Post-quantum cryptography migration takes several years under both the US and UK timelines, and nothing in the migration protects traffic that is copied while it runs. Interim protection has to come from optical-layer encryption or physical-layer approaches. This guide covers the published timelines, the order of work, and how three optical-layer options compare.
How long PQC migration takes
Two governments have published timelines, and both span years.
United States, Executive Order 14412:
- Signed June 22, 2026, per the Federal Register.
- Federal high value assets and high impact systems must use post-quantum cryptography for key establishment by December 31, 2030.
- The same systems must use it for digital signatures by December 31, 2031.
- National Security Systems are excluded.
- The FAR Council must propose a rule requiring covered contractors to comply with NIST standards by December 31, 2030.
United Kingdom, NCSC roadmap:
- Phase one, by 2028: define goals, run discovery, build an initial plan.
- Phase two, by 2031: complete early, highest-priority migration.
- Phase three, by 2035: complete migration of all systems, services, and products.
- The NCSC expects each preparatory phase to take large organizations roughly two to three years.
Do you know I Thought Upgrading to Post-Quantum Encryption Would Cover Us. It Doesn’t.? Learn why upgrading the algorithm is only part of protecting traffic that crosses the network.
Why migrations run long
Three factors extend the timeline.
First, discovery. NIST’s NCCoE defines cryptographic discovery as using inventory tools to learn where and how cryptography protects important data and systems. Organizations that have no current inventory must build one before replacement can be planned.
Second, scope. Migration touches hardware, software, key management, and third-party vendors at the same time, so changes depend on other parties’ schedules.
Third, precedent. The SSL Store reports that Qualys SSL Labs data from May 2024 showed 27.9% of surveyed websites still supporting TLS 1.0, more than five years after websites were told to begin migrating. A comparable post-quantum program should be planned on a similar scale.
Which data and links come first
Prioritization uses two inputs.
Confidentiality period. Short-lived data, such as single-use credentials, carries little long-term risk. Intellectual property, long-term government contracts, and medical records stay sensitive for years. Data that must remain confidential for five years or more ranks highest.
Link exposure. Traffic can be copied digitally or physically.
- Digital: rerouting traffic to a rogue server, exploiting a router, or deploying a switch that forwards data to external storage.
- Physical: access at street cabinets, communication tunnels, and manholes, using a fiber bend or optical splitter. Optical tapping is treated as a recognized physical attack in research on optical network monitoring.
Links on public or shared infrastructure, including third-party carrier backbones, are harder to control and require coordination with the carrier. Ranking data and links together produces the list that sets rollout phases.
The two rankings work together. A link that carries short-lived data over a well-controlled path can wait for a later phase. A link that carries long-lived data over shared infrastructure should not. Documenting the ranking also gives the migration team a defensible reason for the order of rollout, which matters when budgets and vendor schedules force trade-offs.
For more on how encrypted traffic can stay exposed after keys are protected, listen to Your Keys Are Safe. Your Traffic Might Not Be.
What migration progress does not cover
Discovery, ranking, and phased rollout do not protect traffic that crosses the network before they finish.
Most traffic today relies on a key exchange that quantum computers are expected to break. NIST approved its first post-quantum standards in August 2024 to replace it. The payload cipher, AES-256, is not the component at risk. The key exchange that establishes its key is.
The attack that exploits this is harvest now, decrypt later. Traffic copied from a fiber link today can be stored and decrypted after the key exchange is broken. Finishing migration in 2030 or 2031 protects later traffic and has no effect on a copy that already exists.
Interim protection therefore has to do one of two things: prevent a usable copy, or make a copy useless. At the optical layer, that means encrypting the signal or making the signal unrecordable. Neither replaces migration, and both apply only to WAN links, the long-distance connections between sites, and not to LAN or personal-device traffic.
This distinction is why compliance and exposure should be tracked separately. Compliance is measured against the dates in the order or roadmap. Exposure is measured by whether traffic leaving a site can be copied and later read. A program can be on schedule for the first and still carry the second.
Optical-layer protection compared
The table compares CyberRidge‘s Carmel with optical-layer encryption from Ciena and Nokia, using each company’s published information.
| Dimension | CyberRidge Carmel | Ciena WaveLogic | Nokia 1830 platforms |
|---|---|---|---|
| Layer | Layer 1, physical | Optical layer | Layer 1, physical |
| Basis of protection | Signal made unrecordable, independent of the key algorithm | AES-256-GCM encryption | Symmetric keys from a central server |
| Post-quantum angle | Complementary to PQC, with no dependence on the key algorithm | Trial combined PQC with quantum key distribution interworking | Described by Nokia as quantum-safe through its symmetric key architecture |
| Stated throughput | 100 Gb/s uplink today | 1.6 Tb/s in an August 2026 trial | Not stated on the page reviewed |
| Range and deployment | Up to 100 km unamplified, EDFA and Raman compatible, overlay in weeks | Trial on a live network between Chicago and Hammond, Indiana data centers | 1830 PSS and PSI platforms with a central security management server and optical intrusion detection |
Ciena and Nokia protect traffic through encryption and key management, and Ciena’s trial shows far higher throughput than Carmel’s current 100 Gb/s. Carmel takes a different approach by aiming to leave no recordable signal, at lower capacity per uplink. The options address the same exposure in different ways, and the choice depends on link capacity, existing optical equipment, and whether protection should depend on keys.
Bottom line
PQC migration runs on multi-year timelines, and traffic copied during those years stays copied. Rank data by confidentiality period, rank links by exposure, and decide what covers the top links while the migration proceeds. Optical-layer encryption and physical-layer protection are both options for that period, and neither changes migration obligations under EO 14412 or the NCSC roadmap.
Starting discovery now positions an organization for the 2028 NCSC milestone and the earlier US milestones with less rework. Treating interim protection as part of the same plan avoids leaving the most sensitive links dependent on a schedule that runs to 2031 for priority systems and to 2035 for the rest under the NCSC roadmap.
FAQ
Q: How long does post-quantum cryptography migration take?
A: Several years. EO 14412 sets federal deadlines of December 31, 2030 and December 31, 2031, and the NCSC roadmap runs through 2035.
Q: Does EO 14412 apply to private organizations?
A: Not directly. It covers federal high value assets and high impact systems. It also directs a rule requiring covered contractors to comply by December 31, 2030.
Q: What does harvest now, decrypt later mean?
A: It means copying encrypted traffic now and decrypting it later, after the key exchange that protected it can be broken.
Q: How do you decide which links to protect first?
A: Rank data by how long it must stay confidential, rank links by how easily traffic could be copied, and begin with long-lived data on exposed links.
Q: What is CyberRidge Carmel?
A: Carmel is CyberRidge’s Layer 1 platform. According to the company, it makes transmitted optical signals unrecordable on WAN links.
Q: Does Carmel replace PQC migration?
A: No. It operates beneath the key algorithm and does not change migration obligations.
Q: How fast can Carmel be deployed?
A: CyberRidge states weeks, as an overlay with no changes to existing systems.
Q: How do Carmel, Ciena, and Nokia differ?
A: Ciena and Nokia rely on encryption keys at the optical layer. Carmel makes the signal itself unrecordable. Ciena’s trial throughput is far higher than Carmel’s 100 Gb/s.