The Program, Not the Algorithm, Is the Unit of Migration

Post-quantum migration is a systems program, not an algorithm swap, because the cryptographic decision is distributed across a protected path. Protocols coordinate peers, certificates establish identity, libraries and hardware perform operations, clients determine what is negotiated, and organizational policy decides which choices may continue. The final judgment is practical: an organization should call a path ready only when it can define the data and endpoints involved, locate the change surfaces, observe the intended behavior, control the exceptions, and retire vulnerable alternatives without pretending that uncertainty has vanished.

flowchart LR T["Threat and data criticality"] --> P["Define end-to-end path"] P --> I["Inventory change surfaces"] I --> D["Protocol and trust changes"] I --> S["Software, hardware, and legacy controls"] I --> Q["Supplier and refresh constraints"] D --> X["Staged migration and hybrid decision"] S --> X Q --> X X --> V["Test and observe actual behavior"] V --> R["Enforce policy and retire vulnerable paths"] R --> M["Measure maturity and feed the next transition"] M --> I

The loop is not a promise that every organization will use the same architecture or sequence. It is a way to keep the causal relationships visible. Threat and data value determine why a path matters. The path determines which protocols, certificates, clients, libraries, devices, suppliers, and operators participate. Those boundaries determine whether a staged change is possible. Testing determines whether the intended state was reached. Policy and measurement determine whether it stays reached and whether the organization can respond when the next requirement arrives.

The unit of change is the protected path

An algorithm is a necessary design choice, but it is too small to be the unit of migration. It does not tell you which peers must recognize the choice, which certificate authority must issue credentials, which trust stores must accept them, which API exposes the operation, which hardware can perform it, or which policy stops the older alternative. The protected path is the larger unit because it connects the cryptographic operation to the service and data whose security must persist.

Consider a service that establishes a session with a client. The client and server need a common protocol and an acceptable key-establishment method. The selected method may be hybrid, combining a traditional exchange with a PQC mechanism, or it may remain classical because of capability, policy, or compatibility. The server's certificate then has to authenticate the service through a trust path the client accepts. A library, operating system, proxy, or hardware module may implement the operations, and a policy may distinguish creating new protection from recovering older data. The session is the outcome of all these relationships, not of the algorithm name alone.

This is why support, use, and retirement must be reported separately. A library can support a new operation that no deployment enables. A server can enable it that no relevant client negotiates. A client and server can negotiate it while the certificate remains classical. A service can use the intended path for current browsers while older clients fall back. An organization can prohibit a vulnerable choice for new encryption while still retaining a narrowly controlled ability to decrypt existing records. These states are different, and collapsing them into one readiness label hides the work that remains.

The supplied Internet measurement gives this distinction an empirical anchor. In its sample of 32,011 domains, the study reports TLS 1.3 for 52.41%, TLS 1.2 for 15.70%, and QUIC through HTTP/3 for 31.89%, with HTTP/3 counted as TLS 1.3 in the study. It also reports hybrid X25519MLKEM768 key exchange for 49.30% and classical or otherwise quantum-vulnerable groups for 50.70%. Those figures describe a transition in progress within a defined sample. They do not establish complete quantum resilience, because negotiated key exchange is only one part of the path and the study reports that its observed certificate signatures were still classical.

The study's same-domain, different-device observation makes the point more sharply than a percentage. One device reached the banking domain through QUIC and TLS 1.3 with X25519 and AES-256-GCM; another used TLS 1.2 with ECDHE-RSA and AES-128-GCM. The observation is illustrative, not a universal explanation of all client behavior. It does show that the server is not the sole owner of the connection's cryptographic state.