Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways

Meta shares its framework and lessons learned from migrating to post-quantum cryptography (PQC) across its infrastructure. The post introduces a PQC Migration Levels model (PQ-Unaware → PQ-Enabled) to help organizations assess readiness, and outlines a six-step migration strategy covering prioritization, cryptographic inventory, external dependencies, component design, guardrails, and integration. Key recommendations include adopting NIST-standardized algorithms ML-KEM and ML-DSA, using a hybrid classical+PQC approach during the transition, building automated crypto discovery tooling, and implementing guardrails to prevent new quantum-vulnerable key creation. Meta also highlights its contributions to HQC, BIKE, and LibOQS, and warns about the 'store now, decrypt later' threat that makes early action critical even before quantum computers exist.