Training Course Professional

Quantum-Safe Network Architecture

Designing network architectures resilient to quantum attack: hybrid cryptography, crypto-agility, and segmentation.

Full day (6 hours)

Certificate on completion

Enquire About This Course View Curriculum

Proud to recommend our expert members

Course Overview

For network security architects and infrastructure leads. Covers TLS 1.3 hybrid mode deployment (ML-KEM + X25519), quantum-safe VPN configuration (IPsec IKEv2 PQC, WireGuard Rosenpass), certificate lifecycle management under PQC (CA hierarchy migration, ACME automation, OCSP/CRL scaling), internal network PQC for zero trust microsegmentation, and DNSSEC with ML-DSA zone signing.

Curriculum

Course content is structured into sessions below. Each session is configurable to your organisation's environment, threat model, and objectives.

#	Session	Topics
1	The Quantum Threat to Network Architecture Why every network layer from perimeter to internal segments requires PQC migration
2	TLS 1.3 Hybrid Mode Deployment Migrating web-facing and internal TLS to post-quantum key exchange	TLS 1.3 hybrid key exchange: ML-KEM-768 + X25519 combined key encapsulation. Handshake size increase (approximately 1,100 bytes additional), latency impact, and client compatibility considerations. Certificate chain migration: ML-DSA-65 leaf and intermediate certificates. ServerHello size increase (approximately 8 KB versus ECDSA) and implications for TCP initial congestion window. Deployment sequencing: enabling hybrid TLS on reverse proxies and load balancers first, monitoring connection success rates, then extending to internal service-to-service TLS.
Break
3	Quantum-Safe VPN Configuration IPsec IKEv2 and WireGuard PQC migration	IPsec IKEv2 PQC: ML-KEM key agreement for Security Association establishment. Hybrid mode configuration on common VPN concentrators (Cisco, Palo Alto, Fortinet). Throughput benchmarks with PQC overhead. WireGuard PQC: post-quantum key exchange proposals and implementation status. Rosenpass as an interim PQC layer for WireGuard deployments. Site-to-site and remote access VPN: different migration priorities. Remote access VPN (internet-facing, higher HNDL exposure) before site-to-site (typically private circuits, lower harvest risk).
4	Certificate Lifecycle Management Under PQC PKI migration, certificate automation, and trust chain management	CA hierarchy migration: root CA re-signing with ML-DSA, cross-signing for backward compatibility during transition, and trust store update coordination Certificate automation: ACME protocol PQC support, cert-manager integration, and automated renewal for larger PQC certificates OCSP and CRL scaling: ML-DSA signature sizes increase OCSP response and CRL sizes. Stapling strategies and CDN distribution for large CRL payloads.
Break
5	Internal Network Segmentation and East-West Traffic Extending PQC protection beyond the perimeter	Zero trust architecture and PQC: mutual TLS with PQC certificates for microsegmentation. Service mesh mTLS migration (Istio, Linkerd) as covered in the cloud-native workshop, summarised here for network architects. DNS security: DNSSEC with ML-DSA zone signing. Response size implications (ML-DSA-65 signatures are approximately 2.5 KB) and resolver compatibility. Network monitoring: ensuring IDS/IPS and traffic analysis tools can parse PQC handshakes. Updated Suricata and Zeek rule sets for hybrid TLS.
6	Standards, Compliance, and Migration Roadmap Regulatory drivers and sequenced implementation plan	NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) implementation timelines. CNSA 2.0 network encryption deadlines. ENISA, BSI, ANSSI, and UK NCSC guidance on network PQC migration priorities Migration sequencing: internet-facing TLS first, then VPN, then internal east-west, then DNS. Rollback procedures and monitoring for each phase.
7	Q&A and Migration Planning

Designed and Delivered By

Training courses are designed and delivered by QSECDEF in collaboration with subject specialists. All instructors have direct experience in quantum technologies and security.

QSECDEF brings expertise in post-quantum cryptography, quantum computing strategy, and defence-grade security assessment. Our membership spans 900+ organisations and 1,500+ professionals working at the intersection of quantum technologies and critical infrastructure security.

Enquire About This Course

Get in touch to discuss scheduling, group pricing, and how this course can be configured to your organisation's needs.

Training Courses Consulting Services Training

Quantum-Safe Network Architecture

Course Overview

Curriculum

Designed and Delivered By

Quantum Security Defence

Enquire About This Course