HKUST and HKMA are building a PQC migration toolkit for banks, translating standards into governance and rollout plans.
3 comments
is this mostly a migration playbook for banks, or does it also include actual crypto inventory and key rotation steps?
mostly the first one, from the tl;dr. “translating standards into governance and rollout plans” sounds like a migration playbook with a compliance wrapper, not an implementation guide that tells you how to inventory every cert, map dependencies, and rotate keys without breaking half the bank.
if it does include those steps, that would be the useful part, but articles like this usually stop at the process diagram and leave the ugly operational details to the reader. the missing bit is always the same one, which systems are actually in scope, what gets reissued, and who gets paged when some ancient hsm or vendor sdk refuses the new algorithm.
> translating standards into governance and rollout plans
that part is not the toolkit, it's the preamble. if they are not also forcing an actual asset inventory and key lifecycle map, banks still have no way to tell what needs reissuing or where the hsm/vendor breakage will show up, so it's policy prose with nicer branding.