Two days, built for engineers.

Migration to Quantum-Resilient Cryptography: Case X-Road

Petteri Kivimäki

This talk presents a case study on preparing the X-Road ecosystem for the transition to quantum-resilient cryptography through a structured and risk-driven migration approach. While the work is grounded in X-Road, the objective is to demonstrate a process that can be applied to other systems facing similar challenges. Rather than focusing on cryptographic algorithms themselves, the talk examines how an existing, widely deployed system can systematically adapt to the emerging threats posed by quantum computing. The process begins with constructing a comprehensive cryptographic inventory of the target system, mapping all cryptographic assets, protocols, and dependencies across the system. This inventory serves as the foundation for identifying quantum-vulnerable components, particularly those relying on classical public-key cryptography. Building on this, quantum-related threats are mapped to the target system's security architecture, assessing the potential impact on data confidentiality, integrity, and long-term trust. A risk-based prioritization is then applied to determine which components require immediate mitigation and which can be addressed over time. The case study further outlines migration strategies, including the introduction of post-quantum algorithms, hybrid cryptographic approaches, and phased deployment models that ensure backward compatibility and operational continuity. While the findings are derived from the X-Road context, the proposed approach is system-agnostic and can be applied to other information systems and infrastructures. The study therefore provides not only insights into X-Road’s quantum readiness, but also a reusable methodology for organisations planning their own transition to quantum-safe cryptography.