Preparing for the 2030 Quantum Threat: SSL/TLS Migration with Hybrid ML-KEM Practical Guide

• Since HNDL (Harvest Now, Decrypt Later) attacks are already underway, proactive PQC migration is essential to prepare for the 2030 quantum threat.
• Among NIST FIPS 203 (ML-KEM), 204 (ML-DSA), and 205 (SLH-DSA) standards, ML-KEM is core to TLS key exchange, and a Hybrid approach combined with existing ECC is secure.
• Utilize OpenSSL 3.5, which is included by default in RHEL 10.1 and Ubuntu 26.04 LTS, to prioritize X25519MLKEM768 in Nginx's ssl_curves.
• A strategy of migrating only the edge (Reverse Proxy, CDN) instead of upgrading the entire backend is an economical method that reduces downtime risk and defends against HNDL.

Global Adoption Status and Regulations

• Major big tech companies such as Google Chrome 124, Apple iOS 17.4 (iMessage PQ3), AWS, and Cloudflare have already enabled Hybrid ML-KEM by default.
• Domestically, a two-track strategy is required for public and financial sectors where KCMVP certification is mandatory, involving the parallel use of domestic PQC standards (such as AIMer) and NIST standards.

Phased Migration Roadmap

• Phase 1 (2025–2027): Build an encryption asset inventory and fully implement TLS 1.3.
• Phase 2 (2027–2029): Apply X25519MLKEM768 to edge proxies and load balancers serving as external HTTPS touchpoints.
• Phase 3 (2029–2033): Migrate certificate signing algorithms to ML-DSA and complete the crypto-agility pipeline.