Post-Quantum Cryptography Readiness for Indian e-Government Systems: A Migration Framework

The public-key cryptography that protects government websites, digital signatures, identity services and data exchange would be broken by a large fault-tolerant quantum computer. Although such a machine does not yet exist, sensitive data captured today can be stored and decrypted later, and large government systems take many years to change. Standards bodies have now published the first post-quantum cryptographic algorithms, and security agencies advise organisations to start preparing. This paper proposes a practical, six-stage migration framework for Indian e-government systems: (1) governance and ownership; (2) cryptographic discovery and inventory; (3) risk-based prioritisation using data shelf-life; (4) crypto-agile architecture and procurement; (5) phased migration with hybrid deployment and testing; and (6) assurance and continuous monitoring. It offers a simple prioritisation matrix, a checklist of procurement clauses and a set of readiness indicators that state IT departments and ministries can adopt. The framework is written for public-sector programme managers rather than cryptographers, and focuses on the organisational work that determines whether technical migration succeeds. It is a practitioner framework based on published standards and guidance; it does not evaluate specific products.