The EU-funded PostQat project began on September 1, 2026, according to its European Commission CORDIS fact sheet. The project will examine post-quantum secure communications and surveillance for air traffic management, including ground-to-ground, air-to-ground, and air-to-air environments. Its stated work includes identifying high-impact use cases, defining requirements, adapting standardized PQC to aviation constraints, and designing a public-key infrastructure and crypto-agility blueprint.
The project’s start is timely because aviation makes the hidden dimensions of cryptographic migration impossible to ignore. A change can affect safety, interoperability, certification, long-lived equipment, constrained communications, and multiple independent operators. Replacing an algorithm is only one part of the system change.
Start with functions and trust relationships
Air traffic management is not one application or one network. It contains surveillance, command and control, messaging, identity, ground systems, aircraft systems, and links with different performance and assurance requirements. Some technologies were designed when bandwidth, computing, and trust assumptions differed from today’s environment.
A useful cryptographic inventory must therefore capture more than algorithm names. It should identify the protocol and message, the security function required, the communicating parties, the signer and verifier populations, key custody, trust anchors, implementation location, update mechanism, latency and bandwidth constraints, and the operational consequence of failure.
The distinction between confidentiality, integrity, origin authentication, and availability is especially important. Harvest-now-decrypt-later risk may drive early protection for sensitive communications. Authentication migration addresses forgery and trust, but can require coordinated changes across issuers, verifiers, embedded equipment, and offline processes. Priorities should reflect both the threat horizon and the time needed to change the complete dependency chain.
Safety-critical migration needs representative evidence
Post-quantum keys, ciphertexts, and signatures can differ substantially in size and performance from familiar public-key mechanisms. Whether that matters depends on the surrounding system. A primitive-level benchmark does not show the effect on message size, channel utilization, latency, retries, processor load, memory, timing guarantees, or degraded-mode operation.
Aviation testing must represent the actual link, equipment, message patterns, environmental constraints, and failure scenarios. Teams should measure normal operations as well as congestion, packet loss, key rollover, invalid credentials, partial upgrades, recovery, and fallback. They should also preserve the configuration, version, method, timestamp, and responsible party behind each result.
The CORDIS description says PostQat will align its work with aviation certification frameworks. That matters because implementation success and approval are different milestones. A technically functional prototype may still require extensive assurance evidence, safety analysis, interoperability work, and governance before operational adoption.
Mixed fleets make crypto agility concrete
Aviation systems do not upgrade simultaneously. Aircraft, airports, service providers, regulators, and vendors operate on different investment and certification cycles. During migration, classical and post-quantum capabilities may coexist for years. The system must know which peers support which mechanisms, what policy permits, and how a downgrade or unsupported path is handled.
Crypto agility in this context is not a runtime algorithm switch alone. It includes the ability to discover dependencies, introduce new identifiers and credentials, update implementations, coordinate trust, test mixed states, change policy, monitor negotiated outcomes, and retire old mechanisms with evidence. It also requires rollback and exception handling that do not compromise safety.
Inventory records should represent planned state alongside observed state. Owners need to see the current mechanism, target mechanism, blocking dependency, supplier milestone, certification status, test evidence, exception, and retirement criteria. That turns a distant roadmap into a sequence of governable decisions.
PKI migration extends beyond certificates
PostQat’s objective includes a PKI blueprint. In practice, PKI change reaches certificate authorities, registration processes, key-generation and custody systems, certificate profiles, directories, revocation, trust stores, validation software, audit procedures, and relying applications. Long-lived or intermittently connected equipment makes distribution and trust-anchor change particularly consequential.
Teams should inventory both issuers and verifiers. They should know which devices can accept new algorithms and larger objects, which require firmware or hardware changes, who controls those updates, and how long deployment takes. An issuing service supporting a PQC certificate does not create readiness if the intended relying parties cannot validate it.
What critical-system owners should do now
- Inventory by mission function. Connect protocols and cryptographic dependencies to operational purpose and failure impact.
- Map trust end to end. Record issuers, holders, verifiers, trust anchors, key custody, and update authority.
- Measure in context. Test full messages and workflows under realistic timing, bandwidth, load, failure, and recovery conditions.
- Track assurance separately. Distinguish implemented, interoperable, tested, certified, approved, and deployed states.
- Plan mixed operation. Define downgrade controls, exceptions, rollback, monitoring, and retirement evidence.
How Vista Platform helps
Vista Platform is a self-hosted cryptographic system of record. Its operating loop is discovery, canonical inventory, evaluation, action, and proof. Vista Platform Core is free of charge and includes discovery, inventory, compliance and PQC assessment, and CBOM generation without asset, sensor, seat, or time caps.
Vista can help organizations connect cryptographic observations with owners, policies, migration actions, and evidence across complex environments. It tracks and governs post-quantum migration; it does not generate PQC keys, certify aviation systems, or perform every migration step. Vista is not a vulnerability scanner. Selected-asset Active Scan is not indiscriminate network scanning, and gaps in discovery do not prove absence. Teams can review the evaluation approach on Try Vista.
Where uncertainty remains
PostQat has just begun and its fact sheet describes objectives rather than completed findings. The project is scheduled through February 2029, so proposed blueprints, benchmarks, and roadmaps will require future review. The fact sheet identifies its European Commission signature date as April 29, 2026; its relevance today is the September 1 project start. Organizations should treat the work as a source of forthcoming evidence, not as current operational guidance or certification.
Sources
- Post-Quantum Secure Communication and Surveillance for Air Traffic Management (PostQat), European Commission CORDIS project fact sheet, EC signature April 29, 2026; project start September 1, 2026.
- RFC 9958: Post-Quantum Cryptography for Engineers, RFC Editor, June 2026.