MANILA, July 8 — For communities across Asia that rely on digital banking, messaging apps, and online government services, a quiet revolution in cybersecurity is underway — one that could determine whether our private data stays safe when quantum computers arrive. The stakes are high. Quantum computers, still in development, could one day break the encryption systems that protect everything from bank transfers to passport data.
Two of the most widely used public-key cryptography systems — RSA, developed in 1977, and Elliptic Curve Cryptography, or ECC, from 1985 — are vulnerable to a mathematical technique called Shor’s algorithm, which dates back to 1994. Estimates suggest that cracking RSA-2048 encryption, a common standard, would require a quantum computer with about 20 million qubits.
The U.S. National Institute of Standards and Technology, known as NIST, has been working on post-quantum cryptography standards since 2016. In 2024, the agency selected four algorithms for standardization: CRYSTALS-Kyber, CRYSTALS-Dilithium, FALCON, and SPHINCS+. These are designed to resist attacks from both classical and quantum computers.
The timeline for when a cryptographically relevant quantum computer might exist remains uncertain. Estimates range from 2030 to 2050.
That window matters for families across the region, because many digital systems — from Philippine e-wallets to Singapore’s Smart Nation infrastructure — rely on encryption that could become obsolete overnight.
Government action and guidance
The U.S. Department of Homeland Security and the National Security Agency have already issued guidance on transitioning to quantum-resistant cryptography. In 2022, the Quantum Computing Cybersecurity Preparedness Act was signed into U.S. law, requiring federal agencies to migrate to post-quantum cryptography. For Asian economies that trade heavily with the United States or use American technology standards, these moves carry direct implications.
Closer to home, central banks and telecommunications regulators are watching the NIST process closely. The four selected algorithms — two for general encryption and two for digital signatures — represent a global baseline that many countries are expected to adopt.
What it means for ordinary people is straightforward: the apps and services we use daily will need to update their security protocols. For communities that have only recently gained widespread access to digital finance and e-government services, a smooth transition is critical. A rushed or poorly managed migration could create vulnerabilities that cybercriminals might exploit.
The algorithms at the heart of the shift
CRYSTALS-Kyber is designed for general encryption, the kind that protects data in transit. CRYSTALS-Dilithium, FALCON, and SPHINCS+ handle digital signatures — the cryptographic equivalent of a handwritten signature, used to verify identities and authenticate documents. Each algorithm has different strengths.
FALCON, for instance, offers smaller signature sizes, which matters for devices with limited storage. SPHINCS+ takes a different mathematical approach, providing an alternative if vulnerabilities are found in the other schemes.
This redundancy is deliberate: no single algorithm is a silver bullet. For technology companies across Asia, the work of integrating these new standards into products has already begun. Chipmakers, smartphone manufacturers, and cloud service providers are among those testing the new algorithms.
The shift will not happen overnight — legacy systems must be replaced gradually, and backward compatibility must be maintained. The U.S. government’s 2022 law mandates that federal agencies migrate to post-quantum cryptography, setting a precedent that other governments may follow.
For the Philippines, which has been expanding its digital identity system and online tax filing, the NIST standards offer a ready-made framework. Similarly, for India’s Aadhaar system or Indonesia’s digital banking sector, adopting these standards could prevent a future security crisis.
Uncertainty and preparation
The wide range of estimates for when a cryptographically relevant quantum computer will arrive — anywhere from 2030 to 2050 — creates a planning challenge. Moving too early risks wasting resources on standards that may evolve; moving too late could leave systems exposed. What is clear is that the transition will be complex.
Encryption is embedded in everything from email to e-commerce to national security systems. Replacing it requires coordination across governments, industry, and academia.
For now, the four NIST-selected algorithms provide a destination. The journey — for governments, businesses, and the communities they serve — is just beginning.
