Meta's Approach to Migrating their Systems to Post-Quantum Cryptography

"Meta describes its migration process as a far-reaching transformation of infrastructure, standards, and engineering practices across the entire organization. To track progress, they defined a five-level maturity model, from PQ-unaware to PQ-enabled, with the latter representing the ultimate goal of full quantum-resistant protection."

"The strategy suggested by Meta's researchers is defined as a sequence of steps, beginning with prioritization. Companies should rank applications based on their vulnerability, particularly those relying on public-key encryption and key exchange mechanisms, which are especially vulnerable in a post-quantum world."

"Among high-risk applications, we differentiate the ones that have no external dependencies, which can be migrated right away, from those that have external dependencies and thus may need to wait until these dependencies are resolved."

Meta is preparing for quantum computing threats by migrating to post-quantum cryptography, a complex process expected to take years. The migration involves transforming infrastructure, standards, and engineering practices. A five-level maturity model tracks progress from PQ-unaware to PQ-enabled. Companies should prioritize applications based on vulnerability, focusing on those relying on public-key encryption. High-risk applications are categorized based on external dependencies, while medium- and high-priority applications are identified for future quantum threats, with symmetric cryptography attacks deemed low priority due to resource requirements.

Read at InfoQ