PQC migration checkpoints of shared services

The checkpoints a post-quantum migration of a shared service goes through, who owns each one by role, what it waits for, the kind of each date and what a slip would delay. External prerequisites such as standards and industry rules carry their real status from recorded sources.

Reference model, not an agreed plan. No participant has agreed this plan and no coordination governance exists, so no checkpoint is agreed, no date is participant-agreed and no operational board is active. Participant checkpoints are proposed and undated. Owners are roles, never people. Not compliance advice.

Choose a reference service

Proposed, agreed and completed: Site-to-site IPsec VPN (IKEv2) between two organisations

10 checkpoints: 9 proposed, 0 agreed, 1 completed.

Nothing is agreed: no governance between participants exists. Completed checkpoints are external prerequisites whose completion a recorded source shows.

Planned dates by kind

Unknown: no date published or agreed: 8
Vendor roadmap date: 0
Official guidance target: 2
Verified legal obligation: 0
Participant-agreed date: 0

Readiness of the components and the action plan of this service

Checkpoint board

Stages give an order, not a schedule: a checkpoint is in a later stage than everything it waits for. Checkpoints in one stage can run in parallel; checkpoints that wait for each other share a stage and are agreed together.

Checkpoints of the service with owner, dependencies, dates, state and evidence
Stage	Checkpoint	Owner (role)	Depends on	Planned date and its kind	State	Completed	Acceptance evidence	Blocker	Next review	A slip affects
Stage 1	Multiple key exchanges in IKEv2 published as an RFC External prerequisite	Standards body or supervisor (outside the plan)	Nothing	Unknown: no date published or agreed	Completed	2023: RFC 9370, Proposed Standard, 2023.	A Standards Track RFC. RFC 9370: Multiple Key Exchanges in the Internet Key Exchange Protocol Version 2 (IKEv2) (Proposed Standard, published 2023; read 2026-10-23)	Nothing	No review cycle agreed	5 checkpoints
Stage 1	Inventory of the tunnel, both gateways and the transit path Participant checkpoint	Own organisation	Nothing	Official guidance target: 2026-12-31 EU roadmap first steps, which include inventories, by the end of 2026: a guidance target, not a legal deadline. EU roadmap milestone 1: first steps and national roadmaps	Proposed Can start: nothing it depends on is open	Not completed	Gateway products and releases on both sides and the transit providers recorded.	Nothing	No review cycle agreed	7 checkpoints
Stage 2	ML-KEM in IKEv2 published as an RFC External prerequisite	Standards body or supervisor (outside the plan)	Multiple key exchanges in IKEv2 published as an RFC	Unknown: no date published or agreed	Proposed Can start: nothing it depends on is open	Not completed	An RFC with assigned transform identifiers. Post-quantum Hybrid Key Exchange with ML-KEM in IKEv2 (draft-ietf-ipsecme-ikev2-mlkem) (Internet-Draft, revision 09 of 5 July 2026, in the RFC Editor queue, intended Proposed Standard; not yet an RFC; read 2026-10-23)	Still an Internet-Draft in the RFC Editor queue (revision 09, read again on 30 October 2026).	2027-01-28	4 checkpoints
Stage 2; agreed together with Partner gateway: proposal with an additional ML-KEM key exchange	Own gateway: proposal with an additional ML-KEM key exchange Participant checkpoint · Own VPN gateway	Own organisation	Inventory of the tunnel, both gateways and the transit path; Partner gateway: proposal with an additional ML-KEM key exchange	Unknown: no date published or agreed	Proposed Waiting for open dependencies	Not completed	A proposal the partner gateway can accept, recorded with the release that supports it.	Nothing	No review cycle agreed	5 checkpoints
Stage 2; agreed together with Own gateway: proposal with an additional ML-KEM key exchange	Partner gateway: proposal with an additional ML-KEM key exchange Participant checkpoint · Partner organisation's VPN gateway	Counterparty (the other organisation or its users)	Own gateway: proposal with an additional ML-KEM key exchange	Unknown: no date published or agreed	Proposed Can start: nothing it depends on is open	Not completed	A proposal the own gateway can accept, recorded with the release that supports it.	Nothing	No review cycle agreed	5 checkpoints
Stage 2	Transit network passes IKE fragments and the larger messages Participant checkpoint · Transit network between the two sites	Network, CDN or hosting provider	Inventory of the tunnel, both gateways and the transit path	Unknown: no date published or agreed	Proposed Waiting for open dependencies	Not completed	A test or a provider statement that fragmented IKE messages pass on the path.	Nothing	No review cycle agreed	4 checkpoints
Stage 3	Tunnel configuration agreed between both organisations Participant checkpoint · Agreed IKEv2 proposal between the two gateways	All parties of the service jointly	Own gateway: proposal with an additional ML-KEM key exchange; Partner gateway: proposal with an additional ML-KEM key exchange; Transit network passes IKE fragments and the larger messages; ML-KEM in IKEv2 published as an RFC	Unknown: no date published or agreed	Proposed Waiting for open dependencies	Not completed	The agreed proposal, the fallback and the rekey policy, recorded with who agreed and when.	Nothing	No review cycle agreed	3 checkpoints
Stage 4	Joint tunnel test between the two gateways Participant checkpoint	All parties of the service jointly	Tunnel configuration agreed between both organisations	Unknown: no date published or agreed	Proposed Waiting for open dependencies	Not completed	A test record showing the ML-KEM exchange negotiated, including rekeying.	Nothing	No review cycle agreed	2 checkpoints
Stage 5	Production tunnel switched to the agreed proposal Participant checkpoint	All parties of the service jointly	Joint tunnel test between the two gateways	Official guidance target: 2030-12-31 EU roadmap target for high-risk use cases by the end of 2030; it applies only if the service is classed high-risk. EU roadmap milestone 2: high-risk use cases migrated	Proposed Waiting for open dependencies	Not completed	Both gateways log the additional key exchange on the production tunnel.	Nothing	No review cycle agreed	1 checkpoint
Stage 6	Classical-only proposal removed, when both organisations authorise it Participant checkpoint	All parties of the service jointly	Production tunnel switched to the agreed proposal	Unknown: no date published or agreed	Proposed Waiting for open dependencies	Not completed	A recorded authorisation of both organisations.	Nothing	No review cycle agreed	0 checkpoints

Mutual dependencies and parallel work

Checkpoints that wait for each other

They have no order between them: the parties agree them together. No date is derived for them.

Own gateway: proposal with an additional ML-KEM key exchange; Partner gateway: proposal with an additional ML-KEM key exchange

Checkpoints that can start now, in parallel

Stage 2: ML-KEM in IKEv2 published as an RFC; Partner gateway: proposal with an additional ML-KEM key exchange

If a checkpoint slips

Choose a checkpoint to see every checkpoint that waits for it, directly or further down. The portal does not compute new dates: where an affected checkpoint has a dated target, that target may no longer hold.

Kinds of date, kept apart

Unknown: no date published or agreed: Nothing published or agreed. Unknown dates stay unknown; the portal never fills them in.
Vendor roadmap date: A target a supplier announced for a release. A roadmap is not a release; shown only once an editor approved the vendor evidence in the product navigator.
Official guidance target: A date an authority sets as guidance, as the PQC migration timeline records it. Not a legal deadline and not agreed between the parties.
Verified legal obligation: A date a recorded legal act sets. None of the reference services has one.
Participant-agreed date: A date the parties of a service agreed. None exists: this is a reference model.