RACAF-PQC: A Risk-Aware Crypto-Agility Framework for Post-Quantum Secure Communication with Experimental Validation of Security, Performance and Migration Decisions

Abstract

The emergence of cryptographically relevant quantum computing presents a fundamental challenge to contemporary public-key cryptography because Shor's algorithm can solve the integer-factorization and discrete-logarithm problems on which widely deployed RSA and elliptic-curve cryptographic systems rely. Although standardized post-quantum cryptographic (PQC) algorithms are now available, migration from classical cryptography to quantum-resistant systems is not a simple algorithm-selection problem. Different applications impose different requirements with respect to security strength, computational cost, communication overhead, interoperability, algorithmic diversity, and crypto-agility. This paper proposes RACAF-PQC, a Risk-Aware Crypto-Agility Framework for post-quantum migration decision-making. The framework introduces a Post-Quantum Migration Readiness Index (PMRI) that integrates six normalized criteria: security adequacy, computational performance, communication efficiency, algorithmic diversity, interoperability, and crypto-agility. Six cryptographic configurations are evaluated across five application scenarios: low-risk web communication, enterprise systems, high-confidentiality systems, constrained Internet-of-Things (IoT) environments, and critical infrastructure. The proposed framework is experimentally validated using a reproducible multi-criteria computational experiment and a 10,000-trial sensitivity analysis. Results show that the framework selects ML-KEM-512 for resource-sensitive environments and an ECDHE+ML-KEM-768 hybrid configuration for enterprise, high-confidentiality, and critical-infrastructure scenarios. Relative to a fixed ML-KEM-768 strategy, RACAF-PQC produces scenario-dependent decision improvements ranging from 0.7% to 8.8%, with a mean improvement of approximately 5.0%. Relative to classical-only migration, the corresponding mean improvement is approximately 42.0%. Sensitivity analysis demonstrates that the principal selections remain stable under perturbation of the decision weights, with selection stability reaching 100% for enterprise systems and 99.42% for critical infrastructure. The results demonstrate that post-quantum migration can be improved by treating cryptographic agility and application-specific risk as explicit decision variables rather than adopting a single universal algorithm. The study provides a mathematically transparent and reproducible framework for PQC migration planning while avoiding unsupported claims of hardware-level performance.