Post-Quantum Key Management: HSM Readiness, Key Lifecycle, and Infrastructure Planning

Key management infrastructure is the hardest part of the PQC migration. HSMs have long procurement cycles, firmware updates require validation, and key management protocols are deeply embedded in every system. Start planning now.

HSM PQC Readiness

Most HSMs deployed today do not support NIST PQC algorithms natively:

• Thales Luna — PQC firmware updates available for Luna 7.x; check your specific model
• Entrust nShield — PQC support in CodeSafe; firmware updates for standard operations
• AWS CloudHSM — PQC support rolling out; check current algorithm list
• Azure Managed HSM — PQC roadmap announced; timeline TBD
• Google Cloud HSM — PQC support in development

Action: inventory all HSMs, check PQC firmware availability, budget for upgrades or replacements where firmware updates aren't possible.

Cloud KMS PQC Status

• AWS KMS — Supports ML-KEM for TLS to KMS endpoints. PQC key types for encrypt/decrypt in preview
• Azure Key Vault — PQC algorithm support in roadmap
• GCP Cloud KMS — PQC key types under development
• HashiCorp Vault — Transit secrets engine PQC support depends on Go crypto library (in progress)

Key Lifecycle Changes with PQC

• Key sizes — ML-KEM public keys are ~1.2KB (vs 256 bytes for ECDH). ML-DSA signatures are ~2.4KB (vs 64 bytes for ECDSA). Storage and bandwidth planning needed
• Performance — ML-KEM key generation and encapsulation are fast (comparable to ECDH). ML-DSA signing is slower than ECDSA. Benchmark your workloads
• Key transport — Protocols using RSA key transport (wrapping keys with RSA) need migration to ML-KEM
• Key agreement — ECDH-based key agreement needs migration to ML-KEM

Infrastructure Migration Plan

1. Inventory — Map all HSMs, KMS instances, and key management protocols
2. Assess — Check PQC support for each component
3. Upgrade path — Firmware updates where possible, hardware replacement where necessary
4. Hybrid deployment — Run classical + PQC in parallel during transition
5. Validation — Re-validate all security certifications (FIPS 140-3, Common Criteria) after PQC upgrades
6. Full migration — Transition to PQC-primary with classical fallback

Budget Reality

HSM replacement cycles are 5-7 years and cost €50-200K per unit. If your HSMs can't be firmware-upgraded for PQC, you need to budget replacements in your next procurement cycle. Waiting until the quantum threat is imminent means competing with every other organization for limited HSM supply.