Post-quantum cryptography transition and security

Organizations and institutions are increasingly preparing for the cybersecurity risks posed by quantum computing. A primary concern is the “Harvest Now, Decrypt Later” strategy, where adversaries collect encrypted data today to decrypt it once quantum technology becomes sufficiently powerful.

Technical experts and regulatory bodies, such as the U.S. National Institute of Standards and Technology (NIST) and Germany’s Federal Office for Information Security (BSI), are advocating for a transition to post-quantum cryptography. This involves moving away from traditional public-key systems like RSA and ECC toward crypto-agile infrastructures and new standards like FIPS 203, 204, and 205.

In the higher education sector, leaders have identified “Q-Day”—the potential point when quantum power can break current encryption models—as a critical threat that could arrive as early as 2030. To mitigate these risks, IT leaders are recommending the immediate implementation of quantum-resistant algorithms and the prioritization of vendors that support these emerging security standards to protect sensitive research and health data.

Recent developments show an acceleration in global preparations. The U.S. Government Accountability Office (GAO) has issued 89 recommendations to over 20 federal agencies, urging them to inventory current algorithms and prepare for migration. International timelines for quantum adaptation vary, with the U.S., EU, and Australia targeting 2030, while the UK and Canada are associated with 2031.

In the private sector, blockchain and financial entities are also building resilience. Algorand aims for native post-quantum accounts by 2026, while Coinbase is developing safeguards for approximately $250 billion in institutional assets. Additionally, Microsoft has launched a pilot for post-quantum TLS certificates, and StarkWare is testing quantum-safe transactions.