Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways

This post details Meta's proactive strategy and framework for migrating to post-quantum cryptography (PQC). It introduces PQC Migration Levels (PQ-Enabled, PQ-Hardened, PQ-Ready, PQ-Aware, PQ-Unaware) to assess organizational readiness and manage migration complexity. The strategy involves defining prioritization criteria (High, Medium, Low priority based on attack types like SNDL and Grover's), building a cryptographic inventory through automated discovery and manual analysis, addressing external dependencies (standards, HSMs, implementations), implementing PQC components and guardrails, and finally integrating PQC components into use cases. The post highlights Meta's co-authorship of the HQC PQC algorithm and its ongoing deployment of PQ protections across internal traffic.