{
    "status": "pilot",
    "generated": "2026-11-04",
    "disclaimer": "Illustrative reference service. Readiness comes only from editor-approved PQC navigator assertions; a product that supports an algorithm does not mean the service can migrate. Dates are unknown unless published; nothing here is agreed between parties. Not compliance advice.",
    "service": {
        "id": "ipsec-site-to-site",
        "title": "Site-to-site IPsec VPN (IKEv2) between two organisations",
        "illustrative": true,
        "summary": "Two organisations connect their networks with an IKEv2 tunnel between one gateway each, authenticated with certificates, over a transit network run by a provider. Neither organisation can migrate the tunnel alone.",
        "limitations": "A generic template. The post-quantum key exchange for IKEv2 is a draft on the date read; the multiple-key-exchange and intermediate-exchange RFCs it builds on are published. Post-quantum authentication of the gateways is not assessed here.",
        "compiled": "2026-10-23"
    },
    "components": [
        {
            "id": "own-gateway",
            "label": "Own VPN gateway",
            "controlled_by": "Own organisation",
            "function": "VPN / IPsec key exchange",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "partner-gateway",
            "label": "Partner organisation's VPN gateway",
            "controlled_by": "Counterparty (the other organisation or its users)",
            "function": "VPN / IPsec key exchange",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "transit-network",
            "label": "Transit network between the two sites",
            "controlled_by": "Network, CDN or hosting provider",
            "function": null,
            "chosen_release": null,
            "readiness": "Not covered by the product navigator",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "tunnel-agreement",
            "label": "Agreed IKEv2 proposal between the two gateways",
            "controlled_by": "All parties of the service jointly",
            "function": "VPN / IPsec key exchange",
            "chosen_release": null,
            "readiness": "No agreement recorded between the parties",
            "assertion": null,
            "depends_on": [
                "own-gateway",
                "partner-gateway",
                "transit-network"
            ],
            "blocked_by": [
                "own-gateway",
                "partner-gateway",
                "transit-network"
            ]
        },
        {
            "id": "gateway-certificates",
            "label": "Certificates authenticating the gateways",
            "controlled_by": "Certificate authority or trust service provider",
            "function": "PKI / CA certificate issuance",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        }
    ],
    "plan": [
        {
            "party": "own-organisation",
            "party_label": "Own organisation",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "own-gateway",
            "component_label": "Own VPN gateway",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Own VPN gateway and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "counterparty",
            "party_label": "Counterparty (the other organisation or its users)",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "partner-gateway",
            "component_label": "Partner organisation's VPN gateway",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Partner organisation's VPN gateway and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "network-provider",
            "party_label": "Network, CDN or hosting provider",
            "step": "configuration",
            "step_label": "Compatible configuration agreed",
            "component": "transit-network",
            "component_label": "Transit network between the two sites",
            "readiness": "Not covered by the product navigator",
            "action": "Confirm with the provider of Transit network between the two sites that the larger key exchange messages and their fragments pass.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "configuration",
            "step_label": "Compatible configuration agreed",
            "component": "tunnel-agreement",
            "component_label": "Agreed IKEv2 proposal between the two gateways",
            "readiness": "No agreement recorded between the parties",
            "action": "Agree Agreed IKEv2 proposal between the two gateways between the parties concerned and record who agreed and when.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-own-gateway",
                "c-partner-gateway",
                "c-transit-network"
            ],
            "waits_for_labels": [
                "Own VPN gateway",
                "Partner organisation's VPN gateway",
                "Transit network between the two sites"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "ca-trust-service",
            "party_label": "Certificate authority or trust service provider",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "gateway-certificates",
            "component_label": "Certificates authenticating the gateways",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Certificates authenticating the gateways and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "interop-test",
            "step_label": "Interoperability test",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Run a joint interoperability test of the whole chain in a test environment and record its scope and result.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-own-gateway",
                "c-partner-gateway",
                "c-transit-network",
                "c-tunnel-agreement",
                "c-gateway-certificates"
            ],
            "waits_for_labels": [
                "Own VPN gateway",
                "Partner organisation's VPN gateway",
                "Transit network between the two sites",
                "Agreed IKEv2 proposal between the two gateways",
                "Certificates authenticating the gateways"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "pilot",
            "step_label": "Pilot",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Pilot the service with a limited group, keeping the classical fallback.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-interop-test"
            ],
            "waits_for_labels": [
                "Interoperability test"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "rollout",
            "step_label": "Staged rollout",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Roll out in stages agreed by every party.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-pilot"
            ],
            "waits_for_labels": [
                "Pilot"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "validation",
            "step_label": "Validation",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Validate that the post-quantum mechanisms are actually negotiated or verified on every hop.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-rollout"
            ],
            "waits_for_labels": [
                "Staged rollout"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "retire-legacy",
            "step_label": "Retirement of the legacy fallback, when authorised",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Retire the classical-only fallback only when every party has authorised it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-validation"
            ],
            "waits_for_labels": [
                "Validation"
            ],
            "date": "Unknown: no date published or agreed"
        }
    ],
    "milestones": [
        {
            "id": "eu-pqc-milestone-2026",
            "date": "2026-12-31",
            "date_text": "By 31 December 2026",
            "title": "EU roadmap milestone 1: first steps and national roadmaps",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        },
        {
            "id": "eu-pqc-milestone-2030",
            "date": "2030-12-31",
            "date_text": "By 31 December 2030",
            "title": "EU roadmap milestone 2: high-risk use cases migrated",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        },
        {
            "id": "joint-statement-18-member-states",
            "date": "2024-11-27",
            "date_text": null,
            "title": "Joint statement of national agencies: protect the most sensitive use cases by 2030",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        }
    ],
    "interop": []
}