Most “crypto-agility” pitches never leave the compliance slide deck. South Korea’s defense establishment just put it inside a SIM card.
On October 26, IDEMIA Secure Transactions and KT (under South Korea’s 2026 PQC Pilot Conversion Project, run by MSIT and KISA) began testing a Quantum-Resistant SIM that runs NIST’s FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA) side-by-side with Korea’s own KpqC algorithms — in the same secure element, for the Ministry of National Defense and the Army Information and Communication School.
Hardware, not just policy. The SIM acts as a tamper-resistant root of trust, generating and protecting session keys and offloading lattice-based handshakes from the host device – tactical smart units, military PCs, drone ground control, CCTV/video evidence archives, and private 5G authentication are all in scope.
Crypto-agility, demonstrated. The point isn’t that two algorithm families exist together – it’s that the pilot is built to alternate between standards without rewriting application software, so a future NIST update or a KpqC revision doesn’t force a device redesign.
No production date yet. This is explicitly a pilot, with a stated ambition to migrate critical national infrastructure “over the next decade.” Treat it as a proof of concept worth studying, not a shipped product.
Bottom line: crypto-agility isn’t just a CBOM spreadsheet or a migration roadmap – it has to survive contact with firmware and secure elements, where most enterprise crypto inventories never look. If your CBOM stops at the application layer, you have a blind spot exactly where this pilot is aimed.
QuantVision’s discovery reaches into that same layer – HSMs, secure elements, and PKI – so algorithm coexistence doesn’t become a surprise during migration.
How deep does your organization’s crypto inventory actually go – down to the chip, or just the app?
#PostQuantumCryptography #PQC #CryptoAgility #CISO #QuantumSafe #Cybersecurity #NIST #ZeroTrust #5G #InfoSec