HAPKIDO Handbook: Navigating the Transition to Quantum-Safe PKI

PKIs operate on the assumption that trusted credentials remain unforgeable over their lifetime. Advances in quantum computing challenge this premise: credentials trusted today may become forgeable in the future, introducing a "trust now, forge later" risk that directly impacts the integrity of digital identities and trust anchors.

For PKI-dependent ecosystems, migration is not just a cryptographic upgrade problem. Long-lived certificates, complex trust hierarchies, and cross-sector dependencies mean that failures can propagate systemically, affecting entire digital trust ecosystems. Yet progress toward quantum-safe PKI remains fragmented, slowed by uncertainty around standards, timelines, and ownership. The HAPKIDO societal impact assessment shows that compromised PKIs could trigger cascading failures across sectors, from disruption of public services to economic instability in banking systems.

This talk presents the HAPKIDO Handbook, which provides a consolidated, research-based framework to guide organisations and policymakers through the transition to quantum-safe PKI. It combines technical insights, governance perspectives, and societal risk analysis into a unified approach, with two main goals: raising awareness and providing actionable insights to support decision-making.

The handbook presents two key contributions: a societal risk assessment method that translates abstract quantum threats into concrete organisational and societal risks, enabling prioritisation of critical assets and services; and a five-stage growth model guiding organisations from awareness to full ecosystem adaptation, emphasising the need for coordinated action across organisational and sectoral levels. Together, these frameworks position the transition not as a technical upgrade, but as a multi-actor transformation requiring alignment across ecosystems.

The handbook highlights that early action is possible and necessary, including cryptographic inventory and adoption of cryptographic agility practices, as well as jointly testing hybrid solutions. Success depends on coordinated efforts across organisations and policymakers acting within a specific sector to avoid fragmentation and ensure interoperability. Stakeholders should begin risk-based assessment, invest in early experimentation, and actively participate in sector-specific collaboration and standardisation efforts.