Meta's Approach to Migrating their Systems to Post-Quantum Cryptography

Meta's Approach to Migrating their Systems to Post-Quantum Cryptography - InfoQ

[BT](http://www.infoq.com/int/bt/ "bt")

InfoQ Software Architects' Newsletter

A monthly overview of things you need to know as an architect or aspiring architect.

View an example

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

Close

QCon San Francisco (Nov 16-20): What's next in AI? What's next in software? Learn from the teams already doing it.Register Now

Close

Toggle Navigation

Facilitating the Spread of Knowledge and Innovation in Professional Software Development

English edition

• English edition
• Chinese edition
• Japanese edition
• French edition

[Write for InfoQ](http://www.infoq.com/write-for-infoq/ "Write for InfoQ")

Search

RegisterSign in

Unlock the full InfoQ experience

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources.

Log In

or

Don't have an InfoQ account?

Register

• **Stay updated on topics and peers that matter to you**Receive instant alerts on the latest insights and trends.
• **Quickly access free resources for continuous learning**Minibooks, videos with transcripts, and training materials.
• **Save articles and read at anytime**Bookmark articles to read whenever youre ready.

Logo - Back to homepage

NewsArticlesPresentationsPodcastsGuides

Topics

[Development](http://www.infoq.com/development/ "Development")

• [Java](http://www.infoq.com/java/ "Java")
• [Kotlin](http://www.infoq.com/kotlin/ "Kotlin")
• [.Net](http://www.infoq.com/dotnet/ ".Net")
• [C#](http://www.infoq.com/c_sharp/ "C#")
• [Swift](http://www.infoq.com/swift/ "Swift")
• [Go](http://www.infoq.com/golang/ "Go")
• [Rust](http://www.infoq.com/rust/ "Rust")
• [JavaScript](http://www.infoq.com/javascript/ "JavaScript")

Featured in Development

• #### From VR to Flat Screens: Bridging the Input and Immersion Gap

Dany Lepage discusses the architectural journey of porting a hit VR title to seven non-VR platforms. He explains how his team solved the challenges of cross-progression, diverse input paradigms, and maintaining release velocity across Steam, iOS, and PlayStation. Beyond the tech, he shares candid lessons on the "product fit" gap when translating immersive social presence to 2D screens.


All in developmentFollow Topic

[Architecture & Design](http://www.infoq.com/architecture-design/ "Architecture & Design")

• [Architecture](http://www.infoq.com/architecture/ "Architecture")
• [Enterprise Architecture](http://www.infoq.com/enterprise-architecture/ "Enterprise Architecture")
• [Scalability/Performance](http://www.infoq.com/performance-scalability/ "Scalability/Performance")
• [Design](http://www.infoq.com/design/ "Design")
• [Case Studies](http://www.infoq.com/Case_Study/ "Case Studies")
• [Microservices](http://www.infoq.com/microservices/ "Microservices")
• [Service Mesh](http://www.infoq.com/servicemesh/ "Service Mesh")
• [Patterns](http://www.infoq.com/DesignPattern/ "Patterns")
• [Security](http://www.infoq.com/Security/ "Security")

Featured in Architecture & Design

• #### Stripe’s Docdb: How Zero-Downtime Data Movement Powers Trillion-Dollar Payment Processing

Jimmy Morzaria discusses the evolution of Stripe’s database tier to support 5 million QPS with 5.5 nines of reliability. He explains the architecture of DocDB and shares how Stripe leverages a custom zero-downtime data movement platform to perform horizontal sharding, version upgrades, and multi-tenant migrations - all while maintaining the strict consistency required for global commerce.


All in architecture-designFollow Topic

[AI Infrastructure](http://www.infoq.com/ai-ml-data-eng/ "AI Infrastructure")

• [Big Data](http://www.infoq.com/bigdata/ "Big Data")
• [Machine Learning](http://www.infoq.com/machinelearning/ "Machine Learning")
• [NoSQL](http://www.infoq.com/nosql/ "NoSQL")
• [Database](http://www.infoq.com/database/ "Database")
• [Data Analytics](http://www.infoq.com/data-analytics/ "Data Analytics")
• [Streaming](http://www.infoq.com/streaming/ "Streaming")

Featured in AI, ML & Data Engineering

• #### Agents, Architecture, & Amnesia: Becoming AI-Native Without Losing Our Minds

Tracy Bannon shares a cautionary tale of "The Sorcerer’s Apprentice" to illustrate the risks of unbridled AI autonomy. She discusses the shift from bots to autonomous agents, explaining how reckless speed leads to "Architectural Amnesia." She provides a concrete framework for "Minimum Viable Governance," focusing on identity, delegation, and ADRs to manage debt at machine speed across the SDLC.


All in ai-ml-data-engFollow Topic

[Culture & Methods](http://www.infoq.com/culture-methods/ "Culture & Methods")

• [Agile](http://www.infoq.com/agile/ "Agile")
• [Diversity](http://www.infoq.com/diversity/ "Diversity")
• [Leadership](http://www.infoq.com/leadership/ "Leadership")
• [Lean/Kanban](http://www.infoq.com/lean/ "Lean/Kanban")
• [Personal Growth](http://www.infoq.com/personal-growth/ "Personal Growth")
• [Scrum](http://www.infoq.com/scrum/ "Scrum")
• [Sociocracy](http://www.infoq.com/sociocracy/ "Sociocracy")
• [Software Craftmanship](http://www.infoq.com/software_craftsmanship/ "Software Craftmanship")
• [Team Collaboration](http://www.infoq.com/team-collaboration/ "Team Collaboration")
• [Testing](http://www.infoq.com/testing/ "Testing")
• [UX](http://www.infoq.com/ux/ "UX")

Featured in Culture & Methods

• #### Panel: Building a Culture that Works

The panelists share insights on evolving company culture. They discuss leveraging feedback loops, lending social capital, and the friction between legacy bureaucracy and agile engineering. The panel explains how to maintain cohesion in remote teams and use interviews to uncover the true "unmanicured" culture of a firm.


All in culture-methodsFollow Topic

DevOps

• [Infrastructure](http://www.infoq.com/infrastructure/ "Infrastructure")
• [Continuous Delivery](http://www.infoq.com/continuous_delivery/ "Continuous Delivery")
• [Automation](http://www.infoq.com/automation/ "Automation")
• [Containers](http://www.infoq.com/containers/ "Containers")
• [Cloud](http://www.infoq.com/cloud-computing/ "Cloud")
• [Observability](http://www.infoq.com/observability/ "Observability")

Featured in DevOps

• #### AI-Powered SRE for Autonomous Incident Response

The presenters discuss incident response, how AI-enhanced SRE platforms connect signals from logs, metrics, traces, and historical incidents to enable autonomous decisions.


All in devopsFollow Topic

[Events](https://events.infoq.com/ "Events")

Helpful links

• [About InfoQ](http://www.infoq.com/about-infoq "About InfoQ")
• [InfoQ Editors](http://www.infoq.com/infoq-editors "InfoQ Editors")
• [Write for InfoQ](http://www.infoq.com/write-for-infoq "Write for InfoQ")
• [About C4Media](https://c4media.com/ "About C4Media")
• [Diversity](https://c4media.com/diversity "Diversity")

Choose your language

• [En](http://www.infoq.com/news/2026/04/meta-quantum-crypto-migration/# "InfoQ English")
• 中文
• 日本
• Fr


[InfoQ Homepage](http://www.infoq.com/ "InfoQ Homepage")[News](http://www.infoq.com/news "News")Meta's Approach to Migrating their Systems to Post-Quantum Cryptography

[Architecture & Design](http://www.infoq.com/architecture-design/ "Architecture & Design")

Shipping Faster, Breaking More: Rethinking Delivery Systems in the Age of AI (Webinar May 28th)

Meta's Approach to Migrating their Systems to Post-Quantum Cryptography

Apr 30, 2026 2 min read

by

• Sergio De Simone

Follow

#### Write for InfoQ

**Feed your curiosity.**Help 550k+ global

senior developers

each month stay ahead.Get in touch

Log in to listen to this article

Audio ready to play

Your browser does not support the audio element.

0:00 0:00

Normal 1.25x 1.5x

Like

• Reading list

Meta has already begun preparing for the threats posed by quantum computing and migrating its systems to post-quantum cryptography, a complex process that will take multiple years to complete. In a recent article, Meta researchers outline their strategy and share key lessons learned along the way.

Meta describes its migration process as a far-reaching transformation of infrastructure, standards, and engineering practices across the entire organization. To track progress, they defined a five-level maturity model, from _PQ-unaware_ to _PQ-enabled_, with the latter representing the ultimate goal of full quantum-resistant protection.

Each level along the scale brings incremental protection. At the _PQ-aware_ level, a company has assessed its usage of cryptography and understands what it takes to reach the next level, _PQ-ready_. PQ-readyness marks the beginning of the migration even if post-quantum secure solutions are not yet fully enabled. While this is not ideal, it would still make the company faster in reacting once an actual threat materializes.

The strategy suggested by Meta's researchers is defined as a sequence of steps, beginning with prioritization. Companies should rank applications based on their vulnerability. In particular, systems that rely on public-key encryption and key exchange mechanisms are considered high priority, as these primitives are especially vulnerable in a post-quantum world.

Among high-risk applications, we differentiate the ones that have no external dependencies (can be migrated right away), from the ones that have external dependencies and thus may need to wait until these dependencies are resolved.

Medium- and high-priority applications are those that would only become vulnerable once actual quantum computer are available in the future. Among these, attacks on symmetric cryptography are considered low priority due to their substantial resource requirements (typically associated with brute-force Grover’s attacks), while applications relying on digital signatures are generally classified as medium priority

Other steps in the process include building an inventory of affected systems and applications, addressing external dependencies, and designing a quantum-secure solution by selecting appropriate post-quantum cryptography algorithms. At the same time, companies are advised to adopt guardrails to prevent new systems from being built using quantum vulnerable algorithms, including discouraging the creation of new quantum vulnerable keys and the use of affected APIs.

The final step, integrating post-quantum cryptography solutions, can be carried out either by replacing existing solutions or by layering post-quantum schemes on top the classical ones. Meta’s researchers generally favor this hybrid approach:

[It can be] designed so that the combined system should remain at least as secure as the current standard. An adversary would need to break both layers to compromise the system, providing a critical safety net.

While quantum computing is still far from being a reality, it is long known that hackers could harvest encrypted data today and decrypt it when quantum computers will become available in future, with growing evidence they could need fewer resources than earlier thought to break current algorithms. The authors of the research write:

This finding underscores the importance of ongoing efforts to transition widely deployed cryptographic systems to post-quantum standards designed to be secure against quantum attacks.

In this frame, Meta's migration guidelines can offer valuable help to prepare for a complex process that requires visibility, prioritization, ecosystem coordination, and incremental rollout.

About the Author


#### **Sergio De Simone**

**Sergio De Simone** is a software engineer. Sergio has been working as a software engineer for over twenty five years across a range of different projects and companies, including such different work environments as Siemens, HP, and small startups. For the last 10+ years, his focus has been on development for mobile platforms and related technologies. He is currently working for BigML, Inc., where he leads iOS and macOS development.

Show more Show less

#### This content is in the Application Security topic

Follow Topic

##### Related Topics:

• Architecture & Design### Architecture & Design

Followers: 10214

Follow Topic

• Cryptography### Cryptography

Followers: 30

Follow Topic

• Quantum Computing### Quantum Computing

Followers: 60

Follow Topic

• Application Security### Application Security

Followers: 90

Follow Topic

* #### Related Editorial

• ##### Google Cloud KMS Launches Post-Quantum KEM Support to Combat "Harvest Now, Decrypt Later" Threat

• ##### Kubernetes Introduces Post-Quantum Support for TLS

• ##### GitHub Rolls out Post-Quantum SSH Security to Protect Code from Future Threats

• ##### NVIDIA Launches Ising Open Models for Quantum Computing

• ##### The DPoP Storage Paradox: Why Browser-Based Proof-of-Possession Remains an Unsolved Problem

* #### Related Sponsors

• ##### Understanding AI Agent Security

• ##### [[Webinar] Creating Certainty in the Age of Agentic AI. Watch On-Demand.](http://www.infoq.com/vendorcontent/show.action?vcr=531d8edd-4f74-486b-aaca-10058c609c1c&primaryTopicId=2498&vcrPlace=BOTTOM&pageType=NEWS_PAGE&vcrReferrer=https%3A%2F%2Fwww.infoq.com%2Fnews%2F2026%2F04%2Fmeta-quantum-crypto-migration%2F)

• ##### Does your AI stack need a session layer? A maturity framework for teams building AI agents

• ##### Inside MCP: A Protocol for AI Integration

• ##### Akka Launches Agentic Platform for Autonomous, Real-Time & Edge AI Systems

• #### Related Sponsor

Confidently test, evaluate, and red-team your LLM apps with **Promptfoo** — catch regressions, benchmark models, and ship high-quality AI features faster; start testing your prompts today. **Learn More.**

Related Content

• ##### NVIDIA Launches Ising Open Models for Quantum Computing

Apr 30, 2026

• ##### HashiCorp Vault 2.0 Marks Shift to IBM Lifecycle with New Identity Federation

Apr 24, 2026

• ##### The DPoP Storage Paradox: Why Browser-Based Proof-of-Possession Remains an Unsolved Problem

Apr 30, 2026 

• ##### New Rowhammer Attacks on NVIDIA GPUs Enable Full System Takeover

Apr 14, 2026

• ##### Anthropic Releases Claude Mythos Preview with Cybersecurity Capabilities but Withholds Public Access

Apr 13, 2026

• ##### Axios npm Package Compromised in Supply Chain Attack

Apr 02, 2026

• ##### Trustworthy Productivity: Securing AI Accelerated Development

Dec 16, 2025 

• ##### NestJS v12 Roadmap: Full ESM Migration, Standard Schema Validation and Modernised Toolchain

Apr 30, 2026

• ##### Driving and Measuring the Impact of Platform Engineering

Apr 30, 2026

Related Sponsors

• #### Harder, Better, Prompter, Stronger: AI system prompt hardening

System prompts define how LLM applications behave—but they are vulnerable to manipulation. This article explores prompt hardening techniques such as instruction shielding, syntax reinforcement, and layered prompting to defend AI systems against prompt injection and override attacks.

• Sponsored by


Related Content

• ##### Cloudflare Announces Agent Memory, a Managed Persistent Memory Service for AI Agents

Apr 30, 2026

• Icon##### Stripe’s Docdb: How Zero-Downtime Data Movement Powers Trillion-Dollar Payment Processing

Apr 30, 2026 

• ##### Dropbox Redesigns Compaction to Reclaim Space from Underfilled Storage Volumes

Apr 30, 2026

• ##### Vercel Releases Open Agents to Support Background AI Coding Workflows

Apr 30, 2026

• ##### Netflix Scales "Human Infrastructure" to Manage Global Live Operations

Apr 30, 2026

• ##### DBmaestro MCP Server Puts Natural Language in Control of Database Pipelines

Apr 30, 2026

**The InfoQ** Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

• Development

• ##### [QCon San Francisco 2026: 12 Tracks Announced](http://www.infoq.com/news/2026/04/qconsf-2026-tracks-announced/ "QCon San Francisco 2026: 12 Tracks Announced")

• ##### [Microsoft's Russinovich and Hanselman Warn AI Is Hollowing out the Junior Developer Pipeline](http://www.infoq.com/news/2026/04/junior-developer-pipeline-crisis/ "Microsoft's Russinovich and Hanselman Warn AI Is Hollowing out the Junior Developer Pipeline")

• ##### [C++26: Reflection, Memory Safety, Contracts, and a New Async Model](http://www.infoq.com/news/2026/04/cpp-26-reflection-safety-async/ "C++26: Reflection, Memory Safety, Contracts, and a New Async Model")

• Architecture & Design

• ##### [Meta's Approach to Migrating their Systems to Post-Quantum Cryptography](http://www.infoq.com/news/2026/04/meta-quantum-crypto-migration/ "Meta's Approach to Migrating their Systems to Post-Quantum Cryptography")

• ##### [Stripe’s Docdb: How Zero-Downtime Data Movement Powers Trillion-Dollar Payment Processing](http://www.infoq.com/presentations/docdb-online-database/ "Stripe’s Docdb: How Zero-Downtime Data Movement Powers Trillion-Dollar Payment Processing")

• ##### [Uber Migrates 75,000+ Test Classes from Junit 4 to Junit 5 Using Automated Code Transformation](http://www.infoq.com/news/2026/04/uber-junit4-junit5-migration/ "Uber Migrates 75,000+ Test Classes from Junit 4 to Junit 5 Using Automated Code Transformation")

• Culture & Methods

• ##### [Driving and Measuring the Impact of Platform Engineering](http://www.infoq.com/news/2026/04/measure-platform-engineering/ "Driving and Measuring the Impact of Platform Engineering")

• ##### [How Observability and Telemetry Can Enhance the Practice of Software Engineering](http://www.infoq.com/news/2026/04/observability-telemetry/ "How Observability and Telemetry Can Enhance the Practice of Software Engineering")

• ##### [Panel: Building a Culture that Works](http://www.infoq.com/presentations/panel-positive-culture/ "Panel: Building a Culture that Works")

• AI, ML & Data Engineering

• ##### [NVIDIA Launches Ising Open Models for Quantum Computing](http://www.infoq.com/news/2026/04/nvidia-ising-quantum/ "NVIDIA Launches Ising Open Models for Quantum Computing")

• ##### [Vercel Releases Open Agents to Support Background AI Coding Workflows](http://www.infoq.com/news/2026/04/vercel-open-agents/ "Vercel Releases Open Agents to Support Background AI Coding Workflows")

• ##### [Agents, Architecture, & Amnesia: Becoming AI-Native Without Losing Our Minds](http://www.infoq.com/presentations/ai-autonomy-continuum/ "Agents, Architecture, & Amnesia: Becoming AI-Native Without Losing Our Minds")

• DevOps

• ##### [Dropbox Redesigns Compaction to Reclaim Space from Underfilled Storage Volumes](http://www.infoq.com/news/2026/04/dropbox-tiered-compaction/ "Dropbox Redesigns Compaction to Reclaim Space from Underfilled Storage Volumes")

• ##### [Netflix Scales "Human Infrastructure" to Manage Global Live Operations](http://www.infoq.com/news/2026/04/netflix-live-human-ops-scale/ "Netflix Scales "Human Infrastructure" to Manage Global Live Operations")

• ##### [DBmaestro MCP Server Puts Natural Language in Control of Database Pipelines](http://www.infoq.com/news/2026/04/dbmaestro-mcp-server/ "DBmaestro MCP Server Puts Natural Language in Control of Database Pipelines")

**The InfoQ** Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

• Get a quick overview of content published on a variety of innovator and early adopter technologies
• Learn what you don’t know that you don’t know
• Stay up to date with the latest information from the topics you are interested in

Enter your e-mail address

Select your country - [x] I consent to InfoQ.com handling my data as explained in this Privacy Notice.

We protect your privacy.

**May 7 | June 10, 2026 | Online** Architecture decisions are hard to validate while shipping. Join a **5-week online cohort** for **senior engineers, architects, and team leads** to pressure-test real decisions, apply practical frameworks, and work through challenges with a confidential peer group. Facilitated by Luca Mezzalira, Principal Architect at AWS, this cohort helps you: * Pressure-test real decisions. * Apply frameworks to real problems. * Publish on InfoQ.com and earn your certification. **RESERVE YOUR PLACE**

[Home](http://www.infoq.com/ "Home")[Create account](http://www.infoq.com/reginit.action "Create account")Log In[QCon Conferences](http://qconferences.com/ "QCon Conferences")Events[Write for InfoQ](http://www.infoq.com/write-for-infoq/ "Write for InfoQ")[InfoQ Editors](http://www.infoq.com/infoq-editors/ "InfoQ Editors")[About InfoQ](http://www.infoq.com/about-infoq/ "About InfoQ")[About C4Media](https://c4media.com/ "About C4Media")[Media Kit](https://get.infoq.com/infoq-mediakit/ "Media Kit")[InfoQ Developer Marketing Blog](https://devmarketing.c4media.com/?utm_source=infoq "InfoQ Developer Marketing Blog")[Diversity](https://c4media.com/diversity "Diversity")

#### Events

• ##### Online InfoQ Architect Certification

May 7, 2026

• ##### QCon AI Boston

June 1-2, 2026

• ##### Online InfoQ Architect Certification

June 10, 2026

• ##### QCon San Francisco

November 16-20, 2026

#### Follow us on

Youtube 232K FollowersLinkedin 26K FollowersInstagram NewRSS 19K ReadersX 57.1k FollowersFacebook 21K LikesBluesky New

#### Stay in the know

The InfoQ PodcastEngineering Culture PodcastThe Software Architects' Newsletter

General Feedback [feedback@infoq.com](mailto:feedback@infoq.com) Advertising [sales@infoq.com](mailto:sales@infoq.com) Editorial [editors@infoq.com](mailto:editors@infoq.com) Marketing [marketing@infoq.com](mailto:marketing@infoq.com)

InfoQ.com and all content copyright © 2006-2026 C4Media Inc.

Privacy Notice, Terms And Conditions, Cookie Policy

Close

[BT](http://www.infoq.com/int/bt/ "bt")