COMSEC Modernization & Post-Quantum Cryptography
Multiple cryptographic transitions converge with aggressive deadlines and no integrated compliance platform.
Four Simultaneous Cryptographic Transitions
Communications security has entered a period of simultaneous transformation across multiple dimensions. The Department of Defense is transitioning from legacy EKMSEKMS: Electronic Key Management System infrastructure to the modernized KMIKMI: Key Management Infrastructure. The National Security Agency has published aggressive timelines for post-quantum cryptography adoption under CNSA 2.0. Field programmable encryption devices are achieving certification. Coalition operations require coordination across allied nations with different cryptographic standards.
Each transition introduces compliance requirements that organizations must track independently while managing interdependencies between them.
A system that migrates from EKMS to KMI must also plan for CNSA 2.0 algorithm transitions. Coalition interoperability depends on cryptographic alignment across partner nations whose modernization timelines may differ. Field programmable devices create new audit requirements for over-the-air cryptographic updates.
No compliance platform currently addresses these converging requirements comprehensively. Organizations manage COMSEC compliance through disconnected processes that cannot surface conflicts or optimize transition sequencing.
KMI Transition Delays Create Compliance Uncertainty
The Key Management Infrastructure program represents the modernization path from legacy EKMS to contemporary key management capabilities. KMI CI-3 development began in July 2021 but has experienced schedule slips due to hardware technical refresh requirements, supply chain delays, and expanded functional requirements.
NSA re-baselined the program in September 2023, with Full Deployment Decision now targeted for fiscal year 2027. SOUTHCOM became the first major combatant command with KMI-aware over-the-network key capabilities in April 2025, demonstrating operational viability while highlighting that DoD-wide transition from legacy EKMS remains years away.
Compliance Challenge
- Track which accounts have transitioned to KMI vs. legacy EKMS
- Manage key material generated under different systems
- Different training and certification requirements
- Audit procedures accommodating both architectures
Aggressive Post-Quantum Cryptography Timelines
The Commercial National Security Algorithm Suite 2.0 establishes specific deadlines for post-quantum cryptography adoption. These are not aspirational targets but mandatory requirements for National Security Systems.
Post-quantum code signing required
New NSS systems must follow CNSA 2.0
KMI Full Deployment Decision target
NSA equipment transitions complete
Full quantum-resistant transition
Algorithm Transition Requirements
The transition replaces RSA and elliptic curve cryptography with quantum-resistant alternatives. Organizations must inventory their cryptographic implementations, identify systems using algorithms that will be deprecated, and plan migrations that align with CNSA 2.0 deadlines.
- • Which systems use RSA or ECC that must be migrated?
- • What is the migration timeline for each system?
- • Will current plans achieve compliance before deadlines?
RESCUE Programmable COMSEC Transforms Certification Timelines
Traditional COMSEC devices required depot maintenance for cryptographic updates, creating certification timelines measured in years. When cryptographic vulnerabilities emerged or algorithm updates became necessary, the logistics of physically collecting devices, updating them at secure facilities, and redistributing them created delays incompatible with threat evolution timelines.
RESCUERESCUE: Programmable COMSEC device achieving NSA High Assurance certification programmable COMSEC achieved NSA High Assurance certification in October 2024, enabling field programmable encryption that can be updated without depot maintenance.
Coalition Key Management Adds Combinatorial Complexity
NATO CWIX 2024, the largest digital interoperability exercise ever conducted with over 2,500 participants, highlighted ongoing challenges with different key management systems across member nations.
When coalition forces form for exercises or operations, cryptographic interoperability determines what information can be shared and through what channels. Different nations operate different key management architectures, use different cryptographic standards, and maintain different certification requirements.
A nation that modernizes its cryptographic systems without coordination may find itself unable to communicate with allies who have not yet completed equivalent transitions.
Link 16 crypto modernization across coalition partners requires coordination measured in years. Key material generation and distribution procedures vary by partner capability.
Simultaneous Transitions Require Integrated Management
The challenge facing defense organizations is not any single cryptographic transition but the simultaneous management of multiple transitions with interdependencies. KMI migration must account for CNSA 2.0 requirements. Coalition interoperability planning must consider partner nation modernization timelines. Field programmable COMSEC deployment must align with both KMI transition and post-quantum migration schedules.
System migrated to KMI in 2025 with classical algorithms requires another migration for CNSA 2.0 by 2027
Coalition systems updated without partner coordination may lose communication capability
Field programmable devices deployed without post-quantum firmware will require avoidable updates
Cryptographic Compliance as Continuous Program
COMSEC compliance is not a checkpoint to be achieved but a continuous program that must adapt to evolving requirements, emerging threats, and advancing capabilities.
KMI Transition Dashboards
Account-level tracking from EKMS to KMI with FY27 timeline visibility and hybrid environment support
CNSA 2.0 Readiness Assessment
System inventory mapping against post-quantum requirements with deadline compliance tracking
Algorithm Migration Planning
Roadmaps for transitioning from RSA/ECC to ML-KEM, ML-DSA, and hash-based signatures
Field Programmable Audit Trails
Over-the-air update tracking for RESCUE and similar programmable COMSEC architectures
Coalition Crypto Coordination
Cross-national cryptographic configuration tracking and interoperability planning
Convergence Planning
Integrated transition management that optimizes sequencing across simultaneous modernization programs
Organizations that establish systematic approaches to cryptographic compliance management position themselves to address both current transitions and future requirements efficiently.
Common questions
Which post-quantum algorithms are actually standardised?
NIST finalised its first three post-quantum standards on 13 August 2024: FIPS 203 for key encapsulation based on ML-KEM, FIPS 204 for digital signatures based on ML-DSA, and FIPS 205 for the hash-based signature scheme SLH-DSA. Those are the algorithms to build against today. Selection work has continued for an additional key-encapsulation mechanism to provide mathematical diversity, but a scheme still in the standardisation process is not a basis for a production migration commitment.
What does CNSA 2.0 require and by when?
It sets the quantum-resistant suite for national security systems and a phased timeline running to full adoption by 2035, with earlier dates for particular categories. Code signing is deliberately front-loaded, because a signing key is a long-lived trust anchor: firmware signed today with a classical algorithm may still need to be trusted well beyond the point at which that algorithm is retired. Treating 2035 as the planning date, rather than the category deadlines, is the common misreading.
Why start migrating now if a cryptographically relevant quantum computer does not exist?
Because of harvest-now-decrypt-later, and because migration is slower than it looks. Encrypted traffic collected today can be stored and decrypted once the capability exists, so the relevant question for any data is how long it must stay confidential — and for a great deal of national security information that period comfortably exceeds any plausible timeline. Separately, cryptography is embedded in hardware, protocols, certificates and supplier products that take years to turn over.
What is cryptographic agility and why is it the real deliverable?
The ability to change algorithm without redesigning the system that uses it. Most estates cannot answer basic questions — which systems use which algorithms, with which key sizes, in which protocols, supplied by whom — which means any migration begins with discovery rather than engineering. The organisations that will migrate cheaply are the ones that build that inventory now and remove hard-coded algorithm assumptions, because this transition will not be the last one.
Can we just switch on post-quantum in our existing products?
Only where the supplier has implemented it, validated the implementation, and your peers can negotiate it — which is three separate dependencies, each outside your control. Hybrid modes that run a classical and a post-quantum algorithm together are widely used during transition precisely because interoperability lags standardisation. The practical constraint on most estates is the supply chain and the certificate hierarchy, not the algorithms themselves.
Regulatory state described as of August 2026. Requirements change; verify against the current rule before relying on any date above.
From EKMS to KMI. From RSA to ML-KEM. We track it all.
Assess your organization's cryptographic modernization posture against KMI transition timelines and CNSA 2.0 deadlines. See how Thalorin provides visibility into compliance status across all active transitions.