Networks such as the Internet are essential for our connected world. Quantum computing threatens its fundamental security mechanisms. Therefore, a migration to post-quantum-cryptography (PQC) is necessary for networks and their components. Currently, there is little knowledge on how such migrations should be structured and implemented in practice. Our systematic literature review addresses migration approaches for IP networks towards PQC. It surveys papers about the migration process and exemplary real-world software system migrations. On the process side, we found that terminology, migration steps, and roles are not defined precisely or consistently across the literature. Still, we identified four major phases and appropriate substeps which we matched with also emerging archetypes of roles. In terms of real-world migrations, we see that reports used several different PQC implementations and hybrid solutions for migrations of systems belonging to a wide range of system types. Across all papers we noticed three major challenges for adopters: missing experience of PQC and a high realization effort, concerns about the security of the upcoming system, and finally, high complexity. Our findings indicate that recent standardization efforts already push quantum-safe networking forward. However, the literature is still not in consensus about definitions and best practices. Implementations are mostly experimental and not necessarily practical, leading to an overall chaotic situation. To better grasp this fast moving field of (applied) research, our systematic literature review provides a comprehensive overview of its current state and serves as a starting point for delving into the matter of PQC migration.

Advances in quantum computing necessitate migrating the entire technology stack to post-quantum cryptography. This includes IPsec-based VPN connection authentication. Although there is an RFC draft for post-quantum authentication in this setting, the draft does not consider (stateful) hash-based signatures despite their small signature size and trusted long-term security. We propose a design with time-based state-management that assigns VPN devices a certificate authority (CA) based on the hash-based signature scheme XMSS. The CA then issues leaf certificates which are based on classical cryptography but have a short validity time, e. g., four hours. It is to be expected that even large quantum computers will take significantly longer to break the cryptography, making the design quantum-secure. We propose strategies to make the timekeeping more resilient to faults and tampering, as well as strategies to recognize a wrong system time, minimize its potential damage, and quickly recover. The result is an OpenBSD implementation of a quantum-safe and, regarding the leaf certificates, highly flexible VPN authentication design that requires significantly less bandwidth and computational resources compared to existing alternatives.

We present a novel approach to gaining insight into the structure of cryptographic migration problems which are classic problems in applied cryptography. We use a formal model to capture the inherent dependencies and complexities of such transitions. Using classical mathematical results from combinatorics, probability theory, and combinatorial analysis, we evaluate the challenges of migrating large cryptographic IT infrastructures. We show mathematical rigorously that for certain idealized random partitions and under some standard Erdős-Rényi-type assumptions our model exhibits a certain expected structural complexity and provide numerical data for selected parameter sets. This work paves the way for future advancements in both the theoretical understanding and practical implementation of cryptographic migration strategies.

Modern IT infrastructures are composed of heterogeneous services with complex dependencies and security configurations. During migration or modernization efforts, incomplete or outdated knowledge about communication relationships, protocol usage, and cryptographic dependencies represents a major source of risk. This paper presents an approach for the automated construction of a graph-based digital twin of an IT infrastructure, developed using Design Science Research (DSR). It collects data in transit using a dedicated, extensible processing pipeline that extracts, parses, and transforms network-, protocol-, and cryptography-level information into a unified graph representation. The resulting digital twin is implemented using a graph database, enabling interactive exploration through graph queries and visualizations. The graph-based model explicitly represents communication relationships, protocols, and associated cryptographic properties, allowing heterogeneous infrastructure information to be integrated into a coherent schema. Based on this representation, the digital twin is the first solution that supports the cataloging and analysis of cryptographic mechanisms including dependencies, providing a structured foundation for post-quantum cryptography (PQC) migration planning and improved cryptographic agility in complex IT environments.