Framing the Post-Quantum Threat Model: Assets, Adversaries, and Boundaries

Most organizations plan a post-quantum migration as a procurement and engineering task: replace these algorithms with those. That framing misses the point, because the migration's hardest risks are not in the algorithms but in the threat model around them. The assets at stake are defined by how long their secrecy must last relative to the quantum transition; the anchor adversary is an unusual one who has no capability today but will later, and who is already acting; and the migration itself opens new attack surfaces as old and new cryptography coexist. This series applies the discipline of threat modeling — assets, adversaries, boundaries, attack trees, controls — to the crypto transition, and this first article frames the three pillars.

The three pillars

Threat modeling begins with three questions: what are we protecting, from whom, and across what boundaries. For a post-quantum migration each has a distinctive answer. The assets are not only secrets but secrets classified by shelf-life — how long their confidentiality or integrity must hold — because the whole migration is a race between that shelf-life and the arrival of quantum capability. The adversaries include the ordinary active attacker but center on an unusual one: a patient, passive collector with capability that lies in the future. And the boundaries are the points where cryptography terminates and, newly, the interfaces where migrating old and new schemes meet.

This structure matters because a migration analyzed only as an algorithm list will miss the threats that live in the relationships among these pillars. The interaction of a long-lived asset with a future-capable adversary is the harvest-now-decrypt-later threat; the interaction of the migration's new boundaries with an active adversary is the downgrade threat; and the migration's own complexity is an attack surface in its own right. None of these is visible if one only asks which algorithm replaces which.

The rest of this article develops each pillar, and the rest of the series develops the threats they generate: harvest-now-decrypt-later as the anchor, downgrade and rollback against the new boundaries, the migration's own attack surface, and finally a repeatable playbook. The framing here is the scaffold on which those specific analyses hang.

Assets classified by shelf-life

The first pillar is an inventory of assets sorted by how long they must remain protected. Data is the obvious asset, and its shelf-life ranges from ephemeral session content, which needs protection only for seconds, to records that must stay confidential for decades. Keys and credentials are assets too, especially long-lived ones — trust roots, certificate-authority keys, and identity anchors whose compromise cascades. Integrity assets matter as well: signatures and records whose authenticity must be relied upon into the future.

The organizing principle is the same one the migration methodology used: an asset is at risk from the quantum transition precisely when its required protection lifetime extends past the point at which quantum capability arrives. A session key protecting a conversation that is worthless in an hour is not threatened by a computer that will not exist for years; an archive that must stay secret for twenty years is threatened now, because it will still need protection when the attacker gains capability. Classifying assets by shelf-life is therefore not bookkeeping but the core risk calculation.

This classification also prioritizes the migration. The assets with the longest shelf-lives and highest stakes are the ones to migrate first, because they are the ones for which the race against quantum capability is already being lost if nothing is done. The threat model's asset pillar is thus directly actionable: it produces the ranked list of what to protect first, which the harvest-now-decrypt-later article develops into a concrete inventory.

The adversary with future capability

The second pillar contains an adversary unlike those in ordinary threat models: one whose relevant capability does not yet exist. The store-now-decrypt-later attacker is passive today — it records encrypted traffic or exfiltrates ciphertext archives without being able to read them — and waits for a future quantum computer to decrypt its haul. Its defining feature is that the threat accrues now, at the moment of recording, even though the harm is realized later. Defending against it requires acting before its capability arrives, because anything it records today is lost once it can decrypt.

Alongside this novel adversary sits the familiar active on-path attacker, whose capability is present. It intercepts and manipulates connections in real time, and against a migration its characteristic move is the downgrade: forcing a dual-stack system to fall back to the classical cryptography it still supports, stripping away the post-quantum protection. This attacker does not need a quantum computer at all; it exploits the migration's transitional complexity to keep victims on breakable classical schemes.

Distinguishing these two adversaries is essential because they demand different defenses on different clocks. The passive future-capable collector is defended by migrating confidentiality now, ahead of quantum arrival, and is indifferent to the details of negotiation. The active present attacker is defended by hardening the negotiation and boundaries against downgrade, and cares nothing for the quantum timeline. A threat model that conflates them will mistime or misdirect its controls, which is why the adversary pillar must name both explicitly.

The boundaries a migration crosses

The third pillar is the set of trust boundaries the migration touches, because attacks happen at boundaries. Cryptography terminates at specific places — channel endpoints where sessions are established, key-management systems and hardware modules where keys live, and the public-key infrastructure and trust roots that anchor identity — and each is a boundary where the migration changes something and an adversary might strike. Enumerating these termination points is what tells the threat model where its analysis must focus.

The migration introduces new boundaries of its own, and these are the most dangerous because they are novel and transitional. A dual-stack deployment that runs both classical and post-quantum cryptography has interfaces between the two — negotiation logic, combiner code, fallback paths — that did not exist before and that carry their own vulnerabilities. The seam between old and new is an attack surface created by the migration itself, and it is precisely where downgrade attacks and combiner failures live, as later articles detail.

Mapping these boundaries turns the abstract migration into a concrete set of places to defend. The termination points inherit the asset and adversary analysis: a channel endpoint facing the passive collector needs its confidentiality migrated; a negotiation boundary facing the active attacker needs its downgrade resistance hardened; a key-management boundary needs its transitional key handling scrutinized. The boundary pillar is what connects the assets and adversaries to specific components in the architecture.

Applying the discipline

With the three pillars framed, the migration can be analyzed with standard threat-modeling machinery: from each asset and adversary, build attack trees showing how the adversary could reach the asset across the boundaries, and pair each leaf with a control. This is the same discipline used for any system, applied to the crypto transition, and it produces a structured, auditable picture rather than a checklist swap. The distinctive elements — the future-capable adversary and the migration's own surface — slot into this machinery as particular assets, adversaries, and boundaries.

Scope must be set deliberately. The public-key cryptography that quantum computers break — key exchange and signatures — is squarely in scope, because that is what the migration replaces and what the adversaries target. Symmetric cryptography and hashing are largely out of scope for the public-key migration, because quantum search only mildly weakens them and the response is different, as a separate analysis covers; conflating the two dilutes the model. Naming what is in and out keeps the analysis focused on the threats the migration actually addresses.

For autonomous AI systems the three pillars have concrete referents. The assets are model-serving channels, agent-identity credentials and trust roots, and above all long-retention training-data archives whose shelf-life is measured in years. The adversaries are the passive collector harvesting model and agent traffic today and the active attacker probing agent service meshes for downgrade opportunities. The boundaries are the TLS termination points of model endpoints, the key stores behind agent identity, and the dual-stack seams a phased migration introduces. Framing an AI platform's post-quantum migration this way — assets by shelf-life, both adversaries named, boundaries mapped — is what turns it from a vague upgrade into a threat-modeled program, and the rest of this series builds the specific analyses on this frame.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

pqc_threat_model:
  assets:
    classified_by: shelf_life
    at_risk_when: lifetime_gt_time_to_quantum
  adversaries:
    - store_now_decrypt_later   # passive, future capability
    - active_on_path            # present capability, downgrade
  boundaries:
    - channel_endpoints
    - key_management_hsm
    - pki_trust_roots
    - dual_stack_interface      # new surface
  scope: public_key_cryptography

Glossary

Asset shelf-life

How long an asset's confidentiality or integrity must hold; an asset is quantum-at-risk when this exceeds the time to quantum capability.

Store-now-decrypt-later adversary

A passive attacker recording ciphertext today to decrypt once a future quantum computer exists; the threat accrues at recording time.

Active on-path attacker

A present-capability attacker that manipulates connections in real time, characteristically forcing downgrades to classical cryptography.

Trust boundary

A point where cryptography terminates or where trust changes hands; attacks concentrate at boundaries, including new dual-stack ones.

Dual-stack seam

The interface between classical and post-quantum cryptography in a migrating system; a new attack surface the migration creates.

Scope

The deliberate statement of what is in and out; the public-key migration targets quantum-breakable key exchange and signatures, not symmetric primitives.

References

1. NIST IR 8547, Transition to Post-Quantum Cryptography Standards (2024)
2. NIST SP 1800-38, Migration to Post-Quantum Cryptography (practice guide)
3. Mosca, Cybersecurity in an Era with Quantum Computers (IEEE Security & Privacy, 2018)
4. Shostack, Threat Modeling: Designing for Security (Wiley, 2014)
5. IETF draft-ietf-tls-hybrid-design, Hybrid Key Exchange in TLS 1.3