Nobody can break it yet, and that is the point
Quantum computers today lack the power to crack the public-key encryption that protects email, bank statements and software updates. Washington is ordering the swap anyway. The National Institute of Standards and Technology has published its road map, Transition to Post-Quantum Cryptography Standards (NISTIR 8547), and the dates in it are not gentle.
The logic is simple, and a little grim. Adversaries can record encrypted traffic now and wait. NIST calls this “harvest now, decrypt later”: a machine capable of the job does not need to exist today to make today’s secrets worth stealing. Hence the call for changes on a “well-considered schedule” rather than in a panic.
The dates
National Security Memorandum 10 set 2035 as the target for finishing the move across federal systems. Executive Order 14412, signed in June 2026, pulls the most sensitive systems forward. High-value assets and high-impact systems must adopt quantum-resistant key establishment by the end of 2030 and digital signatures by the end of 2031. NIST also plans to deprecate quantum-vulnerable public-key algorithms after 2030 and disallow them after 2035. Deprecation allows continued use at acknowledged risk. Disallowance ends it.
The Department of War’s chief information officer put out its own strategy in June 2026. By December 31, 2030, every department system must support post-quantum cryptography or face being phased out. By December 31, 2031, all must actively use it, barring an approved exception. At TechNet Indo-Pacific in Honolulu, Matthew McFadden of General Dynamics Information Technology put the difficulty plainly: “It’s hard to migrate what you don’t know that you have.”
Under the hood
The replacements are the three standards NIST released in 2024. ML-KEM handles key establishment. ML-DSA and SLH-DSA handle digital signatures. They aim at RSA and the elliptic-curve schemes, which fall to Shor’s algorithm on a big enough quantum machine. Symmetric ciphers such as AES are expected to stay, though an AES-encrypted service can still lean on vulnerable public-key methods to protect its keys. For key establishment NIST’s report recommends ML-KEM-768 as the default.
Dustin Moody, the NIST mathematician who leads the standardization project, said: “We understand there’s not one strategy that fits all use cases.” He added that organizations might move first on particularly sensitive data that must stay secret for a long time.
Hybrid deployments, pairing conventional encryption with the new algorithms, are what NIST calls “akin to using two padlocks on a door instead of one.” They hedge against a flaw in a young algorithm. The price is engineering complexity, performance overhead and review work, and hybrids are generally expected to be temporary, so a second migration follows.
Signatures bring a nastier wrinkle. Some devices cannot change the component that verifies software signatures after manufacture. NIST says equipment expected to outlast the arrival of a relevant quantum computer should be built to require quantum-resistant signatures from day one.
Who feels it
The deadlines bind federal systems, not private firms. But suppliers to federal customers face real planning pressure, and everyone else gets a framework for judging their own exposure. A product bought or built today has to support the cryptography customers will need over its working life. Applications often depend on a cryptographic library, a hardware security module and a certificate authority, and each may need changes before any of it works.
NIST notes that earlier cryptographic transitions took 10 to 20 years from standardization to full integration. IBM and others expect fault-tolerant quantum computing by the end of the decade. An October report from the Government Accountability Office found federal agencies have not yet adequately identified their vulnerable systems or tested quantum-resistant algorithms.
Sources
- Post-quantum cryptography
- NIST Report Provides Guidelines for Transition to Post-Quantum Cryptography Standards
- NIST issues roadmap for transition to post-quantum encryption standards
- What NIST’s Post-Quantum Cryptography Plan Means For Companies And Their Suppliers
- DOW Works To Meet Post-Quantum Cryptography Deadlines
- What’s New: IBM Quantum Safe enables confident post-quantum cryptography migration
Photo: Department of Commerce. Office of the Secretary. 1913 (Public domain)
