The Other End of the Handshake: Cryptographic Dependency Mapping for PQC Migration

Two years into the post-quantum readiness era, aligning on the algorithms is the easy part - NIST has standardized them. The hard part, that quietly derails migration programs, is the wiring: knowing what cryptography you run, where it lives, and, critically, what is connected to what and more importantly what communicates with what. This session makes the case that PQC remediation is fundamentally a dependency problem, not simply discovery and visibility. A weak protocol or a quantum-vulnerable key almost never affects only a single endpoint; it affects the relationship between 2 entities. Disable TLS 1.1 on one side of a handshake while the peer can only speak the old protocol, and you don't harden the channel, instead you break it, often a production-critical one. Fix the wrong end first and you simply relocate the weakness. Remediation must be enforced on both ends of every cryptographic relationship, at the same time. Drawing on real enterprise migration experience - including the realities of large financial-sector estates, this session will walk through a dependency-first method any organization can start with as a foundation. We start with a simple example: a single scanner finding of TLS 1.1 on a payments endpoint, and how mapping it’s peer communication set, turns the remediation ticket into much more than just remediating a single endpoint. We will look at how organizations can lay the foundation to building and maintaining a cryptographic dependency graph from layered telemetry. We go deep on the hardest dependency tree of all: certificate hierarchies and machine identities. A quantum-vulnerable root doesn't invalidate a service; it invalidates a trust fabric. PKI and the exploding population of non-human identities must be mapped first and then migrated, a Cryptographic Bill of Materials (CBOM), which is dependency-aware by design, becomes a living source of truth rather than a one-time inventory. We aim to have attendees leave with a concrete, vendor-neutral playbook: how to assemble the dependency graph, how to compute remediation clusters and surface blockers before a change window, how to sequence coordinated "add-then-remove" cutovers, and how to prioritize by secrecy lifetime based on the harvest-now-decrypt-later attack vector.