Research seriesL3algorithms
The hard part of post-quantum cryptography is not the math - it is swapping primitives inside protocols, certificates, and hardware without breaking interoperability. This series is the engineering playbook: hybrid key exchange, PQC in TLS 1.3, certificate and PKI bloat, crypto-agility as an architecture property, and a repeatable migration methodology. Grounded in NIST SP 800-56C, IETF hybrid drafts, and NIST IR 8547.
A hybrid exchange runs a classical and a post-quantum key exchange together and combines their secrets so the session stays safe if either one survives — provided the combiner binds both correctly.
Adding a post-quantum key to the TLS handshake makes the ClientHello roughly a kilobyte larger, and that size — not the cryptography — is what breaks naive rollouts against real networks.
Post-quantum signatures are tens of times larger than classical ones, and a certificate chain carries several — so the authentication half of the handshake bloats even more than the key exchange did.
The post-quantum migration is painful mostly because systems hard-coded their algorithms. Crypto-agility is the architectural property that lets you swap cryptographic primitives without rebuilding the system.
A post-quantum migration is a repeatable program, not a one-off swap: inventory what you have, rank it by data shelf-life, hybridize the urgent parts first, measure, and keep iterating.