--- title: How much will post-quantum migration cost your Java... description: An open-source static auditor called pqc-migration-readiness estimates how much effort a post-quantum cryptography migration will take for Java codebases,... canonical: https://daily.dev/posts/how-much-will-post-quantum-migration-cost-your-java-codebase--gynozwmem twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How much will post-quantum migration cost your Java codebase? | daily.dev og:description: An open-source static auditor called pqc-migration-readiness estimates how much effort a post-quantum cryptography migration will take for Java codebases,... og:url: https://daily.dev/posts/how-much-will-post-quantum-migration-cost-your-java-codebase--gynozwmem og:image: https://api.daily.dev/og/posts/gyNOzWMeM.png og:image:alt: How much will post-quantum migration cost your Java codebase? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How much will post-quantum migration cost your Java codebase? **[Foojay.io](https://daily.dev/sources/foojayio)** · 7 min read · 0 upvotes · 0 comments ## Summary An open-source static auditor called pqc-migration-readiness estimates how much effort a post-quantum cryptography migration will take for Java codebases, without needing a build or classpath. Run across 27 widely used Java projects (Apache MINA SSHD, jjwt, WildFly Elytron, Keycloak, Spring Security, and others), it found the dominant migration cost is not the RSA/EC call sites themselves but concrete key-type coupling throughout code - method signatures and fields typed to RSAPublicKey or ECPrivateKey rather than the generic PublicKey/PrivateKey. The tool acknowledges three key blind spots: its effort figures are an unvalidated heuristic, algorithms chosen via configuration or wrapper APIs are invisible to source scanning, and algorithm names routed through registries (like jjwt's) are missed entirely. The author is soliciting real-world migration commit data to validate the scoring model. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the deadline for migrating away from RSA and ECDSA encryption? NIST IR 8547 deprecates RSA, ECDSA, (EC)DH and related classical algorithms after 2030 and disallows them after 2035. The post-quantum replacement algorithms were finalized by NIST in August 2024 as ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), giving organizations a fixed timeline to plan migrations against. _Teams scoping post-quantum migration timelines can track deadline and standards updates on daily.dev._ ### Why does a Java library using RSA show zero call sites in a cryptography vulnerability scan? A library like jjwt can show zero detected call sites for RSA or ECDSA usage when its signing logic routes algorithm selection through an internal registry or enum rather than literal calls like getInstance("SHA256withRSA"). The static scanner that found this reported 193 structural findings for jjwt despite zero direct call sites, because the coupling exists in key-type handling rather than literal algorithm invocations. _Developers auditing Java crypto usage can follow tooling gaps like registry-routed algorithms on daily.dev._ ### What is the biggest cost driver when migrating a Java codebase to post-quantum cryptography? The dominant cost is concrete key-type coupling, not the cryptographic algorithm calls themselves. Code written against types like RSAPublicKey or ECPrivateKey in method signatures, fields, and casts must be widened to generic PublicKey/PrivateKey or an opaque handle before a post-quantum key can flow through it; this API churn, not the getInstance swap, accounts for most effort in mature libraries like Apache MINA SSHD and Spring Security. _Engineers estimating post-quantum migration work can compare real codebase findings like these on daily.dev._ ## Similar posts on daily.dev - [Guest Post: Why Enterprises Need to Start Post-Quantum Migration Now](https://daily.dev/posts/guest-post-why-enterprises-need-to-start-post-quantum-migration-now-3avzdtz5p) · The Quantum Insider · 0 upvotes · 0 comments - [Post-Quantum Cryptography \(PQC\): Application Security Migration Guide](https://daily.dev/posts/post-quantum-cryptography-pqc-application-security-migration-guide-poup8den1) · Security Boulevard · 0 upvotes · 0 comments - [Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways](https://daily.dev/posts/post-quantum-cryptography-migration-at-meta-framework-lessons-and-takeaways-opv4djlfy) · Facebook Engineering · 0 upvotes · 0 comments - [Post-Quantum Cryptography in Spring Boot: Four Patterns You Can Ship This Sprint](https://daily.dev/posts/post-quantum-cryptography-in-spring-boot-four-patterns-you-can-ship-this-sprint-cfrrb1unn) · InfoQ · 2 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#quantum-computing](https://daily.dev/tags/quantum-computing), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/how-much-will-post-quantum-migration-cost-your-java-codebase--gynozwmem) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How much will post-quantum migration cost your Java codebase?","url":"https://daily.dev/posts/how-much-will-post-quantum-migration-cost-your-java-codebase--gynozwmem","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-much-will-post-quantum-migration-cost-your-java-codebase--gynozwmem"},"datePublished":"2026-10-11T12:29:38.672Z","dateModified":"2026-10-11T12:35:06.150Z","description":"An open-source static auditor called pqc-migration-readiness estimates how much effort a post-quantum cryptography migration will take for Java codebases,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a2d3a75fc1874ff05f76e326ed905ba8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a2d3a75fc1874ff05f76e326ed905ba8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Foojay.io","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Foojay.io","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1820f6a6ae944760aa322b67ed85f848","url":"https://daily.dev/sources/foojayio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-much-will-post-quantum-migration-cost-your-java-codebase--gynozwmem","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,quantum-computing,cryptography","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Foojay.io","item":"https://daily.dev/sources/foojayio"},{"@type":"ListItem","position":3,"name":"How much will post-quantum migration cost your Java codebase?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-much-will-post-quantum-migration-cost-your-java-codebase--gynozwmem#faq","mainEntity":[{"@type":"Question","name":"What is the deadline for migrating away from RSA and ECDSA encryption?","acceptedAnswer":{"@type":"Answer","text":"NIST IR 8547 deprecates RSA, ECDSA, (EC)DH and related classical algorithms after 2030 and disallows them after 2035. The post-quantum replacement algorithms were finalized by NIST in August 2024 as ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), giving organizations a fixed timeline to plan migrations against. Teams scoping post-quantum migration timelines can track deadline and standards updates on daily.dev."}},{"@type":"Question","name":"Why does a Java library using RSA show zero call sites in a cryptography vulnerability scan?","acceptedAnswer":{"@type":"Answer","text":"A library like jjwt can show zero detected call sites for RSA or ECDSA usage when its signing logic routes algorithm selection through an internal registry or enum rather than literal calls like getInstance(\"SHA256withRSA\"). The static scanner that found this reported 193 structural findings for jjwt despite zero direct call sites, because the coupling exists in key-type handling rather than literal algorithm invocations. Developers auditing Java crypto usage can follow tooling gaps like registry-routed algorithms on daily.dev."}},{"@type":"Question","name":"What is the biggest cost driver when migrating a Java codebase to post-quantum cryptography?","acceptedAnswer":{"@type":"Answer","text":"The dominant cost is concrete key-type coupling, not the cryptographic algorithm calls themselves. Code written against types like RSAPublicKey or ECPrivateKey in method signatures, fields, and casts must be widened to generic PublicKey/PrivateKey or an opaque handle before a post-quantum key can flow through it; this API churn, not the getInstance swap, accounts for most effort in mature libraries like Apache MINA SSHD and Spring Security. Engineers estimating post-quantum migration work can compare real codebase findings like these on daily.dev."}}]} ```