Meta Shares Post-Quantum Cryptography Migration Framework and Lessons
Meta has published a detailed framework and lessons learned from its ongoing migration to post-quantum cryptography (PQC) to assist other organizations in strengthening their digital resilience. Addressing the threat of quantum computers breaking conventional public-key encryption, Meta emphasizes the urgency of preparing for "store now, decrypt later" attacks, where adversaries collect encrypted data for future decryption. The company proposes a structured approach using "PQC Migration Levels" to help teams manage the complexity of transitioning various use cases. This strategy focuses on effectiveness, timeliness, performance, and cost efficiency. Meta highlights its alignment with new standards from the US National Institute of Standards and Technology (NIST), such as ML-KEM and ML-DSA, and notes its contribution to the HQC algorithm. By outlining its process from risk assessment to deployment, Meta aims to provide practical guidance for the broader industry. The goal is to enable organizations to navigate this multi-year transition effectively, ensuring security commitments are upheld as the industry moves toward a post-quantum future, with target timeframes for critical systems protection approaching 2030.
Wire timeline
Meta Shares Post-Quantum Cryptography Migration Framework and Lessons
Meta has published a detailed framework and lessons learned from its ongoing migration to post-quantum cryptography (PQC) to assist other organizations in strengthening their digital resilience. Addressing the threat of quantum computers breaking conventional public-key encryption, Meta emphasizes the urgency of preparing for "store now, decrypt later" attacks, where adversaries collect encrypted data for future decryption. The company proposes a structured approach using "PQC Migration Levels" to help teams manage the complexity of transitioning various use cases. This strategy focuses on effectiveness, timeliness, performance, and cost efficiency. Meta highlights its alignment with new standards from the US National Institute of Standards and Technology (NIST), such as ML-KEM and ML-DSA, and notes its contribution to the HQC algorithm. By outlining its process from risk assessment to deployment, Meta aims to provide practical guidance for the broader industry. The goal is to enable organizations to navigate this multi-year transition effectively, ensuring security commitments are upheld as the industry moves toward a post-quantum future, with target timeframes for critical systems protection approaching 2030.
Engineering at Meta