Bootstrapping PQC on Existing Hardware: A Three-Stage Migration Framework

The transition to post-quantum cryptography requires more than replacing algorithms. Public-key cryptography is deeply embedded in device identity, secure boot, code signing, certificate issuance, software delivery, and credential lifecycle management. For long-lived connected and industrial devices, immediate hardware replacement is often neither financially nor operationally practical.

This presentation presents a three-stage migration framework for introducing PQC into existing device platforms while preserving current hardware roots of trust. In the first stage, symmetric cryptography and existing protected key storage are used to maintain secure boot and establish a trusted execution environment. In the second stage, that environment is used to generate, provision, and protect PQC credentials on the device. In the third stage, PQC credentials and the established boot chain are used to authenticate and deploy quantum-safe applications and software updates.

The session will examine how this staged approach applies to constrained embedded devices and large, mixed-generation fleets. It will also address the operational challenges that determine whether such a migration can scale, including cryptographic agility, key protection, credential lifecycle management, rollback, code-signing evolution, and coexistence between classical and PQC-capable devices.

The framework is based on practical experience designing PKI, secure boot, code-signing, and device-identity infrastructures for large populations of connected devices. It is intended for organizations that must begin PQC adoption before PQC-optimized hardware is broadly deployed. Attendees will leave with a concrete migration model for using existing hardware security capabilities to bootstrap PQC, introducing PQC credentials without replacing the entire installed base, and evolving PKI, secure boot, and software-signing infrastructures toward fully quantum-ready platforms.