eprint.iacr.orgpaper

N2SF-Based Post-Quantum Cryptography Migration Framework for Data in National and Public Institutions

An IACR ePrint paper proposes PQC migration decision criteria for data held by national and public institutions, derived from South Korea's N2SF (National Network Security Framework) protection requirements and each data object's cryptographic dependencies/operational state. It distinguishes migration actions (payload retention, key rewrapping, re-encryption, communication migration, signature renewal) from execution decisions (allow/defer/deny), requiring consistent completion checks, recoverable registered copies, and current authority. A reference implementation ran 225 policy trials and 9 interruption trials, showing per-stage/completion rechecking prevented unauthorized completions or reads that occurred when reusing initial decisions, and confirmed clean resumption after interruption; institutional approval and production-scale key management remain unvalidated.