Post-Quantum Cryptography Migration in Communication Networks: A Systematic Review of Protocol Integration, Performance Trade-Offs, and Transition Readiness

The prospect of a cryptographically relevant quantum computer (CRQC) undermines the public-key primitives that secure virtually every layer of modern communication networks, from subscriber authentication in cellular cores to transport-layer key exchange. Adversaries already following a harvest-now, decrypt-later (HNDL) strategy make this threat actionable today for any traffic whose confidentiality must outlast a decade. Following NIST’s finalisation of the first post-quantum cryptography (PQC) standards, ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) in August 2024, and the selection of HQC as a fourth key-encapsulation candidate in March 2025, research has shifted from algorithm design to network-level integration. This paper reports a PRISMA-2020-compliant systematic literature review of PQC migration in communication networks, structured around five research questions covering protocol and scenario coverage, quantitative performance impact, hybrid cryptography strategies, transition barriers, and open research gaps. Six databases (IEEE Xplore, Scopus, Web of Science, ACM Digital Library, SpringerLink, and MDPI) were searched (3229 records identified); after deduplication, title-keyword screening, full-text eligibility assessment, and a pre-specified quality appraisal (Q1–Q6, threshold ≥3/6) applied to 310 eligible studies, a final synthesis corpus of 141 studies (68 journal articles, 68 conference papers, 4 conference-derived book chapters, 1 workshop paper) was screened, quality-appraised, and synthesised narratively with supporting evidence tables. The review finds that transport-layer protocols (TLS 1.3, QUIC, DTLS 1.3) dominate the literature, that lattice-based ML-KEM/ML-DSA offer the most favourable latency–bandwidth–energy trade-off among standardised families, and that classical–PQC hybrid schemes are the de facto transition strategy across 5G/6G, IoT, VPN, and automotive scenarios, at the cost of 10–100× larger keys/signatures and 8–40% handshake latency overhead. Persistent barriers include constrained-device resource limits, immature hardware acceleration, incomplete IETF/3GPP standardisation, and public-key-infrastructure scaling. We propose a five-level PQC transition-readiness maturity model and identify large-scale field validation, PQC–QKD integration, and lightweight signature schemes as priority directions for future work.