Quantum Threats

Satellite communication HNDL vulnerability: Military and commercial satellites have 15-25 year operational lifespans. NSA CNSA 2.0 sets a quantum-resistant transition timeline for National Security Systems by equipment category — software/firmware signing exclusively CNSA 2.0 by 2030, web/cloud services by 2033, traditional networking equipment by 2030, operating systems by 2033, niche equipment and custom applications by 2033 — which NSS satellite ground segments and links fall under. Currently intercepted satellite communications are harvestable for future quantum decryption.

NIST IR 8547 describes NIST’s expected transition from quantum-vulnerable cryptographic algorithms to post-quantum signature and key-establishment schemes. It is intended to inform migration efforts and timelines for information technology products, services, and infrastructure.

NIST SP 800-210 provides general access control guidance for cloud service models (IaaS, PaaS, SaaS). Because vendors, including cloud service providers, often implement and control the cryptographic mechanisms an organisation depends on, vendor readiness is a critical factor in an organisation's PQC transition.

Long-lived ciphertext in databases, backups, and archives protected by classical key-wrapping mechanisms is exposed to store-now-decrypt-later risk.

Cloud Security Alliance quantum readiness guidance: CSA published quantum-safe security guidance identifying crypto-agility as critical requirement for cloud deployments. Multi-cloud environments using 5+ key management systems face fragmented PQC migration paths.

10 CFR § 73.54 requires nuclear power plant licensees to maintain cybersecurity plans and protect digital computer and communication systems associated with safety, security, emergency preparedness, and supporting functions.

More than one billion smart meters are deployed worldwide and need migration planning for future quantum threats. Some meters use unchangeable fixed-function cryptography, while the oldest devices that cannot receive over-the-air updates will need replacement.

CISA’s PQC Initiative addresses quantum-computing security risks and supports critical-infrastructure and government networks during the transition to PQC. CISA is also helping critical-infrastructure owners and operators facilitate the eventual PQC transition for operational technology.

Many critical-infrastructure OT systems use legacy RSA encryption, which is a primary target of quantum attacks because Shor's algorithm can break it. This creates a strategic "harvest now, decrypt later" risk, where adversaries collect encrypted OT communications today intending to decrypt them once quantum capabilities mature. OT further compounds this risk because a significant share of its endpoints run out-of-date, end-of-life operating systems and software that remain in operation for long periods. Integrating PQC protections adds processing overhead that can exceed the hardware capabilities of these OT systems.

Singapore's Cyber Security Agency released a Quantum-Safe Handbook and Quantum Readiness Index (in public consultation through end-2025) to guide Critical Information Infrastructure owners and government agencies toward quantum-safe migration.

NERC's January 2026 Critical Infrastructure Protection Roadmap addresses security of the North American bulk power system through measures including MFA, foundational cyber hygiene, and protection of SCADA and AGC communications using protocols such as DNP3, ICCP, and Modbus. Its survey material also identifies quantum computing as a risk to modern cryptography and gives an encrypted-data collection and later quantum decryption scenario.

NIST IR 8547 is an Initial Public Draft dated November 2024. It describes the transition from quantum-vulnerable cryptography and identifies 2035 as the primary federal target for completing migration to post-quantum cryptography. NIST intends to deprecate classical digital signatures at the 112-bit security level after 2030.

The 2024 Quantum Threat Timeline Report suggests that the quantum threat may be closer than previously thought. It emphasizes proactive quantum-threat mitigation.

The NIS2 Directive requires entities in scope to adopt cybersecurity risk-management measures, including the use of state-of-the-art cryptography. Member States should connect with NIS2 and eIDAS supervisory bodies to understand the implications of the quantum threat for regulated entities. The roadmap also encourages real-world testing through activities such as ETSI Plugtests and IETF PQC hackathons.

DNSSEC quantum signature forgery: DNSSEC uses RSA (RSASHA256 per RFC 5702) and ECDSA (ECDSAP256SHA256 per RFC 6605) to sign DNS records — RFC 8624 covers current algorithm implementation requirements. Approximately 40% of global DNS domains have DNSSEC enabled including 92% root zone adoption. Quantum forgery of DNSSEC signatures enables DNS hijacking for any signed domain redirecting traffic to attacker-controlled servers. PQC signatures face challenges with DNS UDP packet size limits (~1232 bytes) requiring protocol-level changes. IETF draft-sheth-pqc-dnssec-strategy-01 addresses migration strategy.

RPKI's mandated signature algorithm for certificates, CRLs, CMS signed objects, and certification requests is RSA PKCS #1 v1.5. RSA key pairs used for these RPKI signatures must have a 2048-bit modulus. This RFC 7935 profile obsoletes the earlier RFC 6485 algorithm profile. A quantum computer capable of breaking RSA could forge any RPKI signature, including on resource certificates and ROAs. That capability lets an attacker bypass route origin validation by forging a ROA that authorizes their own malicious route. RSA-2048 signing currently keeps the RPKI dataset at about 838MB. Switching to a post-quantum scheme such as ML-DSA-44 would grow that dataset to roughly 3.0GB.

OpenSSH 10.0 was released on 2025-04-09. It uses the hybrid post-quantum algorithm mlkem768x25519-sha256 by default for key agreement. The algorithm is considered safe against attacks by quantum computers and has been standardized by NIST.

NIST announced HQC's selection for standardization in March 2025. HQC is a code-based KEM intended to complement ML-KEM by relying on a different underlying security problem. NIST will create a draft HQC standard for public comment and, after adjudicating comments, publish a final version in approximately two years.

NIST SP 800-227 KEM recommendations: Published as final standard on September 18, 2025 — initially released as Initial Public Draft in January 2025. Provides definitions, security properties, and implementation recommendations for key-encapsulation mechanisms as companion guidance to FIPS 203 (ML-KEM). Establishes best practices for KEM usage in protocols, hybrid constructions, and key management — essential reference for correct PQC deployment.

Sigstore plans to enable content signing with post-quantum keys and eventually adopt post-quantum cryptography in services including Fulcio and Rekor. ML-DSA has been added to enable experimentation, while Sigstore still needs a plan for transitioning away from traditional cryptographic algorithms.

Quantum random number generation (QRNG) for PQC key security: PQC algorithm security depends on high-quality randomness for key generation. Classical PRNGs may contain algorithmic biases exploitable by sophisticated adversaries. QRNG uses quantum mechanical processes to generate theoretically unpredictable randomness. Quantinuum Quantum Origin was among the first software-delivered QRNGs to obtain NIST SP 800-90B entropy source validation. Commercial QRNG products from ID Quantique, Quside, and QNu Labs are available for HSM, IoT, and automotive integration. QRNG complements PQC by ensuring cryptographic keys are non-predictable from generation.

NIST IR 8547 proposes deprecation after 2030 and disallowance after 2035 for listed quantum-vulnerable digital-signature and key-establishment algorithm families, including RSA, ECDSA, and elliptic-curve key establishment. NSM-10 establishes 2035 as the primary target for completing migration to PQC across federal systems. SP 800-131A separately addresses transitions in algorithms and key lengths used by federal agencies to protect controlled unclassified information.

KyberSlash1 and KyberSlash2 are timing vulnerabilities in several Kyber/ML-KEM implementations, including the official reference code. Their exploitability was demonstrated on the Raspberry Pi 2 and Arm Cortex-M4, with Kyber secret keys recovered within minutes for KyberSlash2 and within a few hours for KyberSlash1.

This document examines the specific risks that quantum computing could pose to industrial control systems (ICS) and other operational technology (OT).

BSI TR-02102-1 provides Germany's official security assessment and recommended key lengths for cryptographic mechanisms, forming the baseline against which PQC transition urgency is judged.

ANSSI-PG-083 version 3.00 sets out rules and recommendations for choosing and sizing cryptographic mechanisms. It accounts for the quantum threat and aims to remain valid for at least 15 years.

CCN-TEC 009 (Spain's National Cryptologic Centre) recommendations for a safe post-quantum transition, covering CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, SPHINCS+, BIKE, HQC, Classic McEliece and SIKE, driven by Shor's/Grover's algorithm risk and harvest-now-decrypt-later.

CSA guidance provides a practical framework for modernizing cloud key management for PQC, including cryptographic asset inventory, crypto agility, and mitigation of Store-Now-Decrypt-Later and hybrid-downgrade risks. It discusses hybrid and migration-ready PQC updates affecting TLS, SSH, and IKEv2.

Israel's National Cyber Directorate (INCD) Alert 1855 (6 March 2025, TLP:CLEAR) warns that quantum computers can break widely used public-key algorithms — factorization (RSA), discrete logarithms (Diffie-Hellman) and elliptic-curve discrete logarithms — used in TLS, SSL-VPN and API key exchange. It flags forged digital signatures on software and firmware and on documents convertible to money (including digital currencies), especially on ICS/SCADA and medical (IoMT) platforms whose algorithms are hard to replace, and harvest-now-decrypt-later capture of long-sensitive data as a risk that may already be under way. It directs organisations to appoint an owner, find systems with non-resistant components and plan to add NIST's standardised PQC algorithms alongside existing ones, prioritised by system and data sensitivity, with crypto-agility built into development and procurement.

CISA, NSA, and NIST factsheet recommending a Quantum-Readiness Roadmap, a useful cryptographic inventory, assessment of supply-chain considerations, and engagement with technology vendors about PQC.

The estimated security strength of approved hash functions depends on the required property and the hash output length. For collision-resistant applications, the document assigns 128-bit strength to SHA-256 and SHA3-256, 192-bit strength to SHA-384 and SHA3-384, and at least 256-bit strength to SHA-512 and SHA3-512.

This is IAPH's cyber resilience guidance for emerging technologies in the maritime supply chain. It addresses quantum computing risk in a chapter structure alongside other emerging technologies including Artificial Intelligence and IoT. It recommends integrating cybersecurity into technology planning from the earliest stages, termed "cybersecurity by design." It recommends assessing risks from emerging technologies even when an organization does not plan to deploy them locally. Among the technology-specific protection measures it lists is post-quantum cryptography adoption.

Applied Quantum's practitioner-built 8-phase PQC migration framework for enterprise-wide crypto-agility, covering executive mandate through vendor governance, with sector extensions for financial services and OT.

Bitcoin address types can differ in how soon they become vulnerable to quantum computers. Potentially quantum-vulnerable types include earlier addresses, reused addresses, and Taproot addresses. Taproot remains vulnerable because it uses ECC, specifically Schnorr signatures.

Standard Ethereum accounts use ECDSA on secp256k1 to sign transactions. An account that has sent a transaction exposes its public key onchain, enabling a quantum computer to derive its private key. Ethereum plans to use account abstraction through EIP-8141 to let accounts adopt post-quantum signatures.

Distributed-ledger networks using traditional cryptography face HNDL data-privacy risk because an attacker can store a ledger replica and later reveal protected data with a sufficiently powerful quantum computer. PQC migration can protect future security and integrity but does not retroactively protect previously recorded Bitcoin transactions.

The education sector has seen an alarming surge in cyber threats. Schools rely on expansive networks connecting students, faculty, administration, and third-party vendors, with thousands of devices and endpoints — many unmanaged — expanding the attack surface. A cryptographically relevant quantum computer will threaten systems relying on traditional asymmetric cryptography, making both authentication flows and data in transit vulnerable.

Project Leap Phase 2 tested post-quantum cryptography in an operational payment system while sending liquidity transfers. The document characterizes migration to quantum-safe payment systems as complex and high-stakes and calls for timely preparation and institutional collaboration.

HNDL threatens currently protected financial records, transaction data, and long-term financial contracts recorded on blockchains. A bad actor can store protected ledger data now and later use a sufficiently powerful quantum computer to reveal it. Moving Bitcoin users to PQC address types does not retroactively protect transactions previously recorded with less-quantum-resistant address types.

BIS Papers No. 149 examines the risk that quantum computers pose to financial stability by potentially breaching widely used cryptographic algorithms. The paper notes that sensitive financial data faces a harvest-now-decrypt-later risk that necessitates immediate preparation.

Despite increasing awareness, many organizations have yet to define or apply resources adequately supporting quantum-resistant projects. This delay, called crypto-procrastination, threatens the overall migration roadmap by compressing future implementation tasks into unrealistically short timeframes. The period 2030-2031 represents a key milestone, when algorithms like RSA-2048 will be deprecated.

Payment-system HNDL risk: malicious actors may capture encrypted financial data today for future quantum decryption. Project Leap Phase 2 tested post-quantum cryptography in the Eurosystem's T2 payment system.

BIS-led roadmap on quantum-readiness for the global financial system: CRQC risk (27% of surveyed experts expect it within 10 years, 50% within 15), harvest-now-decrypt-later, Shor's/Grover's algorithms — recommends cryptographic inventory, hybrid schemes, and phased migration starting immediately.

The Swiss Financial Market Supervisory Authority FINMA surveyed 60 Swiss financial institutions on the opportunities and risks of quantum computing. FINMA recommends that a PQC roadmap be drawn up by mid-2027 at the latest. FINMA expects institutions' risk analysis to result in a comprehensive inventory listing all cryptographic methods used. FINMA recommends taking into account the risk of harvest-now-decrypt-later attacks, where data encrypted today may be stolen with the intention of decrypting it later using powerful quantum computers.

Japan's FSA Study Group report on post-quantum cryptography, formulated through mid-2024 stakeholder discussions, providing recommendations for deposit-taking institutions transitioning to PQC.

MAS advisory (TCRS/2024/01) outlining cybersecurity risks from quantum computing developments and expected mitigating measures for Singapore financial institutions.

ASC X9 report giving financial-industry managers high-level guidance on quantum-enabled cyberattack risk, cryptographic asset inventory, and PQC migration prioritization.

With this report, X9 seeks to educate financial industry management on how to identify, analyze, prioritize and manage the significant risks posed by future quantum computers and to offer guidance on how the industry can migrate to post-quantum cryptography to protect sensitive data and networks against quantum-enabled cyberattacks. The report calls for creating a cryptographic asset inventory to identify all cryptographic systems in use. It calls for prioritizing current systems for remediation based on a risk assessment. It calls for working with vendors to develop and deploy PQC solutions in third-party products.

FINMA conducted a survey of 60 Swiss financial institutions between November 2025 and January 2026 on the opportunities and risks of quantum computing. In most cases the surveyed institutions lacked a clear roadmap and sufficiently forward-looking planning for migration to quantum-safe encryption. FINMA considers that action is needed in the risk-management process of numerous institutions to continue meeting operational-risk and resilience requirements. FINMA's measures include creating a cryptographic inventory and protecting critical data against "harvest now, decrypt later" attacks.

The HKMA plans to launch a Quantum Preparedness Index to assess the banking sector’s maturity in adopting PQC and quantum computing, followed by a target index and transition roadmap outlining potential projects and pilots. It also intends to establish a Fintech Cybersecurity Baseline for fintech solution providers. The Blueprint identifies external-platform and third-party dependencies, high implementation costs, skills shortages, and particular difficulty for smaller institutions.

OSFI's overview of digital and crypto risks for Canadian financial institutions, including quantum computing's threat to encryption and store-now-decrypt-later exposure, alongside a joint OSFI/FCAC quantum-readiness questionnaire.

HKMA launched a Quantum Preparedness Index (QPI) and whitepaper for the banking sector: initial sector-wide QPI score of 2.3, with 32% of banks not yet started on PQC planning; HKMA targets full sectoral readiness (QPI 10) by 2030.

Japan FSA study group report on deposit-taking financial institutions' response to post-quantum cryptography, chaired by Mizuho Financial Group's Group Information Security Officer (study conducted July-October 2024).

A future cryptanalytically relevant quantum computer could break public-key systems still used today. NSA's direction covers public cryptographic algorithms on both unclassified and classified National Security Systems.

CNSA 2.0 compliance deadline pressure: NSA mandates CNSA 2.0 compliance with phased deadlines — software/firmware signing supported and preferred by 2025 (exclusively by 2030), networking equipment supported and preferred by 2026 (exclusively by 2030), NSS acquisitions by January 2027, web browsers/servers/cloud supported and preferred by 2025 (exclusively by 2033), full transition by 2033.

NSA CNSA 2.0 mandates technology-category migration timelines for National Security System operators, requiring software/firmware signing and web/cloud services to prefer PQC by 2025, networking by 2026, operating systems by 2027, and constrained devices by 2030, with exclusive deadlines between 2030 and 2033. The December 2024 FAQ further requires phasing out non-compliant equipment by December 31, 2030, enforcing mandatory CNSA 2.0 use by December 31, 2031, and achieving full NSS quantum resistance by 2033.

Harvest-now-decrypt-later attacks targeting Australian classified data: Foreign state actors actively intercepting and storing encrypted Australian government communications. ASD's Annual Cyber Threat Report 2024-2025 identifies nation-state actors targeting Australian government networks. Classified data encrypted with current RSA/ECDSA is at full Shor's-algorithm risk when CRQCs become available; AES-128 retains 64-bit effective security against Grover's algorithm (weakened, not broken) — AES-256 is the symmetric mitigation.

CISA's January 23, 2026 product-category guidance responds to Executive Order 14306. Organizations should acquire only PQC-capable products when planning acquisitions in categories where such products are widely available. The widely available categories include cloud services, collaboration software, web software, and endpoint security.

Only 4% of Healthcare & Life Sciences organizations have encrypted 80% or more of their sensitive cloud data. Fifty-nine percent are concerned about future decryption of today’s data, including harvest now, decrypt later. The report says the clock is ticking on post-quantum readiness.

HSCC Cybersecurity Working Group's Q1 2026 report identifies a joint HSCC/Health-ISAC Post Quantum Cryptography task group and reports three new task groups for Policy, Isolation and Segmentation, and Workforce.

Munich Re’s Cyber Insurance Risks and Trends 2025 says NIST finalized its principal set of quantum-resistant encryption algorithms in August 2024. It says RSA will be vulnerable to quantum-based decryption but should continue to offer sufficient protection through at least 2030. It also says attackers are already stealing data to decrypt once sufficiently powerful quantum computers become available.

A manifest specification for IoT firmware updates must support different cryptographic algorithms and algorithm extensibility. Because signature schemes based on RSA and Elliptic Curve Cryptography (ECC) may become vulnerable to quantum-accelerated key extraction in the future, unchangeable bootloader code in ROM is recommended to use post-quantum secure signature schemes such as hash-based signatures. Where COSE (RFC 9052) is used, its COSE_Sign structure can carry signatures generated with the Elliptic Curve Digital Signature Algorithm (ECDSA) or the Edwards-curve Digital Signature Algorithm (EdDSA).

ETSI TR 104 005 V1.1.1 technical report analyzing PQC impacts on ETSI TC SET's Secure Element Technologies specifications (SIM/UICC/Secure Element), driven by Shor's and Grover's algorithms.

Apple will start accepting PQC roots in late 2025 or in 2026. Microsoft is updating Windows and Linux builds to allow PQC integration. Mozilla identified preventing capture-and-decrypt attacks as an immediate priority.

NIST FIPS 203/204/205 standardization milestone: First official PQC standards published August 2024. FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) provide the foundation for all PQC migration. CMVP validation of implementations is ongoing with first validated modules expected 2025-2026.

Digital rights management (DRM) solutions aim to prevent the copying or distribution of copyrighted material. This addresses the modern paradigm of cloud-based content delivery followed by major platforms such as Netflix, Disney+, and Amazon Prime. Three widely used DRM solutions — Google Widevine, Apple FairPlay, and Microsoft PlayReady — are deployed on billions of devices worldwide. These systems have design-level shortcomings that leave them vulnerable to emerging attacks, including an absence of post-quantum security.

FS-ISAC report on quantum computing's impact on the Payment Card Industry: cryptographic asset inventory across HSMs/databases/physical systems, AES-256 migration against Grover's algorithm, and RSA/ECC replacement with PQC, produced with PCI SSC/NIST/BIAN input.

Subscriber personal data, including call and location history, is stored in operator systems and must be protected with quantum-safe encryption over its lifetime. Sensitive data on 5G SBI and N32 interfaces is exposed to store-now/decrypt-later attacks.

The GSMA Post Quantum Telco Network Task Force publishes guidance on PQC impacts and migration for telecommunications, building on PQ.01 and referring to PQ.02 for quantum-risk assessment. Migration depends on standards bodies, equipment manufacturers, infrastructure providers, and operators implementing quantum-safe protocols and algorithms.

GSMA PQ.05 analyzes threats, impacts, and mitigations for a cryptographically relevant quantum computer targeting 4G and 5G roaming architectures and interfaces. It prioritizes protection of roaming interfaces against harvest-now-decrypt-later attacks and also addresses future impersonation, spoofing, and tampering.

ANSSI-FT-117 technical guide for IPsec's post-quantum transition — hybridizing IKEv2 key exchange and signature authentication, noting significant message-size increases from PQC key/ciphertext/signature sizes.