovers more surfaces costs almost nothing, which is what makes it the sort every inventory feeds rather than a one-time ceremony. Start a Migration sequences what happens after the lanes exist.

Common misconceptions

1. “Quantum breaks all encryption, so fix everything at once.” The threat is specific: public-key cryptography breaks, symmetric encryption and hashing survive with bigger parameters. A program that treats the whole estate as one undifferentiated emergency stalls under its own scope, and the stall is more dangerous than either threat. The split exists precisely so a multi-year effort has a defensible order.
2. “It’s decades away, so none of this is urgent.” The hardware timeline is the wrong measure for Lane 1. Harvesting works today, so the relevant deadline for long-lived data is its own shelf life, and that countdown started when the data first crossed a collectible path.
3. “Signatures first, because certificates are the cryptography we can actually see.” Visibility is an artifact of tooling. Certificate expiry dashboards make Lane 2 conspicuous while Lane 1’s harvesting exposure generates no alerts at all, so teams gravitate to the lane with the dashboards. The urgent lane is the invisible one, which is exactly why it gets missed.
4. “Symmetric is dying too, so AES needs replacing.” Grover halves effective key strength and a bigger key restores it. AES-256 retains roughly 128 bits of effective resistance, NIST calls even that estimate conservative, and CNSA 2.0 keeps AES at the heart of national-security systems. Symmetric panic misdirects budget away from the lanes that need it.
5. “Lane 2 means it can wait.” Deliberate describes the pacing discipline, and Lane 2 holds the longest lead times in the whole program: root rotations, trust-store distribution, vendor signing services. A deliberate lane started late arrives at the cliff mid-migration, which converts the most consequential failure in the estate (PKI Collapse) from a managed risk into a scheduled one.
6. “The lanes are importance rankings.” They’re clock assignments. The root CA in Lane 2 can be the single most consequential item in the estate; its lane says when its failure mode arrives, and blast radius says how much it matters relative to its lane-mates.
7. “We deployed hybrid key exchange, so Lane 1 is done.” Hybrid is the transition vehicle, and it protects traffic from the changeover forward. Lane 1 finishes when every long-lived data path negotiates post-quantum key establishment, and even then, traffic recorded before the change stays exposed forever. The coverage gap inside Lane 1 is measurable: among 3,510 UK organizations reachable over both web and email in the June 2026 scan, 1,419 negotiated a post-quantum group on HTTPS while negotiating none on their mail path, and only 144 managed both. Web support ran 16.89 times more likely than email support on the same estates, so a Lane 1 status read from the web alone overstates where the estate actually is.
8. “Our vendor’s post-quantum roadmap covers us.” Roadmaps routinely cover one lane and stay silent about the other, because ML-KEM support in a network product says nothing about the signing service, and vice versa. A roadmap that names one lane has answered half the question. Vendor-Controlled Crypto Surfaces covers the surfaces you can ask about and the ones you can only wait on.

Pro tips

1. Put the lane in the risk register. Each system’s row in The Cryptographic Risk Register carries its lane assignment right next to its two dates, the mandate deadline and the threat-exposure date (The Two-Clock Test is the tool for stating those two dates cleanly). Written down that way, the triage survives staff turnover and reads correctly in an audit.
2. Blast radius ranks within lanes, never across them. Comparing a Lane 1 item against a Lane 2 item by consequence alone re-scrambles the clocks the split just separated. Sort into lanes first, then let blast radius and shelf life order each lane internally.
3. Get shelf life from the business owner, never the security team. Security teams answer with the retention policy, which measures how long you must keep a record. The lane assignment needs how long it must stay secret, which is a different number with a different owner. The Shelf-Life Question is the exact question to ask.
4. Let the lane script your vendor conversations. A Lane 1 conversation asks for the date ML-KEM ships inside the product’s key exchange. A Lane 2 conversation asks for the ML-DSA signing roadmap and the trust-store plan. When a vendor answers “we support post-quantum” without naming a lane, the follow-up is one sentence: “key establishment or signatures, and which date belongs to which?”
5. When an item resists lane assignment, split the row. Resistance almost always means the entry describes a system doing both jobs. TLS, IPsec, and SSH each establish keys and authenticate endpoints, so give each function its own row and the ambiguity disappears.
6. Re-run the sort as discovery continues. The first pass covers the crown jewels; every subsequent discovery sweep feeds new rows into an existing structure instead of forcing a re-plan. The lanes are stable even while the inventory underneath them grows.

Where does the two-lane split break?

Published limits, because a triage rule you can’t break is a triage rule you haven’t tested:

1. Signing keys on long-lived field devices. A firmware trust anchor sealed into a device with a 15-year service life is Lane 2 by mechanism, since forging its signature still requires a live machine. It carries Lane 1 urgency anyway, because the fix rides the device’s replacement cycle, and a 15-year lead time consumes any credible runway to a CRQC. Run Mosca’s arithmetic and the start date is now. This is the exception that proves the shelf-life rule: the lanes were never really sorting by attack mechanics, they were sorting by whether your window to act is closing, and for a sealed signing key the window closes on the day the last feasible replacement cycle begins. PQC in Firmware and Code Signing and Constrained-Device PQC carry the depth.
2. The split produces lanes, and a lane is still a pile. Turning a lane into a migration queue takes the second sort keys, shelf life and blast radius, and turning the queue into a program takes owners, budget, and dates. Teams that stop at the split have a taxonomy rather than a plan.
3. Estates with no long-lived confidential data. Where nothing needs secrecy beyond a year or two, Lane 1 loses its present-tense edge and both lanes converge into ordinary lead-time planning. In practice this describes almost nobody, because payroll, legal, personnel, and the key material itself all carry long lifetimes, but the boundary is worth stating.
4. Lanes applied to whole systems misfile everything. The unit of triage is the cryptographic function. Apply the split at the system level and TLS lands in one lane, which is wrong in both directions at once.

How do you use the two-lane split in the boardroom?

The split’s board value is that it converts “quantum risk” from a vague line item into two tracks with different dates, different budgets, and an honest answer to the question every director eventually asks: are we exposed right now? The deployable version fits in three sentences. “Our encryption does two jobs on two schedules. The key-exchange half protecting our long-lived data is exposed to harvesting today, so it runs as the urgent track. The signature half fails only when the machine arrives, so it runs as a planned track with a completion date ahead of that arrival.”

It also arms you against the two mis-sequenced pitches that recur in board settings:

1. The certificate-first pitch. When a vendor or a director proposes leading with certificates because auditors see them, the split is the two-sentence answer: certificate failure waits on the machine, harvesting works tonight, and the program’s order should follow the exposure rather than the dashboard.
2. The compliance-equals-safety pitch. The federal government’s own binding deadlines stagger the lanes, key establishment by the end of 2030 and signatures by the end of 2031 under Executive Order 14412, so the split has a citable federal precedent when someone asks why your two tracks carry two dates.

Source: The White House, “Securing the Nation Against Advanced Cryptographic Attacks,” presidential action, June 22, 2026, whitehouse.gov.

One level up, the split is also how you brief a board member who arrived with “quantum breaks everything” from a headline. Handing them the two-jobs distinction upgrades the room’s whole conversation, because a director who can ask “which lane does this affect?” has become an asset to the program instead of a source of panic budget.

Questions people ask

What should we migrate to post-quantum cryptography first, key exchange or signatures? Key establishment on long-shelf-life data paths moves first, because harvesting exposes that traffic today and recorded ciphertext is beyond recovery. Signatures and PKI follow on a planned track that must still complete before a capable machine arrives. The federal deadlines under EO 14412 run the same order, key establishment by end of 2030 and signatures by end of 2031.

Why is key establishment more urgent than signatures? An adversary can record encrypted traffic today and decrypt it when a quantum computer arrives, so the exposure on long-lived data accumulates every day. A signature forgery has to be committed live against a running system, so nothing an attacker records now advances it. One risk compounds in the present; the other waits on hardware.

Are attackers harvesting my signatures the way they harvest my data? No. Forging a signature requires the private key, which a future quantum computer derives from the public key, and the public key is already published by design. Recording signatures or signed traffic in advance buys an attacker nothing, which is the core difference the forge-later attack note takes apart.

Does the deliberate lane mean signatures are safe until Q-Day? It means the risk arrives later, and the work still has to start early, because signing and PKI migrations carry the longest lead times in the program, with baseline estimates of 5 to 7 years for a small enterprise, 8 to 12 for a medium one, and 12 to 15 for a large one. The lane ends at a cliff: the day forgery becomes possible, every classical signing key is exposed simultaneously, so the planned track must finish before that day.

Do I need to replace AES? No. AES survives the quantum era; Grover’s algorithm halves its effective key strength and a larger key restores the margin. Standardize on AES-256 for long-lived secrets, schedule any remaining AES-128 up during normal refresh, and treat the symmetric layer as part of the solution rather than the problem.

Which lane is TLS in? Both, and that’s the point of sorting by function. The handshake’s key exchange belongs to Lane 1 and moves to hybrid post-quantum groups, while the certificate chain’s signatures belong to Lane 2 and follow the PKI migration. One protocol, two rows, two schedules.

How do the lanes map to the NIST standards? Lane 1 migrates key establishment to ML-KEM (FIPS 203). Lane 2 migrates signatures to ML-DSA (FIPS 204) or SLH-DSA (FIPS 205). The monitor lane keeps AES-256 and SHA-384, the parameters CNSA 2.0 already mandates for national-security systems.

Does the two-lane split replace Mosca’s theorem? They do different work. The split is the program-level sort that sets each item’s pace, and Mosca’s theorem is the per-item arithmetic that dates its deadline. The lanes even tell Mosca’s X which lifetime to use: secrecy lifetime for Lane 1 items, required trust lifetime for Lane 2.

Is anybody actually running the two lanes at different speeds? Public measurement says yes, and on public infrastructure the deliberate lane has not started. A scan of 4,665 UK organizations on June 30, 2026 found 44.0% of reachable HTTPS endpoints negotiating a post-quantum key-exchange group, and zero post-quantum certificate signatures across all 7,921 certificates it collected. Lane 1 is visibly in motion, and Lane 2 remains classical wherever a public scanner can see it.

Where does the split come from, organizationally? It falls out of the inventory. Run discovery, build the CBOM, and the split is the first question you put to every row: which job, which schedule. That’s why it’s the first sort every inventory feeds, and Start a Migration picks up the sequencing from there.

---

Everything here is the map, given freely. The two-lane split quantified against your own estate, with your own shelf lives, your own trust anchors, and dates a regulator would accept, is the work I do. Request the workshop.

Last verified 2026-08-10 · Updated 2026-08-25 · Maintained by Addie LaMarr, LaMarr Labs.