Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways (opens in new tab)

Meta argues that organizations should begin migrating to post-quantum cryptography (PQC) before quantum computers become practical. The “store now, decrypt later” threat means attackers may already be collecting encrypted data for future decryption, making long-lived sensitive information vulnerable today. Meta’s experience suggests a phased strategy based on risk prioritization, cryptographic inventories, technical readiness, deployment, and operational guardrails.

Why PQC Migration Is Urgent

• Quantum computers are expected to eventually break conventional public-key cryptography, potentially within 10–15 years.
• Attackers can use “store now, decrypt later” (SNDL) attacks by collecting encrypted data today and decrypting it once quantum capabilities mature.
• NIST and the UK NCSC have issued migration guidance, including target timeframes such as 2030 for protecting critical systems.
• NIST has standardized algorithms including:
  • ML-KEM (Kyber) for key encapsulation
  • ML-DSA (Dilithium) for digital signatures
  • HQC, which includes contributions from Meta cryptographers

Meta’s Migration Goals

Meta’s multi-year migration is guided by four objectives:

• Effectiveness: Protect systems against quantum-enabled adversaries.
• Timeliness: Deploy protections as standards and technologies evolve.
• Performance: Minimize latency, resource use, and user impact.
• Cost efficiency: Balance investment against the risk and sensitivity of each use case.

PQC Migration Levels

Meta proposes a maturity ladder that measures how quickly an organization can respond to a relevant quantum event, such as a major technical breakthrough, new standards, or changing industry practices.

• PQ-Unaware: The organization has not recognized the quantum threat.
• PQ-Aware: The threat and eventual requirements have been assessed, but design work has not begun.
• PQ-Ready: A suitable PQC solution has been identified or prepared, but deployment is deferred because of cost, prioritization, or other constraints.
• PQ-Hardened: All currently available protections have been implemented, but complete mitigation is impossible because required primitives—such as efficient post-quantum OPRFs—do not yet exist.
• PQ-Enabled: A post-quantum-secure solution is deployed for the use case. This is the desired end state for every application.

Even reaching PQ-Ready can reduce future reaction time and create useful technical and organizational foundations, although it does not itself protect systems from quantum attacks.

Meta’s PQC Migration Strategy

Meta describes migration as several potentially overlapping workstreams:

• Define prioritization: Classify applications by high, moderate, or low risk so the most exposed use cases move first.
• Build a cryptographic inventory: Identify where cryptography is used and which applications rely on quantum-vulnerable algorithms.
• Address external dependencies: Track standards, PQC-capable hardware security modules, and the maturity of available implementations.
• Implement PQC components: Build reusable post-quantum cryptographic capabilities for later integration.
• Deploy guardrails: Update cryptographic standards, prevent creation of new vulnerable keys, and restrict affected APIs.
• Integrate protections: Apply PQC components to prioritized use cases and internal traffic.

Prioritizing Applications

The first prioritization category focuses on applications vulnerable to attacks that can begin now and be completed later using quantum algorithms such as Shor’s algorithm.

• Applications using quantum-vulnerable public-key encryption or key-exchange mechanisms are considered high priority.
• Systems handling sensitive data with long confidentiality requirements are especially exposed to SNDL attacks.
• Risk-based prioritization helps organizations avoid attempting a costly, simultaneous migration of every application.

Organizations should begin by identifying high-value and long-lived data, inventorying vulnerable cryptography, and moving each use case progressively toward PQ-Enabled status.