Daiwa Institute of Research and Deloitte suggest treating post-quantum cryptography (PQC) migration as a structured program rather than a physics challenge. Experts emphasize that organizations should prioritize iterative testing and focus on critical assets instead of attempting a full-scale discovery process immediately.
Daiwa tested a hybrid approach within the Daiwa Securities online trading system using a PQC-enabled load balancer. The proof of concept showed that the average TLS handshake time increased by approximately 1.2 milliseconds. While this impact was negligible in high-bandwidth data centers, the company noted that message sizes and packet counts increased.
According to Sadaaki Yamazaki of Daiwa, key establishment and digital signatures are at different stages of readiness. He noted that ML-KEM is already standardized, and hybrid key exchange options like X25519MLKEM768 are becoming available. Adopting these early can help mitigate risks associated with the harvest now, decrypt later strategy.
Colin Soutar from Deloitte highlighted that the primary difficulties in PQC implementation are governance and maintaining a cryptographic inventory rather than replacing algorithms. Enterprise infrastructure, including VPNs, cloud services, and APIs, requires coordination across various organizational departments to manage dependencies effectively.
