Migrating Software Systems towards Post-Quantum-Cryptography -- A Systematic Literature Review

TL;DR

This systematic review analyzes current approaches and challenges in migrating networks to post-quantum cryptography, highlighting inconsistencies, real-world implementations, and the need for standardized practices in this evolving field.

Contribution

It provides a comprehensive overview of migration processes, identifies key phases and roles, and highlights challenges and the state of standardization efforts in PQC migration.

Findings

Identified four major phases in PQC migration process.

Reported diverse PQC implementations and hybrid solutions in real-world cases.

Highlighted challenges such as high effort, security concerns, and complexity.

Abstract

Networks such as the Internet are essential for our connected world. Quantum computing poses a threat to this heterogeneous infrastructure since it threatens fundamental security mechanisms. Therefore, a migration to post-quantum-cryptography (PQC) is necessary for networks and their components. At the moment, there is little knowledge on how such migrations should be structured and implemented in practice. Our systematic literature review addresses migration approaches for IP networks towards PQC. It surveys papers about the migration process and exemplary real-world software system migrations. On the process side, we found that terminology, migration steps, and roles are not defined precisely or consistently across the literature. Still, we identified four major phases and appropriate substeps which we matched with also emerging archetypes of roles. In terms of real-world migrations, we see that reports used several different PQC implementations and hybrid solutions for migrations of systems belonging to a wide range of system types. Across all papers we noticed three major challenges for adopters: missing experience of PQC and a high realization effort, concerns about the security of the upcoming system, and finally, high complexity. Our findings indicate that recent standardization efforts already push quantum-safe networking forward. However, the literature is still not in consensus about definitions and best practices. Implementations are mostly experimental and not necessarily practical, leading to an overall chaotic situation. To better grasp this fast moving field of (applied) research, our systematic literature review provides a comprehensive overview of its current state and serves as a starting point for delving into the matter of PQC migration.