# Quantum-Safe: a trust infrastructure roadmap

A roadmap for post-quantum cryptography across certificate management, key protection, signing and verification. It separates local signing, server signing and evidence services, prioritising one pilot route rather than claiming ecosystem-wide readiness.

## Problem

Keys, certificates and records have different lifecycles and compatibility. Algorithm migration must cover signer and recipient, certificate chains and validation policy.

## Scope

- Trusted Key for local signing; HSMs for infrastructure keys and server routes under specific configurations.
- Composite at key, certificate and document-envelope layers represents three separate configurations.
- Service rollout follows dependencies, testing and acceptance gates.

## Boundaries

The roadmap to 2029 and macOS 2028 are not current capabilities. Module or ISMS certifications do not automatically cover the ecosystem or every algorithm/configuration.

## Prerequisites

- Inventory assets, recipients, operating systems, CA/HSM and target applications.
- Agree profiles, formats, certificate chains, validation policy and rollback.

## Pilot

Choose one issuance–signing–verification route on a fixed combination. Test invalid chains, wrong algorithms, altered data, revocation and recipient compatibility; retain reproducible evidence.

## Source document

https://docs.mobile-id.vn/Proposals/MobileID_QuantumSafe_Ecosystem_Proposal_V5.pdf

V5; 71 pages; Vietnamese PDF.

Observed source version; confirm implementation scope.
- Scope and priorities: 3
- Capabilities and prerequisites: 8
- Architecture and composite: 10
- Local signing and records: 22
- Roadmap and acceptance: 35
- Verification appendices: 48