Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways (opens in new tab)
Meta argues that organizations should begin migrating to post-quantum cryptography (PQC) before quantum computers become practical. The “store now, decrypt later” threat means attackers may already be collecting encrypted data for future decryption, making long-lived sensitive information vulnerable today. Meta’s experience suggests a phased strategy based on risk prioritization, cryptographic inventories, technical readiness, deployment, and operational guardrails. ## Why PQC Migration Is Urgent - Quantum computers are expected to eventually break conventional public-key cryptography, potentially within 10–15 years. - Attackers can use “store now, decrypt later” (SNDL) attacks by collecting encrypted data today and decrypting it once quantum capabilities mature. - NIST and the UK NCSC have issued migration guidance, including target timeframes such as 2030 for protecting critical systems. - NIST has standardized algorithms including: - **ML-KEM (Kyber)** for key encapsulation - **ML-DSA (Dilithium)** for digital signatures - **HQC**, which includes contributions from Meta cryptographers ## Meta’s Migration Goals Meta’s multi-year migration is guided by four objectives: - **Effectiveness:** Protect systems against quantum-enabled adversaries. - **Timeliness:** Deploy protections as standards and technologies evolve. - **Performance:** Minimize latency, resource use, and user impact. - **Cost efficiency:** Balance investment against the risk and sensitivity of each use case. ## PQC Migration Levels Meta proposes a maturity ladder that measures how quickly an organization can respond to a relevant quantum event, such as a major technical breakthrough, new standards, or changing industry practices. - **PQ-Unaware:** The organization has not recognized the quantum threat. - **PQ-Aware:** The threat and eventual requirements have been assessed, but design work has not begun. - **PQ-Ready:** A suitable PQC solution has been identified or prepared, but deployment is deferred because of cost, prioritization, or other constraints. - **PQ-Hardened:** All currently available protections have been implemented, but complete mitigation is impossible because required primitives—such as efficient post-quantum OPRFs—do not yet exist. - **PQ-Enabled:** A post-quantum-secure solution is deployed for the use case. This is the desired end state for every application. Even reaching PQ-Ready can reduce future reaction time and create useful technical and organizational foundations, although it does not itself protect systems from quantum attacks. ## Meta’s PQC Migration Strategy Meta describes migration as several potentially overlapping workstreams: - **Define prioritization:** Classify applications by high, moderate, or low risk so the most exposed use cases move first. - **Build a cryptographic inventory:** Identify where cryptography is used and which applications rely on quantum-vulnerable algorithms. - **Address external dependencies:** Track standards, PQC-capable hardware security modules, and the maturity of available implementations. - **Implement PQC components:** Build reusable post-quantum cryptographic capabilities for later integration. - **Deploy guardrails:** Update cryptographic standards, prevent creation of new vulnerable keys, and restrict affected APIs. - **Integrate protections:** Apply PQC components to prioritized use cases and internal traffic. ## Prioritizing Applications The first prioritization category focuses on applications vulnerable to attacks that can begin now and be completed later using quantum algorithms such as Shor’s algorithm. - Applications using quantum-vulnerable public-key encryption or key-exchange mechanisms are considered high priority. - Systems handling sensitive data with long confidentiality requirements are especially exposed to SNDL attacks. - Risk-based prioritization helps organizations avoid attempting a costly, simultaneous migration of every application. Organizations should begin by identifying high-value and long-lived data, inventorying vulnerable cryptography, and moving each use case progressively toward PQ-Enabled status.