Get ready for post-quantum cryptography
Data encrypted today can be recorded now and decrypted later by a quantum computer. Governments have set dates to retire today's public-key cryptography. This editable standard helps you plan the move.
What post-quantum cryptography is
Why it matters
Most public-key cryptography today (RSA, elliptic-curve and Diffie-Hellman) relies on maths a large quantum computer could solve quickly. That computer doesn't exist yet, but attackers can harvest now and decrypt later.
What it does
New algorithms that run on ordinary computers replace two jobs: agreeing keys to encrypt connections and data (ML-KEM), and digital signatures for certificates, code and documents (ML-DSA, SLH-DSA).
What stays the same
AES and SHA-2/SHA-3 remain secure at current sizes. TLS, VPNs and PKI keep working with new algorithms inside them. Keys and signatures get larger, so some systems and suppliers need upgrades.
Dates already set by NIST and governments
Dates from NIST IR 8547 and published national guidance in the US, Canada, the UK, the EU and Australia. Confirm the ones that apply to you; they can change.
- Aug 2024NIST publishes the first post-quantum standards
FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures.
- 2026–2027Plans and inventories
Canada's federal departments plan from April 2026; the EU asks organizations to start by the end of 2026; new US national security systems must support CNSA 2.0 from 1 January 2027.
- 2028Discovery done, migration starts
The UK NCSC expects discovery and a migration plan by 2028; Canada's federal transition begins in April 2028.
- 2030Quantum-vulnerable algorithms deprecated
NIST IR 8547: RSA, elliptic-curve and classical Diffie-Hellman are deprecated after 2030. US federal key establishment, EU high-risk systems and Australia's target all point to 2030.
- 2031Signatures and high-priority systems
US federal digital signatures by 31 December 2031; Canada's high-priority systems and the UK's priority migrations by 2031.
- 2035Disallowed
NIST disallows quantum-vulnerable public-key algorithms after 2035; Canada and the UK expect all systems migrated.
An editable standard you adapt, not a white paper
- Editable Word standard in formal "shall" requirement language
- Plain-language explanation of what post-quantum cryptography is, what it does and what stays the same
- Approved and quantum-vulnerable algorithm tables with NIST IR 8547 status
- Cryptographic inventory and CBOM method, generated in the build pipeline with drift checks, plus prioritization rules for long-lived and archived data
- Phased milestones (2030 key establishment, 2031 signatures, 2035 disallowance), hybrid key exchange rules and a yearly algorithm rotation exercise
- Supplier contract terms, PKI and code signing, AI pipeline and AI agent credentials, and exceptions with CISO approval after 2032
- Regulatory timelines for the US, Canada, UK, EU and Australia, measures and definitions
Who it's for
CISOs, security architects, infrastructure and PKI teams, and organizations holding client or personal data that must stay confidential for years: legal, finance, health, government suppliers and technology companies.
Frameworks referenced
- NIST FIPS 203/204/205
- NIST IR 8547
- NIST SP 800-227
- NIST CSF 2.0
- ISO/IEC 27001:2022
NIST material is referenced, not reproduced; algorithm names and dates are republished courtesy of the National Institute of Standards and Technology. NIST does not endorse CyberGlass.
Questions
Is post-quantum cryptography the same as quantum key distribution?
No. Post-quantum cryptography is software that runs on today's computers. Quantum key distribution needs special quantum hardware and links, and most national authorities recommend post-quantum cryptography for general use.
We're a small business. Does this apply to us?
Mostly through your suppliers: cloud services, browsers, VPNs and software will change for you. The standard includes a small-business route that focuses on asking suppliers for their roadmaps and protecting long-lived data.
Do we need new hardware?
Sometimes. HSMs, VPN appliances, smart cards and older devices may need upgrades. The cryptographic inventory in section 5 tells you where.
Could the dates change?
Yes. They come from published guidance and may be updated. The standard shows each date's source so you can check it.
Start with your inventory
You can't migrate what you can't find. The standard tells you what to record, how to prioritize and what to ask suppliers.