Quantum Threats
Detailed analysis of quantum threats across industries, including criticality, at-risk cryptography, and PQC replacements.
Detailed analysis of quantum threats across industries, including criticality, at-risk cryptography, and PQC replacements.
quantum_threats_hsm_industries_04012026.csv • Updated: 4/1/2026
Ind.Industry | ID | Description | Crit.Criticality | Crypto | PQC Repl. | Actions | Info |
|---|---|---|---|---|---|---|---|
| Aerospace / Aviation | AERO-001UpdatedLow | Aircraft avionics cryptographic exposure: RTCA DO-326A defines airworthiness security processes for aircraft systems with 30-40 year service lives. ARINC 664 (AFDX) network security and flight management systems rely on RSA/ECDSA. Aircraft entering service today will operate well beyond CRQC arrival with no practical mid-life cryptographic retrofit path. Source: RTCA DO-326A / DO-356A Airworthiness Security | Critical | Avionics PKIARINC 664 network securityflight management system authentication | Crypto-agile avionics designML-DSA for flight software signinghybrid certificate chains | ||
| Aerospace / Aviation | AERO-002High | Satellite communication HNDL vulnerability: Military and commercial satellites have 15-25 year operational lifespans. NSA CNSA 2.0 mandates PQC for all national security systems including satellite uplink/downlink by 2035. Currently intercepted satellite communications are harvestable for future quantum decryption. Source: NSA CNSA 2.0 Cybersecurity Advisory | Critical | Satellite uplink/downlink RSA/ECDSAground station TLSinter-satellite link encryption | ML-KEM-1024ML-DSA-87 per CNSA 2.0AES-256 | ||
| Aerospace / Aviation | AERO-003Low | Air traffic management authentication gap: ICAO Assembly Resolution A41-19 (2022) addresses aviation cybersecurity but ADS-B transmissions remain unencrypted and unauthenticated. ADS-B currently lacks any cryptographic protection; quantum computing becomes relevant when authenticated ADS-B is deployed using public-key cryptography, which would itself require PQC to remain secure. Source: ICAO Assembly Resolution A41-19 | High | ADS-B (unencrypted)Mode SATC data linksACARS messaging | Authenticated ADS-B with ML-DSAquantum-safe ATC protocols | ||
| Automotive / Connected Vehicles | AUTO-001High | V2X PKI quantum transition: ISO/SAE 21434 (published August 2021) establishes cybersecurity engineering requirements for road vehicles. V2X communications use ECDSA P-256 certificates per IEEE 1609.2. Vehicles have 12+ year lifecycles meaning 2026 production vehicles remain on roads through 2038+ when CRQCs may be operational. Source: ISO/SAE 21434 Road Vehicle Cybersecurity | Critical | ECDSA P-256 V2X certificatesIEEE 1609.2 PKIdigital key infrastructure | ML-DSA V2X certificateshybrid V2X authenticationFN-DSA for constrained ECUs | ||
| Automotive / Connected Vehicles | AUTO-002High | OTA firmware update signature forgery: Over-the-Air update mechanisms for modern connected vehicles use RSA/ECDSA code signing. Quantum forgery of update signatures enables malicious code injection into vehicle ECUs controlling braking, steering, and powertrain systems. Source: SAE J3061 / ISO/SAE 21434 Vehicle Cybersecurity | Critical | RSA/ECDSA code signingsecure boot chainsECU firmware verification | ML-DSA firmware signingSLH-DSA for safety-critical ECUsdual-signature verification | ||
| Automotive / Connected Vehicles | AUTO-003Low | UNECE WP.29 R155/R156 cybersecurity regulation gap: Mandatory for new vehicle type approvals in EU since July 2022 and extended to all new vehicles July 2024. Requires cybersecurity management systems and secure OTA updates but does not yet address post-quantum cryptography creating a future compliance gap. Source: UNECE WP.29 Regulations R155/R156 | High | TLS for telematicsRSA/ECDSA for OTA signingconnected car cloud API authentication | Hybrid TLS 1.3 with ML-KEMML-DSA OTA signingcrypto-agile telematics | ||
| Automotive / Connected Vehicles | AUTO-004High | In-vehicle network security quantum exposure: ISO/SAE 21434 covers the full vehicle cybersecurity lifecycle including CAN bus, LIN, FlexRay, and automotive Ethernet backbone networks. Embedded ECUs have limited computational resources and constrained crypto-agility, making mid-lifecycle PQC migration impractical for vehicles already in production. Source: ISO/SAE 21434 Road Vehicle Cybersecurity | High | CAN bus authenticationsecure boot in ECUsin-vehicle Ethernet encryptionHSM key storage | Hardware security modules with PQC supportcrypto-agile ECU designML-DSA for secure boot | ||
| Cloud Computing / Data Centers | CLOUD-003High | Federal cloud PQC compliance requirements: NIST SP 800-210 general access control guidance for cloud systems combined with NIST IR 8547 deprecation timeline means federal cloud deployments must transition to PQC by 2030. FedRAMP and StateRAMP certifications will require FIPS 203/204/205 compliance. Source: NIST IR 8547 / NIST SP 800-210 | Critical | Federal cloud TLSFedRAMP-authorized encryptioncloud HSM FIPS modules | FIPS 203 (ML-KEM)FIPS 204 (ML-DSA)FIPS 205 (SLH-DSA) cloud implementations | ||
| Cloud Computing / Data Centers | CLOUD-004High | Cloud HSM and key management PQC gap: NIST SP 800-210 defines access control for cloud systems but cloud-hosted HSMs and KMS services currently lack full PQC support. FIPS 140-3 validation for PQC modules is ongoing with multi-year certification timelines. Organizations using cloud HSMs face vendor dependency for PQC migration. Source: NIST SP 800-210 Cloud Access Control | Critical | Cloud HSM root keysKMS key wrappingtenant isolation keysFIPS 140-3 modules | FIPS 140-3 validated PQC HSM modulesbring-your-own-key PQCML-KEM key wrapping | ||
| Cloud Computing / Data Centers | CLOUD-001Low | Cloud backup and disaster recovery HNDL risk: Air-gapped backups and long-term archival storage encrypted with RSA/ECDSA key wrapping are vulnerable to harvest-now-decrypt-later. Cloud backup data often retained for 7+ years for compliance. Source: Cloud Security Alliance Quantum-Safe Guidelines | High | Backup encryption key wrappingarchival storage TLSdisaster recovery replication | PQC-enabled backup encryptionML-KEM key wrappingAES-256 for archival | ||
| Cloud Computing / Data Centers | CLOUD-002Low | Cloud Security Alliance quantum readiness guidance: CSA published quantum-safe security guidance identifying crypto-agility as critical requirement for cloud deployments. Multi-cloud environments using 5+ key management systems face fragmented PQC migration paths. Source: Cloud Security Alliance Quantum-Safe Security | High | Cloud KMS key wrappingmulti-cloud encryptionBYOK/HYOK solutionssecrets management | Unified PQC key managementML-KEM cloud HSM integrationcrypto-agile KMS | ||
| Critical Infrastructure | CI-001NewModerate | CISA 16 critical infrastructure sectors PQC readiness gap: Presidential Policy Directive PPD-21 defines 16 critical infrastructure sectors. CISA January 2026 Product Categories List per Executive Order 14306 provides PQC procurement guidance but sector-specific PQC guidance exists for only a subset of sectors. RAND Corporation analysis identifies internet services identity management IT products and power grid as highest priority NCFs for PQC migration. Most CI sectors lack dedicated PQC migration roadmaps creating fragmented preparedness. Source: CISA Post-Quantum Cryptography Initiative / PPD-21 | Critical | All asymmetric cryptography across 16 CI sectorssector-specific SCADA/ICS protocolsfederal PKI | Sector-specific PQC migration roadmapsFIPS 203/204/205 complianceCISA ACDI deployment | ||
| Critical Infrastructure | CI-002NewModerate | EU NIS2 Directive quantum implications for essential services: NIS2 (effective October 2024) requires proportionate technical and organizational security measures for essential services but does not explicitly mandate PQC. ENISA June 2025 implementing guidelines recommend post-quantum cryptography adoption for long-lived sensitive data. European Cybersecurity Certification Group (ECCG) incorporated PQC into Agreed Cryptographic Mechanisms v2.0 (April 2025) making PQC part of EUCC certification. Essential services in scope include energy water healthcare digital infrastructure waste management and digital service providers across all EU member states. Source: EU NIS2 Directive / ENISA PQC Guidance | Critical | All quantum-vulnerable cryptography in NIS2 essential servicesTLS/IPsec for CI networksSCADA encryption | ML-KEM/ML-DSA per ECCG ACM v2.0hybrid implementationsPQC-by-default for new systems by 2030 | ||
| Critical Infrastructure | CI-003NewModerate | ICS/SCADA protocol collective quantum vulnerability: Modbus DNP3 and OPC UA are foundational industrial control protocols deployed across energy water manufacturing transportation and defense. Modbus and DNP3 were designed without cryptographic authentication; modern deployments add TLS/VPN overlays using RSA/ECC. OPC UA integrates RSA/ECC certificate authentication natively. Quantum computers can forge OPC UA certificates masquerade as legitimate controllers decrypt historical VPN traffic and break firmware signatures enabling undetected tampering across all critical infrastructure sectors simultaneously. Source: NIST SP 800-82 / IEC 62351 / ISA/IEC 62443 | Critical | OPC UA RSA/ECC certificatesModbus TCP over TLS (RSA key exchange)DNP3 Secure AuthenticationVPN RSA/ECDH | Crypto-agile OPC UA with ML-KEM/ML-DSAquantum-resistant VPN overlays for Modbuspost-quantum DNP3 SA | ||
| Cross-Industry | CROSS-001Low | Quantum-safe readiness gap: Organizations score average 25/100 on IBM Quantum-Safe Readiness Index. 70% lack complete cryptographic inventory, creating massive vulnerability window. Estimated 5-6 year gap between CRQC arrival and organizational readiness completion. Source: IBM Institute for Business Value — Secure the Post-Quantum Future 2025 | Critical | All asymmetric cryptographyPKI infrastructurekey management systems | Comprehensive CBOMautomated discovery toolsML-KEM/ML-DSA migration | ||
| Cross-Industry | CROSS-002High | NIST IR 8547 proposed transition timeline: NIST Initial Public Draft (November 2024) establishes proposed timeline to deprecate RSA, ECDSA, ECDH, and EdDSA by 2030 and disallow them entirely after 2035. Sets 112-bit security minimum. Final version pending as of February 2026. Landmark publication making PQC migration a compliance requirement for federal systems. Source: NIST IR 8547 Transition to Post-Quantum Cryptography Standards | Critical | RSA-2048/3072/4096ECDSA P-256/P-384ECDHEdDSA | ML-KEM-768/1024 (FIPS 203)ML-DSA-44/65/87 (FIPS 204)SLH-DSA (FIPS 205) | ||
| Cross-Industry | CROSS-004Low | CRQC timeline uncertainty: Global Risk Institute 2025 survey of 26 quantum computing experts estimates 28-49% probability of a cryptographically relevant quantum computer (CRQC) within 10 years (up significantly from 19-34% in 2024) and 5-15% within 5 years. Majority of experts now consider a CRQC by 2035 quite likely. Harvest-now-decrypt-later attacks make immediate PQC migration urgent regardless of exact timeline. Source: Global Risk Institute Quantum Threat Timeline 2025 | Critical | RSA-2048/4096ECC P-256/384ECDSAECDHEdDSA | Immediate hybrid PQC deploymentML-KEM-1024ML-DSA-87 | ||
| Cross-Industry | CROSS-007Low | EU coordinated PQC transition roadmap: European Commission published coordinated PQC roadmap (June 2025) establishing EU-wide milestones. By December 2026: national transition roadmaps and initial identification steps. By December 2030: high-risk use cases transitioned and PQC-by-default for new systems. By December 2035: PQC transition completed for as many systems as feasible across all EU member states. Source: European Commission Digital Strategy — PQC Roadmap | Critical | All quantum-vulnerable cryptography in EU member state systems and critical infrastructure | ML-KEMML-DSASLH-DSAhybrid implementations per EU coordinated timeline | ||
| Cross-Industry | CROSS-009NewLow | DNSSEC quantum signature forgery: DNSSEC uses RSA (RSASHA256 per RFC 6944) and ECDSA (ECDSAP256SHA256 per RFC 6605) to sign DNS records. Approximately 40% of global DNS domains have DNSSEC enabled including 92% root zone adoption. Quantum forgery of DNSSEC signatures enables DNS hijacking for any signed domain redirecting traffic to attacker-controlled servers. PQC signatures face challenges with DNS UDP packet size limits (~1232 bytes) requiring protocol-level changes. IETF draft-sheth-pqc-dnssec-strategy-00 addresses migration strategy. Source: IETF DNSSEC PQC Strategy / Verisign Research | Critical | RSASHA256 (RFC 6944)ECDSAP256SHA256/ECDSAP384SHA384 (RFC 6605)DNSSEC zone signing keys and key signing keys | ML-DSA or FN-DSA for compact DNSSEC signatureshybrid DNS signingTCP fallback for larger PQC signatures | ||
| Cross-Industry | CROSS-010NewLow | BGP/RPKI route origin validation quantum vulnerability: RPKI uses RSA-2048 exclusively for signing Route Origin Authorizations (ROAs) that validate BGP route origins. As of 2025 54-59% of IPv4/IPv6 routes are covered by ROAs representing ~74% of global internet traffic. Quantum forgery of ROAs enables attackers to hijack arbitrary IP address prefixes globally redirecting internet traffic at scale. Post-quantum RPKI would increase data sizes from 1.2GB to 2.9-39.1GB depending on algorithm creating significant operational challenges. Source: APNIC / RIPE Labs RPKI Research | Critical | RSA-2048 ROA signaturesRPKI certificate hierarchyBGP route validation | ML-DSA for ROA signinghybrid RPKI certificatesbandwidth-optimized PQC for route validation | ||
| Cross-Industry | CROSS-011NewLow | SSH key quantum exposure: Billions of SSH keys globally use RSA-2048/4096 ECDSA and Ed25519 for server authentication and remote access. Historical SSH sessions captured today can be decrypted once CRQCs arrive exposing credentials and sensitive data. OpenSSH 10.0 (April 2025) made ML-KEM hybrid (mlkem768x25519-sha256) the default key exchange. GitHub enabled post-quantum SSH (sntrup761x25519-sha512) in September 2025. Legacy SSH deployments without PQC remain vulnerable to harvest-now-decrypt-later attacks. Source: OpenSSH Post-Quantum Cryptography / GitHub Security | Critical | RSA-2048/4096 SSH host keysECDSA P-256/P-384 keysEd25519Diffie-Hellman key exchange | mlkem768x25519-sha256 (OpenSSH 10.0 default)sntrup761x25519-sha512 hybridML-KEM key exchange | ||
| Cross-Industry | CROSS-003Low | Vendor dependency crisis: 62% of organizations incorrectly assume vendors will manage quantum-safe transition automatically. Lack of contractual PQC requirements and service-level agreements for crypto-agility. Source: IBM Institute for Business Value — Secure the Post-Quantum Future 2025 | High | Third-party API keysvendor-managed HSMscloud KMS | Vendor PQC roadmap requirementscontractual crypto-agility clauses | ||
| Cross-Industry | CROSS-005UpdatedHigh | FIPS 206 FN-DSA (Falcon) standardization status: NIST published the Initial Public Draft of FIPS 206 (FN-DSA) in late 2025 with public comment period underway as of early 2026. Development has taken longer than initially projected due to the mathematical complexity of the algorithm. Once finalized, FN-DSA will provide a 4th PQC standard optimized for compact signatures. Source: NIST FIPS 206 FN-DSA Status | High | RSA/ECDSA certificates requiring compact signaturesroot CA keysconstrained device authentication | FN-DSA (FIPS 206) for compact signaturesML-DSA for general-purpose signing | ||
| Cross-Industry | CROSS-006High | HQC selected as 5th PQC algorithm: NIST announced March 11 2025 the selection of HQC (Hamming Quasi-Cyclic) as a backup KEM to ML-KEM. HQC is based on error-correcting codes rather than lattices, providing algorithmic diversity in case a lattice-based vulnerability is discovered. Draft standard expected for public comment in early 2026 with final standard in 2027. Source: NIST Post-Quantum Cryptography Standardization | High | All systems relying solely on ML-KEM without backup KEM | HQC as backup KEM alongside ML-KEM-768/1024algorithm diversity strategy | ||
| Cross-Industry | CROSS-008High | NIST SP 800-227 KEM recommendations: Published September 2025 as final guidance on key-encapsulation mechanisms. Provides definitions, security properties, and implementation recommendations for KEMs as companion guidance to FIPS 203 (ML-KEM). Establishes best practices for KEM usage in protocols, hybrid constructions, and key management — essential reference for correct PQC deployment. Source: NIST SP 800-227 Recommendations for KEMs | High | Incorrect or insecure KEM implementationslegacy key exchange protocols | FIPS 203 ML-KEM per SP 800-227 guidanceproper KEM-TLS integration | ||
| Cross-Industry | CROSS-012NewLow | Container image signing quantum vulnerability: Sigstore/cosign uses ECDSA-P256 exclusively for container image signatures in CI/CD pipelines. Container registries serve as critical software supply chain trust anchors for cloud-native deployments. Quantum forgery of container signatures enables injection of backdoored images into registries undetected affecting every Kubernetes deployment that pulls them. Sigstore transparency log (Rekor) provides tamper resistance but signature verification still depends on ECDSA. PQC support is planned but not yet implemented in the Sigstore ecosystem. Source: Sigstore / OpenSSF Supply Chain Security | High | ECDSA-P256 cosign signaturesFulcio short-lived certificatescontainer registry PKI | ML-DSA for container signingPQC-enabled Fulcio certificateshybrid signature verification | ||
| Cross-Industry | CROSS-013NewModerate | Quantum random number generation (QRNG) for PQC key security: PQC algorithm security depends on high-quality randomness for key generation. Classical PRNGs may contain algorithmic biases exploitable by sophisticated adversaries. QRNG uses quantum mechanical processes to generate theoretically unpredictable randomness. Quantinuum Quantum Origin became the first software QRNG to achieve NIST SP 800-90B entropy source validation (2024). Commercial QRNG products from ID Quantique Quside and QNu Labs are available for HSM IoT and automotive integration. QRNG complements PQC by ensuring cryptographic keys are non-predictable from generation. Source: NIST SP 800-90B / Quantinuum Quantum Origin | High | Classical PRNGs with potential algorithmic biashardware RNG with insufficient entropy | NIST SP 800-90B validated QRNGquantum entropy sources for HSM key generationhybrid classical-quantum RNG | ||
| Cryptocurrency / Blockchain | CRYPTO-001Low | Bitcoin ECDSA transaction hijacking: Approximately $718B in quantum-vulnerable P2PK addresses with exposed public keys (price-dependent estimate). Early P2PK addresses including Satoshi's estimated 1.1M BTC are permanently vulnerable as public keys are exposed on-chain. P2PKH addresses are protected until first spend. Source: Federal Reserve HNDL Paper | Critical | secp256k1 ECDSA | P2QRH (BIP-360) proposal with ML-DSA and SLH-DSA | ||
| Cryptocurrency / Blockchain | CRYPTO-002Low | Ethereum Foundation PQC initiative: Dedicated post-quantum security team established January 2026 with $2M across two research prizes (Poseidon Prize + Proximity Prize). Active development of account abstraction and Verkle tree migration paths. All Ethereum accounts that have transacted expose public keys making them quantum-vulnerable via secp256k1 ECDSA and BLS12-381. Source: Ethereum Foundation PQC Program | Critical | secp256k1 ECDSABLS12-381keccak256 address derivation | Account Abstraction (EIP-4337)Verkle Treesquantum-resistant signature schemes | ||
| Cryptocurrency / Blockchain | CRYPTO-003Low | Blockchain HNDL permanence risk: Federal Reserve research confirms distributed ledger networks face permanent data privacy risks from harvest-now-decrypt-later attacks even with future PQC deployment. On-chain transaction data is immutable — encrypted data harvested today remains permanently exposed once CRQCs arrive. Source: Federal Reserve Board FEDS Paper September 2025 | Critical | RSA-2048ECDSAECDH in blockchain protocolsBLS signatures | ML-KEM-1024ML-DSA-87SLH-DSAvalidator PQC authentication | ||
| Cryptocurrency / Blockchain | CRYPTO-004Low | Cryptocurrency custody HSM quantum vulnerability: Institutional custody solutions managing billions in digital assets rely on secp256k1 ECDSA keys stored in HSMs. NIST PQC standardization identifies ECDSA as quantum-vulnerable. Custody HSM vendors face multi-year FIPS 140-3 recertification timelines for PQC-enabled modules, creating a gap between threat emergence and mitigation availability. Source: Cryptocurrency Security Standard (CCSS) | Critical | secp256k1 ECDSA custody keysRSA/ECDH key wrappingHSM root keys | ML-KEM-1024ML-DSA-87PQC-enabled custody HSMs | ||
| Education / Research | EDU-001NewLow | Student PII harvest-now-decrypt-later exposure: FERPA mandates protection of student education records but does not address post-quantum cryptography. Student records including SSNs transcripts disciplinary records and health data are retained 60+ years. PowerSchool breach (2024) exposed 62 million student records demonstrating massive data aggregation risk. Encrypted student databases harvested today become readable once CRQCs arrive. Source: FERPA / US Department of Education | Critical | RSA/ECDSA protecting student information systemsTLS for SIS/LMS platformsdatabase encryption key wrapping | ML-KEM for database key managementAES-256-GCMquantum-safe TLS for EdTech platforms | ||
| Education / Research | EDU-002NewLow | SAML federation identity compromise: InCommon Federation provides SAML-based identity and access management for US research and education institutions. Federation metadata is signed with 4096-bit RSA keys. Quantum forgery of IdP signing keys enables forged SAML tokens and privilege escalation across all federated services including library systems research databases financial aid and student portals. eduroam WiFi authentication also relies on EAP with RADIUS using RSA/ECDSA certificates. Source: Internet2 InCommon Federation / Jisc Trust and Identity | Critical | RSA-4096 federation metadata signingSAML assertion signatures (RSA/ECDSA)eduroam RADIUS certificatesEAP-TLS | ML-DSA for SAML assertion signingPQC-enabled federation metadatahybrid certificate chains for eduroam | ||
| Education / Research | EDU-004NewLow | Federally funded research data quantum exposure: Universities conducting defense-funded research handle ITAR/EAR/CUI data requiring decades-long protection. CMMC 2.0 mandates NIST SP 800-171 controls for DoD-funded research. Research data on quantum computing itself advanced materials genomics and AI represents high-value intelligence targets. Harvest-now-decrypt-later attacks on university research networks could compromise national security research programs. Source: CMMC 2.0 / NIST SP 800-171 | Critical | RSA/ECDSA protecting research data repositoriesTLS for research collaboration platformsVPN encryption for lab networks | CNSA 2.0 compliance for defense researchML-KEM-1024 for data encryptionML-DSA-87 for research data signing | ||
| Education / Research | EDU-003NewLow | Digital credential and diploma forgery: W3C Verifiable Credentials 2.0 and Open Badges 3.0 standards use ECDSA/RSA digital signatures for tamper-proof academic credentials. Universities worldwide are adopting blockchain-backed digital diplomas with permanent on-chain signatures. Quantum forgery enables creation of fraudulent academic credentials that are cryptographically indistinguishable from legitimate ones with permanent lifetime impact. Source: W3C Verifiable Credentials Data Model 2.0 | High | ECDSA P-256 in W3C Verifiable CredentialsRSA in traditional diploma PKIblockchain ECDSA signatures | ML-DSA for credential signingSLH-DSA for long-term archival signaturesPQC-enabled credential verification | ||
| Education / Research | EDU-005NewLow | Education sector cyber attack escalation: Education is the most attacked sector globally with 4388 weekly cyberattacks per organization (2025) representing a 31% year-over-year increase. Average breach cost in higher education exceeds $3.7M. Schools use an average of 2591 EdTech tools per year each representing a potential attack surface. Quantum computing will amplify existing attack vectors by enabling cryptographic bypass of authentication and encryption across this already vulnerable sector. Source: Check Point Research / Higher Ed Dive | High | TLS protecting EdTech platformsRSA/ECDSA API authenticationschool network encryption | Hybrid TLS 1.3 with ML-KEMML-DSA for EdTech API signingcrypto-agile school network architecture | ||
| Energy / Critical Infrastructure | ENERGY-001Low | Power grid SCADA quantum vulnerability: IEC 62351 specifies security for power system communications (DNP3, IEC 61850, IEC 60870-5-104) using RSA/ECDSA for authentication. Critical infrastructure with 20-30 year equipment lifecycles and limited OTA update capability creates massive quantum exposure window. Source: IEC 62351 Power Systems Security Standards | Critical | RSA-2048 in SCADA authenticationECDSA in IEC 61850DNP3 Secure Authentication | IEC 62351 quantum updateML-DSA for SCADA authenticationhybrid protocols | ||
| Energy / Critical Infrastructure | ENERGY-002UpdatedLow | Nuclear facility digital I&C quantum exposure: NRC 10 CFR 73.54 requires cybersecurity for nuclear power plant digital instrumentation and control systems. Nuclear plants operate under 40-year initial licenses with 20-year renewals (some seeking subsequent 20-year renewals to 80 years total). Digital safety systems deployed today will operate well into the CRQC era. Source: NRC Cybersecurity Requirements (10 CFR 73.54) | Critical | Safety system digital I&C cryptographynuclear safeguards data encryption | Defense-in-depth with ML-KEM/ML-DSACNSA 2.0 compliance for nuclear systems | ||
| Energy / Critical Infrastructure | ENERGY-003Low | Smart grid quantum security research: University of Toronto CA$1.45M research project identifies real-time quantum attack scenarios targeting grid controllers, smart meters, and energy routers. Over 1 billion smart meters globally will require PQC migration; many lack OTA update capability requiring physical replacement. Source: University of Toronto Smart Grid Security Research | Critical | AMI mesh networkingsmart meter PKIPMU authenticationdistribution automation | Quantum-safe AMI protocolsIEC 62351 PQC updateconstrained device PQC | ||
| Energy / Critical Infrastructure | ENERGY-004Low | Pipeline and oil/gas SCADA quantum vulnerability: IEC 62443 governs industrial automation security for natural gas, oil, and water pipeline control systems. Equipment lifecycles of 20-30 years and air-gapped or semi-air-gapped network architectures complicate PQC migration. Pipeline SCADA systems are classified as critical infrastructure by CISA. Source: IEC 62443 Industrial Automation Security | High | ICS/SCADA protocolsVPN encryption for pipeline monitoringRTU authentication | IEC 62443 PQC updatehybrid VPN protocolsML-DSA for RTU authentication | ||
| Financial Services / Banking | FIN-001Low | BIS Project Leap quantum-safe payment system cryptography: Phase 2 launched July 2025 with Bank of Italy, Bank of France, Deutsche Bundesbank, Nexi-Colt, and SWIFT testing hybrid PQC on TARGET2 real-time gross settlement system. Demonstrates quantum-safe cryptographic integration for cross-border payment infrastructure processing trillions daily. Source: Bank for International Settlements Project Leap Phase 2 | Critical | Payment system infrastructurecross-border settlementRSA-2048ECDSATLS legacy | ML-KEM-1024ML-DSA-87hybrid TLS 1.3HQC | ||
| Financial Services / Banking | FIN-002Low | Harvest Now Decrypt Later (HNDL) attacks targeting long-lived financial data including transaction records and settlement logs. Federal Reserve research confirms cryptocurrency networks face permanent data privacy risks from HNDL even with future PQC deployment. Financial records retained for regulatory compliance spanning decades are prime targets. Source: Federal Reserve Board FEDS Paper September 2025 | Critical | RSA-2048ECDSAECDHECC-256/384 | ML-KEM-1024ML-DSA-87SLH-DSAAES-256 | ||
| Financial Services / Banking | FIN-004High | HSM backup key extraction vulnerability: Master encryption keys wrapped with RSA in HSM backup archives become recoverable with quantum computers, exposing entire key hierarchies protecting decades of financial data. NIST SP 800-227 (September 2025) provides formal KEM guidance for transitioning key wrapping to quantum-safe mechanisms. Source: NIST SP 800-227 KEM Recommendations | Critical | RSA key wrapping in HSM backupsECDH key agreementarchived master keys | ML-KEM-1024 per NIST SP 800-227AES-256-GCM key wrapping | ||
| Financial Services / Banking | FIN-003Low | G7 Cyber Expert Group PQC roadmap: January 2026 statement coordinated by U.S. Treasury and Bank of England establishes G7-wide framework for financial sector quantum-safe migration. Calls for cryptographic inventory, vendor roadmap alignment, and coordinated transition planning across G7 financial systems. Source: G7 Cyber Expert Group Statement (U.S. Treasury) | High | G7 financial infrastructurecross-border payment systemscorrespondent banking TLS | ML-KEMML-DSAhybrid implementationscoordinated G7 PQC standards | ||
| Financial Services / Banking | FIN-005Low | FS-ISAC PQC migration urgency warning: Financial Services Information Sharing and Analysis Center (September 2025) warns that financial sector organizations have not defined or allocated resources for quantum-resistant migration, compressing transition into unrealistically short timeframes. Without immediate action, roadmap collapse by 2030 compliance deadlines is likely. Source: FS-ISAC — The Timeline for Post Quantum Cryptographic Migration | High | RSAECCTLS 1.2/1.3 key exchangePKI certificates across financial infrastructure | ML-KEMML-DSAhybrid implementationsimmediate cryptographic inventory | ||
| Government / Defense | GOV-001High | HNDL on classified data: TOP SECRET information requiring 25-75+ year protection is actively harvested for future quantum decryption. Current encryption provides no protection against this threat. Source: NSA CNSA 2.0 Cybersecurity Advisory | Critical | RSA-2048/4096ECDH P-384ECDSA | ML-KEM-1024ML-DSA-87AES-256 | ||
| Government / Defense | GOV-002Moderate | CNSA 2.0 compliance deadline pressure: NSA mandates CNSA 2.0 compliance with phased deadlines — software/firmware signing supported and preferred by 2025 (exclusively by 2030), networking equipment supported and preferred by 2026 (exclusively by 2030), NSS acquisitions by January 2027, web browsers/servers/cloud supported and preferred by 2025 (exclusively by 2033), full transition by 2035. Source: NSA CNSA 2.0 Guidance | Critical | Federal PKINSS communicationsclassified systemsdefense supply chain | FIPS 140-3 validated PQC modulesCMVP certification acceleration | ||
| Government / Defense | GOV-005High | Nuclear command and control quantum exposure: NC3 (Nuclear Command, Control, and Communications) systems operate on 50+ year lifecycles and represent the highest-consequence quantum threat scenario. NSA CNSA 2.0 specifically identifies national security systems including strategic communications as priority for PQC transition. Source: NSA CNSA 2.0 Cybersecurity Advisory | Critical | All public-key cryptography in NC3 systemsstrategic communications encryption | CNSA 2.0 full suiteAES-256ML-KEM-1024ML-DSA-87 | ||
| Government / Defense | GOV-003Moderate | Federal PQC procurement guidance: CISA January 2026 federal buying guidance pursuant to Executive Order 14306 (June 2025) recommends agencies procure quantum-resistant technology across designated product categories including cloud services, collaboration tools, web browsers/servers, and endpoint security. Note: EO 14306 removed the original procurement mandate but CISA's product categories list strongly encourages PQC-capable acquisitions. Source: CISA Product Categories for PQC Technologies | High | COTS productsfederal IT infrastructuredefense systems | NIST FIPS 203/204/205 complianceACVP testingvendor PQC roadmaps | ||
| Government / Defense | GOV-004Low | Federal PKI signature forgery risk: Quantum-enabled impersonation of federal systems and fraudulent certificate issuance affecting government-wide trust infrastructure. The Federal PKI serves as the root of trust for digital identity across federal agencies, and quantum forgery of CA certificates would compromise the entire federal trust hierarchy. Source: Federal PKI Policy Authority | High | RSA-2048/4096 in Federal PKIECDSA P-256/P-384 intermediate certificates | ML-DSA-87SLH-DSAhybrid X.509 certificates | ||
| Healthcare / Pharmaceutical | HLTH-001Low | HNDL on patient records: Healthcare data has lifetime sensitivity; genomic data and mental health records remain sensitive indefinitely. HIPAA mandates 6+ year retention but records persist 25+ years. Source: HHS HIPAA Security Rule | Critical | RSAECDHECDSATLS | ML-KEM-768/1024ML-DSAAES-256 | ||
| Healthcare / Pharmaceutical | HLTH-002UpdatedLow | Healthcare cloud encryption and breach crisis: Only 4% of healthcare operators encrypted 80%+ of sensitive cloud data. Thales 2025 report shows 59% prototyping or evaluating PQC but low actual deployment. 725 major breaches in 2023 (per HHS OCR) exposed 168M+ individuals (2024 figures pending final OCR reporting). Health records retain lifetime sensitivity making them prime HNDL targets. Source: Thales 2025 Data Threat Report Healthcare Edition | Critical | EHR databasesmedical imagingpatient portalshealth information exchangescloud encryption | ML-KEM-768/1024ML-DSAAES-256-GCMquantum-safe TLS | ||
| Healthcare / Pharmaceutical | HLTH-004Low | Connected medical device lifecycle quantum exposure: FDA Section 524B of FD&C Act requires cybersecurity for medical devices. Implantable and connected devices (pacemakers, insulin pumps, remote monitoring) with 10-20 year lifecycles being deployed today will operate well into the CRQC era. Limited computational resources and power constraints in implantable devices restrict PQC options. Source: FDA Cybersecurity for Medical Devices | Critical | BLE cryptographyTLS in medical IoTembedded ECC in implantable devices | Crypto-agile device designhybrid firmware updatesML-DSA for device authentication | ||
| Healthcare / Pharmaceutical | HLTH-003Low | FDA premarket cybersecurity guidance: FDA finalized guidance (September 2023) under Section 524B of FD&C Act (Consolidated Appropriations Act 2023). Requires cryptographic risk assessment and Software Bill of Materials for new device submissions. Medical devices with 10-20 year lifecycles deploying now will operate into the CRQC era. Source: FDA Premarket Cybersecurity Guidance 2023 | High | RSA-2048ECDSA in device firmwareTLS in medical devicesPKI for device authentication | ML-KEM-768ML-DSAcrypto-agile firmware update mechanisms | ||
| Healthcare / Pharmaceutical | HLTH-005Low | Drug supply chain authentication quantum risk: Drug Supply Chain Security Act (DSCSA) mandates product serialization and verification to prevent counterfeit drug infiltration. EPCIS (Electronic Product Code Information Services) and verification systems rely on digital signatures and TLS. Quantum forgery of verification responses enables counterfeit drug injection into the legitimate supply chain. Source: FDA Drug Supply Chain Security Act (DSCSA) | High | EPCIS digital signaturesTLS authentication for verification systemsmanufacturer PKI | ML-DSA for supply chain signinghybrid verification certificatesPQC-enabled EPCIS | ||
| Insurance | INS-001UpdatedLow | NAIC Insurance Data Security Model Law (MDL-668) quantum exposure: Adopted 2017 and enacted in 22+ states (as of late 2025), requires encryption of nonpublic information in transit and at rest. Actuarial models, claims history spanning decades, and underwriting algorithms represent long-lived sensitive data prime for HNDL attacks. Source: NAIC Insurance Data Security Model Law (MDL-668) | High | RSA/ECDSA protecting policyholder dataTLS for claims processingdatabase encryption | ML-KEM for key exchangeAES-256-GCMML-DSA for document signing | ||
| Insurance | INS-002Low | New York DFS cybersecurity regulation (23 NYCRR 500) quantum gap: Requires risk assessment and encryption for financial services including insurance companies. Life insurance and annuity records with 50+ year retention periods are prime HNDL targets. Regulation does not yet address post-quantum cryptography. Source: NY DFS Cybersecurity Regulation (23 NYCRR 500) | High | Database encryptionpolicyholder data TLSclaims management systems | PQC-enabled encryptionhybrid TLS 1.3ML-KEM key management | ||
| Insurance | INS-003Low | Systemic cyber risk to insurance sector: Geneva Association research identifies systemic cyber risk including quantum threats to insurance industry managing multi-decade policy data. Life insurance and pension records retain sensitivity for 50+ years. Reinsurance treaties with multi-year duration vulnerable to data manipulation. Source: Geneva Association Systemic Cyber Risk Research | High | Actuarial model encryptionreinsurance platform cryptopolicyholder PII protection | AES-256 with ML-KEM key exchangeML-DSA for contract signingcrypto-agile platforms | ||
| Internet of Things (IoT) | IOT-001UpdatedLow | IoT device risk escalation: Forescout 2025 research reports overall average device risk scores increased 15% year-over-year, with significant country-level risk score increases. Billions of constrained devices using ECDSA P-256 and RSA-2048 with limited crypto-agility and no practical firmware update path for PQC migration. Source: Forescout Device Risk Research | Critical | ECDSA P-256RSA-2048TLS 1.2 in IoT devicesdevice provisioning certificates | Lightweight PQC (FN-DSASLH-DSA)hybrid schemes for constrained devices | ||
| Internet of Things (IoT) | IOT-002Low | Industrial IoT SCADA quantum vulnerability: IEC 62443 governs industrial automation security. OPC UA protocol uses RSA/ECDSA for authentication across manufacturing, energy, and critical infrastructure. IIoT environments with 15-25 year equipment lifecycles and air-gapped networks face complex PQC migration. Source: IEC 62443 Industrial Automation Security | Critical | OPC UA RSA/ECDSAIEC 62443 authenticationindustrial protocol encryption | OPC UA PQC implementationIEC 62443 quantum updatehybrid industrial protocols | ||
| Internet of Things (IoT) | IOT-003Low | IoT firmware update security (IETF SUIT): The IETF SUIT working group defines firmware update architecture (RFC 9019) with COSE-based manifest signing (using ECDSA/EdDSA per RFC 9052/9053) for firmware authentication. Constrained devices (Class 1-3) cannot support full PQC signature verification creating a security gap during migration. Source: IETF SUIT Working Group (RFC 9019) | High | COSE signatures (ECDSA/EdDSA)CoAP DTLSfirmware signing keys | Lightweight ML-DSASLH-DSA for stateless constrained devices or XMSS where state management is feasiblehybrid COSE signatures | ||
| Internet of Things (IoT) | IOT-004High | Smart city infrastructure quantum vulnerability: Traffic management, public safety cameras, environmental sensors, and municipal IoT systems form interconnected networks with diverse device types and long deployment cycles. ISO/IEC 30182 defines smart community infrastructure framework. City-wide mesh networks and cloud gateways aggregate sensitive data from thousands of endpoints. Source: ISO/IEC 30182 Smart City Concept Model | High | City-wide IoT mesh networkingcloud gateway TLSsensor authenticationmunicipal PKI | Quantum-safe smart city architecturehybrid mesh protocolsPQC-enabled gateways | ||
| IT Industry / Software | IT-001UpdatedLow | Open source cryptographic library PQC integration: OpenSSL 3.5 (April 2025) includes ML-KEM, ML-DSA, and SLH-DSA support with X25519MLKEM768 hybrid key exchange available in TLS (enabled by default in some configurations). Millions of applications depend on OpenSSL and similar libraries. Libsodium and other popular libraries lag behind creating widespread dependency risk during the PQC transition. Source: OpenSSL PQC Integration | Critical | Legacy RSA/ECDSA in crypto librariesOpenSSL pre-3.5libsodiumBoringSSL | OpenSSL 3.5+ with PQCOQS providerliboqs integration | ||
| IT Industry / Software | IT-002Low | Certificate authority and PKI PQC transition: CA/Browser Forum must coordinate migration of the global WebPKI trust hierarchy to post-quantum algorithms. Chrome and Firefox have shipped ML-KEM hybrid key exchange (X25519+ML-KEM-768). Root CA key migration requires coordinated trust store updates across all major browsers and operating systems. Source: CA/Browser Forum PKI Standards | Critical | CA root keys (RSA-4096/ECDSA)intermediate certificatesTLS server certificatesS/MIME | Hybrid X.509 certificatesML-DSA CA hierarchycomposite certificate standards | ||
| IT Industry / Software | IT-003Authoritative | NIST FIPS 203/204/205 standardization milestone: First official PQC standards published August 2024. FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) provide the foundation for all PQC migration. CMVP validation of implementations is ongoing with first validated modules expected 2025-2026. Source: NIST FIPS 203/204/205 Post-Quantum Cryptography Standards | Critical | All RSA/ECDSA/ECDH implementations requiring FIPS compliance | FIPS 203 (ML-KEM-512/768/1024)FIPS 204 (ML-DSA-44/65/87)FIPS 205 (SLH-DSA) | ||
| IT Industry / Software | IT-004Low | Code signing and software supply chain quantum vulnerability: Software supply chain integrity depends on RSA/ECDSA code signing for open source repositories, package managers, and CI/CD pipelines. SLSA (Supply-chain Levels for Software Artifacts) framework identifies signing as critical trust anchor. Quantum forgery of code signatures enables malicious package injection at scale. Source: SLSA Supply Chain Security Framework (OpenSSF) | Critical | RSA/ECDSA code signingpackage manager signaturesCI/CD pipeline authentication | ML-DSA code signingSLH-DSA for long-term artifactsSLSA PQC integration | ||
| IT Industry / Software | IT-005Low | Authentication infrastructure quantum vulnerability: Enterprise authentication systems including X.509 digital certificates, SAML assertions, OAuth/OIDC tokens, and FIDO2 attestation rely on quantum-vulnerable PKI. FIDO Alliance has published a PQC roadmap for WebAuthn migration. Migration to PQC-compatible credential systems requires coordinated ecosystem updates. Source: FIDO Alliance PQC Roadmap | High | X.509 certificatesSAML assertionsOAuth/OIDC tokensFIDO2 attestation keys | Hybrid certificate chainsML-DSA certificatesPQC-enabled FIDO2 per FIDO Alliance roadmap | ||
| Legal / Notary / eSignature | LEG-001Low | eIDAS long-term signature vulnerability: EU Regulation 910/2014 Article 25(2) grants qualified electronic signatures legal equivalence to handwritten signatures across 27 EU member states. Property deeds, constitutional documents, and notarial acts require 50-100+ year validity. Quantum signature forgery would retroactively undermine the integrity of millions of legally binding documents. Source: EU Regulation 910/2014 (eIDAS) | Critical | RSA-2048/4096ECDSA P-256/P-384SHA-256 in AdES formats (XAdESPAdESCAdES) | ML-DSA-65/87SLH-DSA for long-term archival signaturesXMSS | ||
| Legal / Notary / eSignature | LEG-002Low | eIDAS 2.0 Digital Identity Wallet quantum risk: Regulation 2024/1183 (entered force May 20, 2024) amends eIDAS to mandate European Digital Identity Wallets for all EU member states. Wallets must support qualified electronic attestations of attributes. Cryptographic protocols underpinning wallet-to-verifier authentication rely on RSA/ECDSA. Source: EU Regulation 2024/1183 (eIDAS 2.0) | High | ECDSA P-256RSA-2048ECDH in wallet authenticationX.509 certificates | ML-DSA-65/87ML-KEM-768/1024hybrid signature schemes | ||
| Legal / Notary / eSignature | LEG-003Low | Qualified timestamp quantum forgery risk: ETSI EN 319 422 governs qualified time-stamp authorities under the eIDAS framework using RFC 3161 time-stamp protocol. Timestamps cryptographically prove document existence at specific moments for legal evidence and IP filings. Quantum-capable adversaries could forge timestamps to backdate contracts or fabricate audit trails. Source: ETSI EN 319 422 Qualified Timestamp Policy | High | RSA-2048/4096ECDSA P-256/P-384 in RFC 3161 timestamp tokensSHA-256 | ML-DSA-65/87SLH-DSA for long-term timestamp integrity | ||
| Legal / Notary / eSignature | LEG-004High | Court electronic evidence repudiation risk: As quantum computing advances, defense attorneys may challenge the integrity of digitally signed electronic evidence, arguing signatures could have been forged. This introduces reasonable doubt for any evidence authenticated solely with quantum-vulnerable cryptography. Courts will need to establish new standards for digital evidence admissibility in the post-quantum era. Source: NIST SP 800-86 Guide to Integrating Forensic Techniques | High | RSA/ECDSA signatures on court filingsevidence chain of custodyforensic reports | PQC re-signing with archival timestampsSLH-DSA for evidence integrity | ||
| Media / Entertainment / DRM | MEDIA-001Moderate | Content encryption master key HNDL risk: AACS (Advanced Access Content System) protects Blu-ray and UHD content using RSA key hierarchy. Studio content libraries worth billions have indefinite commercial value. Master encryption keys harvested today enable future mass decryption of entire studio catalogs once CRQCs arrive. Source: AACS Licensing Administrator Specifications | Critical | AACS RSA key hierarchyPlayReadyFairPlay DRM key management | AES-256 with ML-KEM key wrappingquantum-safe DRM key distribution | ||
| Media / Entertainment / DRM | MEDIA-002Low | Streaming platform DRM quantum vulnerability: Major streaming services (Netflix, Disney+, Amazon) use Widevine, PlayReady, and FairPlay DRM systems with RSA key hierarchies for content license distribution. Combined global streaming revenue exceeds $100B annually with content catalogs representing irreplaceable IP. Source: AACS / Content Protection Standards | Critical | RSA key exchange in Widevine/PlayReady/FairPlaycontent encryption keyslicense server PKI | ML-KEM key wrappingquantum-safe license distributionAES-256 content encryption | ||
| Media / Entertainment / DRM | MEDIA-003Low | Broadcast conditional access quantum exposure: DVB Conditional Access Systems use ECM (Entitlement Control Messages) with RSA/ECDSA encryption protecting pay-TV content distribution. Set-top boxes and smart TVs with 7-10 year lifecycles have limited crypto-agility for PQC migration. Source: DVB Project — Conditional Access System Standards | High | DVB-CSA encryptionECM RSA/ECDSAbroadcast conditional access keys | AES-128/256 CAS upgradeML-KEM for ECM distribution | ||
| Payment Card Industry | PCI-001Low | EMV offline authentication quantum vulnerability: EMVCo specifications use RSA as the only approved asymmetric algorithm for offline card authentication (CDA/DDA). Approximately 14.7 billion EMV chip cards in circulation globally (end 2024). Quantum forgery of RSA signatures enables counterfeit card acceptance at any offline-capable terminal. Source: EMVCo Book 2 Security and Key Management | Critical | RSA-1024/2048 in EMV CDA/DDA offline authenticationcard personalization keys | ML-DSA hybrid offline authenticationFN-DSA for constrained chip environments | ||
| Payment Card Industry | PCI-002Low | PCI DSS 4.0.1 cryptographic gap: PCI DSS requires 'strong cryptography' for cardholder data protection but does not yet mandate post-quantum algorithms. Organizations meeting current PCI compliance may still be quantum-vulnerable. Cryptographic inventory requirements (Req 3/4) do not address PQC readiness assessment. Source: PCI Security Standards Council DSS 4.0.1 | High | TLS protecting payment dataRSA/ECDSA certificatesHSM key wrapping for card data | PQC-enabled payment HSMshybrid TLS 1.3ML-KEM for key exchange | ||
| Payment Card Industry | PCI-003Low | PIN block encryption quantum vulnerability: PIN encryption at scale relies on 3DES DUKPT; the quantum attack surface is the RSA-based key injection ceremony at Key Injection Facilities (KIFs) used to load base derivation keys into terminals — quantum forgery of RSA key transport enables malicious key injection at scale. AES-256 DUKPT provides quantum-resistant symmetric alternative but terminal hardware replacement required at massive scale. Source: PCI PIN Security Requirements | High | 3DES DUKPT base derivation keysRSA key injectionPIN encryption | AES-256 DUKPTML-KEM key injectionquantum-safe PIN encryption | ||
| Rail / Transit | RAIL-001Low | Railway signaling system quantum vulnerability: EN 50159 (Safety-related communication in railway systems) governs cryptographic authentication for ERTMS/ETCS (European Train Control System) train signaling. GSM-R and its successor FRMCS (Future Railway Mobile Communication System) provide the communication layer. Signaling infrastructure has 25-40 year lifecycles with limited upgrade paths. Quantum compromise of signaling authentication could enable unauthorized train movements. Source: EN 50159 Railway Communication Security / ERA | Critical | RSA/ECDSA in ERTMS/ETCS signaling authenticationGSM-R/FRMCS encryptioninterlocking system crypto | ML-DSA for signaling authenticationPQC-enabled FRMCShybrid railway protocols | ||
| Rail / Transit | RAIL-004NewLow | Positive Train Control (PTC) cryptographic migration: FRA regulations (49 CFR 236.1033) mandate cybersecurity for PTC systems controlling train movements across 57000+ miles of US freight and passenger rail. PTC uses wireless wayside-to-onboard communications with RSA/ECC for key establishment. Equipment lifecycles of 15-25 years mean systems deployed today will operate into the CRQC era. Limited computational resources in onboard units constrain PQC algorithm choices. Source: FRA Positive Train Control Regulations (49 CFR 236) | Critical | RSA/ECC key establishment in PTC wireless communicationsISO/IEC 29192-4 lightweight cryptofirmware signing | Quantum-resistant lightweight AEADML-KEM for wayside-to-vehicle key exchangecrypto-agile PTC firmware | ||
| Rail / Transit | RAIL-005NewModerate | Autonomous and driverless train system quantum exposure: Autonomous rail systems including CBTC (Communications-Based Train Control) and GoA4 driverless operations rely on continuous authenticated communication between trackside and onboard systems. ISO/SAE 21434 cybersecurity engineering standards and IEC 62443 industrial automation security govern these systems. Quantum forgery of infrastructure authentication enables unauthorized commands to driverless trains with potential for collisions or derailments. Source: ISO/SAE 21434 / IEC 62443 Autonomous Rail | Critical | RSA/ECC for V2I authenticationcertificate-based platform identityDiffie-Hellman session keysfirmware signing | SLH-DSA for firmware signingML-KEM for V2I key encapsulationpost-quantum authenticated key exchange | ||
| Rail / Transit | RAIL-002High | Transit ticketing and access control quantum exposure: ISO/IEC 14443 contactless smart cards and NFC-based ticketing systems used by transit authorities worldwide rely on cryptographic authentication. MIFARE DESFire and similar platforms use AES/3DES symmetric encryption (quantum-resistant) but PKI infrastructure for card issuance, key management systems, and back-office settlement use RSA/ECDSA. Source: ISO/IEC 14443 Contactless Card Standards | High | Ticketing PKIkey management RSA/ECDSAback-office settlement TLSmobile ticketing | ML-KEM for key managementML-DSA for PKIPQC-enabled mobile ticketing | ||
| Rail / Transit | RAIL-003NewLow | GSM-R to FRMCS transition quantum vulnerability: European railways are transitioning from legacy GSM-R to FRMCS (Future Railway Mobile Communication System) based on 5G technology (2026-2035 timeline). FRMCS introduces IP-based networks with asymmetric cryptography for authentication and key exchange inheriting 5G quantum vulnerabilities. During the parallel operation period both legacy A5/1 (broken) and 5G crypto (quantum-vulnerable) coexist. Deutsche Bahn begins live FRMCS tests in 2027. Without PQC integration from the design phase FRMCS will require costly retrofitting. Source: UIC / ETSI FRMCS Specification | High | GSM-R A5/1 stream cipherFRMCS 5G authentication (ECDSA/RSA)IKEv2 key exchange for railway backbone | ML-KEM hybrid for FRMCS key exchangeML-DSA for railway signaling authenticationnative PQC in FRMCS specification | ||
| Retail / E-Commerce | RETAIL-001Low | E-commerce payment flow quantum vulnerability: PCI DSS 4.0.1 requires strong cryptography for online payment processing but TLS protecting checkout flows uses RSA/ECDSA key exchange vulnerable to quantum attacks. E-commerce transaction volume exceeds $6 trillion globally with payment data in transit continuously exposed. Source: PCI Security Standards Council | Critical | TLS 1.2/1.3 RSA/ECDSA key exchangepayment tokenizationPOS encryption | Hybrid TLS 1.3 with ML-KEMPQC-enabled payment gatewaysquantum-safe tokenization | ||
| Retail / E-Commerce | RETAIL-002High | Customer data HNDL exposure: Retailers store customer PII, loyalty program data, payment history, and behavioral analytics for 5-10+ years for marketing and compliance. NIST Cybersecurity Framework identifies data protection as core function. Encrypted customer databases harvested today become readable with CRQCs. Source: NIST Cybersecurity Framework | High | Database encryption (RSA/ECDSA key management)CRM system TLSloyalty platform crypto | ML-KEM for database key managementAES-256-GCMhybrid encryption for customer data | ||
| Retail / E-Commerce | RETAIL-003Low | Retail supply chain authentication: GS1 standards govern product identification and supply chain visibility for billions of products globally. RFID, EDI (AS2/AS4), and electronic product codes use digital signatures for authentication. Quantum forgery enables counterfeit product injection and supply chain manipulation. Source: GS1 Global Standards | High | EDI AS2/AS4 encryptionRFID authenticationGS1 Digital Link signatures | ML-DSA for supply chain signingPQC-enabled EDIquantum-safe RFID | ||
| Supply Chain / Logistics | SUPPLY-001UpdatedLow | Maritime cybersecurity quantum exposure: IMO MSC-FAL.1/Circ.3 guidelines address maritime cybersecurity. Maritime sector carries approximately 80% of world trade by volume. Port management systems, vessel identity PKI (used in ECDIS and GMDSS), and maritime VPN infrastructure use RSA/ECDSA — AIS itself is an unauthenticated broadcast protocol and is not quantum-affected until authenticated replacements are deployed. Source: IMO Maritime Cyber Risk Management Guidelines | High | Port management system PKIvessel identity certificate PKImaritime VPN/TLSelectronic chart ECDIS authentication | ML-DSA for maritime authenticationPQC-enabled AISquantum-safe port systems | ||
| Supply Chain / Logistics | SUPPLY-002Low | Electronic Bill of Lading quantum vulnerability: DCSA standards for electronic Bills of Lading (eBL) enable digital trade documentation for containerized shipping. Digital signatures on eBL documents prove ownership and transfer rights for cargo worth billions. Quantum forgery enables cargo theft and trade document fraud. Source: DCSA Electronic Bill of Lading Standards | High | eBL digital signatures (RSA/ECDSA)trade document PKIshipping platform TLS | ML-DSA for eBL signinghybrid trade document certificatesPQC-enabled shipping platforms | ||
| Supply Chain / Logistics | SUPPLY-003Low | Customs and cross-border trade quantum risk: WCO SAFE Framework of Standards governs security and facilitation of international trade. Digital certificates for customs declarations, AEO (Authorized Economic Operator) credentials, and single window systems use RSA/ECDSA. Quantum forgery enables customs fraud at global scale. Source: WCO SAFE Framework of Standards | High | Customs declaration digital signaturesAEO certificatessingle window system PKI | ML-DSA for customs signingPQC-enabled single windowquantum-safe AEO credentials | ||
| Telecommunications | TELCO-001Low | HNDL on subscriber data: Mobile network operators retain call detail records, location data, and encrypted communications for 2-10 years. 5G user data encrypted with vulnerable algorithms. Source: GSMA Security Guidelines | Critical | RSAECDSAECDH (subscriber authentication and key exchange); AES-128 legacy bearers weakened by Grover's algorithm but not broken | ML-KEM-1024ML-DSAAES-256 | ||
| Telecommunications | TELCO-002UpdatedLow | GSMA Post-Quantum Telco Network Taskforce: Established September 2022 to coordinate quantum-safe migration for mobile network operators worldwide. Published PQ.03 guidelines (v2.0 October 2024) providing telecom-specific PQC migration guidance. Taskforce brings together major operators and vendors to develop industry-wide PQC migration roadmap for 5G/6G infrastructure. Source: GSMA Post-Quantum Telco Network Taskforce | High | 5G authentication (AKA)RAN encryptionIPsec/IKEv2 for network interconnects | 3GPP PQC integrationML-KEM for 5G securityhybrid authentication protocols | ||
| Telecommunications | TELCO-003Low | 5G network security quantum vulnerability: 3GPP specifications define 5G security architecture (TS 33.501) using ECDSA and RSA for network authentication. 5G network slicing authentication and RAN encryption protect critical enterprise, IoT, and emergency services. N2/N3 interface security relies on IPsec with quantum-vulnerable key exchange. Source: 3GPP TS 33.501 5G Security Architecture | High | 5G AKA protocolnetwork slice authenticationN2/N3 IPsec/IKEv2RAN encryption | 3GPP Release 19+ PQC integrationML-KEM for 5G SAhybrid IKEv2 | ||
| Telecommunications | TELCO-004Low | SIM card and eSIM authentication quantum vulnerability: Billions of SIM cards globally use RSA-2048 or ECDSA P-256 for authentication. GSMA eSIM remote provisioning (SGP.22) relies on PKI with quantum-vulnerable key exchange. SIM replacement cycles of 3-5 years provide a migration window but legacy devices will persist longer. Source: GSMA eSIM Specification (SGP.22) | High | RSA-2048ECDSA P-256 in SIM authenticationeSIM remote provisioning PKI | ML-DSA for SIM authenticationPQC-enabled eSIM provisioninghybrid schemes | ||
| Telecommunications | TELCO-005Low | 6G native PQC design window: 6G standards development (2025-2030 in 3GPP and ETSI) represents a critical opportunity to incorporate PQC from the design phase, avoiding the crypto-agility retrofit challenges facing 5G. ETSI ISG on Quantum-Safe Cryptography is providing input to 6G security architecture development. Source: ETSI ISG Quantum-Safe Cryptography / 3GPP | High | 6G authentication protocolsair interface encryptionnetwork slicingedge computing | Native ML-KEM/ML-DSA in 6G specificationsquantum-safe by design per ETSI QSC | ||
| Water / Wastewater | WATER-001Moderate | Water treatment plant SCADA quantum vulnerability: America's Water Infrastructure Act (AWIA) of 2018 requires community water systems serving 3,300+ people to conduct risk and resilience assessments including cybersecurity. Water treatment SCADA systems use ICS protocols with RSA/ECDSA authentication. CISA identifies Water and Wastewater Systems as one of 16 critical infrastructure sectors. Equipment lifecycles of 15-25 years with limited remote update capability. Source: EPA America's Water Infrastructure Act (AWIA) 2018 / CISA | Critical | SCADA/ICS authentication (RSA/ECDSA)VPN for remote monitoringhistorian database encryption | IEC 62443 PQC update for water systemsML-DSA for SCADA authenticationhybrid VPN | ||
| Water / Wastewater | WATER-005NewLow | Dam control system SCADA quantum vulnerability: FERC Security Program for Hydropower Projects governs cybersecurity for federally regulated dams. Dam SCADA systems control spillway gates water flow and emergency shutdowns with catastrophic failure consequences. Remote access gateways use RSA/ECC VPN authentication. Equipment lifecycles of 25-40 years with air-gapped architectures complicate PQC migration. FERC security requirements (Revision 3A 2016) have not been updated to address post-quantum threats. Source: FERC Security Program for Hydropower Projects | Critical | RSA/ECC VPN authentication for remote dam accesscertificate-based SCADA authenticationAES with RSA key wrapping | ML-KEM for VPN key encapsulationpost-quantum certificate infrastructurequantum-resistant remote access | ||
| Water / Wastewater | WATER-004NewModerate | Wastewater treatment SCADA quantum vulnerability: Wastewater SCADA systems are architecturally distinct from drinking water treatment serving sewage pumping biosolids handling and effluent discharge control. EPA/CISA guidance (August 2024) classifies wastewater under essential services. Newer systems use OPC UA and DNP3 Secure Authentication with RSA/ECC key establishment. Quantum-enabled decryption of control commands could corrupt treatment processes releasing untreated sewage into waterways with environmental and public health catastrophe. Source: NIST NCCoE Water/Wastewater Cybersecurity Project | Critical | RSA/ECC in OPC UA certificatesDNP3 Secure AuthenticationVPN for remote HMI access | Quantum-resistant OPC UA profilespost-quantum DNP3 authenticationhybrid VPN for wastewater SCADA | ||
| Water / Wastewater | WATER-002Low | Smart water infrastructure quantum exposure: AWWA (American Water Works Association) standards govern smart water metering, leak detection sensors, and distribution network monitoring using IoT-connected devices. Advanced Metering Infrastructure (AMI) for water utilities faces similar PQC migration challenges as energy smart meters — constrained devices with limited crypto-agility deployed for 10-15 year cycles. Source: AWWA Cybersecurity Guidance for Water Utilities | High | AMI mesh networkingsmart meter PKISCADA remote terminal unitscloud platform TLS | Quantum-safe AMI protocolsML-KEM for device provisioningconstrained device PQC | ||
| Water / Wastewater | WATER-003NewLow | Water quality monitoring IoT sensor quantum exposure: EPA cybersecurity guidance (August 2024) addresses water sector IoT but lacks specific PQC requirements. Real-time water quality sensors monitoring pH turbidity dissolved oxygen and contaminants communicate via IoT protocols with RSA/ECC key bootstrap. Constrained sensors lack crypto-agility for mid-life PQC migration. Quantum-enabled data integrity attacks could inject false sensor readings causing treatment failures and public health emergencies. Source: EPA Cybersecurity for Water Sector (August 2024) | High | RSA/ECC sensor-to-gateway key bootstrapTLS for cloud data aggregationIoT provisioning certificates | Post-quantum key agreement for sensor provisioninglightweight PQC for constrained IoThybrid gateway encryption |
- CriticalAerospace / AviationNSA CNSA 2.0 Cyberse...
Satellite communication HNDL vulnerability: Military and commercial satellites have 15-25 year operational lifespans. NSA CNSA 2.0 mandates PQC for all national security systems including satellite uplink/downlink by 2035. Currently intercepted satellite communications are harvestable for future quantum decryption.
At Risk
Satellite uplink/downlink RSA/ECDSA, ground station TLS, inter-satellite link encryption
PQC Replacement
ML-KEM-1024, ML-DSA-87 per CNSA 2.0, AES-256
- HighAerospace / AviationICAO Assembly Resolu...
Air traffic management authentication gap: ICAO Assembly Resolution A41-19 (2022) addresses aviation cybersecurity but ADS-B transmissions remain unencrypted and unauthenticated. ADS-B currently lacks any cryptographic protection; quantum computing becomes relevant when authenticated ADS-B is deployed using public-key cryptography, which would itself require PQC to remain secure.
At Risk
ADS-B (unencrypted), Mode S, ATC data links, ACARS messaging
PQC Replacement
Authenticated ADS-B with ML-DSA, quantum-safe ATC protocols
- CriticalAutomotive / Connected VehiclesISO/SAE 21434 Road V...
V2X PKI quantum transition: ISO/SAE 21434 (published August 2021) establishes cybersecurity engineering requirements for road vehicles. V2X communications use ECDSA P-256 certificates per IEEE 1609.2. Vehicles have 12+ year lifecycles meaning 2026 production vehicles remain on roads through 2038+ when CRQCs may be operational.
At Risk
ECDSA P-256 V2X certificates, IEEE 1609.2 PKI, digital key infrastructure
PQC Replacement
ML-DSA V2X certificates, hybrid V2X authentication, FN-DSA for constrained ECUs
- CriticalAutomotive / Connected VehiclesSAE J3061 / ISO/SAE ...
OTA firmware update signature forgery: Over-the-Air update mechanisms for modern connected vehicles use RSA/ECDSA code signing. Quantum forgery of update signatures enables malicious code injection into vehicle ECUs controlling braking, steering, and powertrain systems.
At Risk
RSA/ECDSA code signing, secure boot chains, ECU firmware verification
PQC Replacement
ML-DSA firmware signing, SLH-DSA for safety-critical ECUs, dual-signature verification
- HighAutomotive / Connected VehiclesUNECE WP.29 Regulati...
UNECE WP.29 R155/R156 cybersecurity regulation gap: Mandatory for new vehicle type approvals in EU since July 2022 and extended to all new vehicles July 2024. Requires cybersecurity management systems and secure OTA updates but does not yet address post-quantum cryptography creating a future compliance gap.
At Risk
TLS for telematics, RSA/ECDSA for OTA signing, connected car cloud API authentication
PQC Replacement
Hybrid TLS 1.3 with ML-KEM, ML-DSA OTA signing, crypto-agile telematics
- HighAutomotive / Connected VehiclesISO/SAE 21434 Road V...
In-vehicle network security quantum exposure: ISO/SAE 21434 covers the full vehicle cybersecurity lifecycle including CAN bus, LIN, FlexRay, and automotive Ethernet backbone networks. Embedded ECUs have limited computational resources and constrained crypto-agility, making mid-lifecycle PQC migration impractical for vehicles already in production.
At Risk
CAN bus authentication, secure boot in ECUs, in-vehicle Ethernet encryption, HSM key storage
PQC Replacement
Hardware security modules with PQC support, crypto-agile ECU design, ML-DSA for secure boot
- CriticalCloud Computing / Data CentersNIST IR 8547 / NIST ...
Federal cloud PQC compliance requirements: NIST SP 800-210 general access control guidance for cloud systems combined with NIST IR 8547 deprecation timeline means federal cloud deployments must transition to PQC by 2030. FedRAMP and StateRAMP certifications will require FIPS 203/204/205 compliance.
At Risk
Federal cloud TLS, FedRAMP-authorized encryption, cloud HSM FIPS modules
PQC Replacement
FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) cloud implementations
- CriticalCloud Computing / Data CentersNIST SP 800-210 Clou...
Cloud HSM and key management PQC gap: NIST SP 800-210 defines access control for cloud systems but cloud-hosted HSMs and KMS services currently lack full PQC support. FIPS 140-3 validation for PQC modules is ongoing with multi-year certification timelines. Organizations using cloud HSMs face vendor dependency for PQC migration.
At Risk
Cloud HSM root keys, KMS key wrapping, tenant isolation keys, FIPS 140-3 modules
PQC Replacement
FIPS 140-3 validated PQC HSM modules, bring-your-own-key PQC, ML-KEM key wrapping
- HighCloud Computing / Data CentersCloud Security Allia...
Cloud backup and disaster recovery HNDL risk: Air-gapped backups and long-term archival storage encrypted with RSA/ECDSA key wrapping are vulnerable to harvest-now-decrypt-later. Cloud backup data often retained for 7+ years for compliance.
At Risk
Backup encryption key wrapping, archival storage TLS, disaster recovery replication
PQC Replacement
PQC-enabled backup encryption, ML-KEM key wrapping, AES-256 for archival
- HighCloud Computing / Data CentersCloud Security Allia...
Cloud Security Alliance quantum readiness guidance: CSA published quantum-safe security guidance identifying crypto-agility as critical requirement for cloud deployments. Multi-cloud environments using 5+ key management systems face fragmented PQC migration paths.
At Risk
Cloud KMS key wrapping, multi-cloud encryption, BYOK/HYOK solutions, secrets management
PQC Replacement
Unified PQC key management, ML-KEM cloud HSM integration, crypto-agile KMS
- CriticalCritical InfrastructureCISA Post-Quantum Cr...
CISA 16 critical infrastructure sectors PQC readiness gap: Presidential Policy Directive PPD-21 defines 16 critical infrastructure sectors. CISA January 2026 Product Categories List per Executive Order 14306 provides PQC procurement guidance but sector-specific PQC guidance exists for only a subset of sectors. RAND Corporation analysis identifies internet services identity management IT products and power grid as highest priority NCFs for PQC migration. Most CI sectors lack dedicated PQC migration roadmaps creating fragmented preparedness.
At Risk
All asymmetric cryptography across 16 CI sectors, sector-specific SCADA/ICS protocols, federal PKI
PQC Replacement
Sector-specific PQC migration roadmaps, FIPS 203/204/205 compliance, CISA ACDI deployment
- CriticalCritical InfrastructureEU NIS2 Directive / ...
EU NIS2 Directive quantum implications for essential services: NIS2 (effective October 2024) requires proportionate technical and organizational security measures for essential services but does not explicitly mandate PQC. ENISA June 2025 implementing guidelines recommend post-quantum cryptography adoption for long-lived sensitive data. European Cybersecurity Certification Group (ECCG) incorporated PQC into Agreed Cryptographic Mechanisms v2.0 (April 2025) making PQC part of EUCC certification. Essential services in scope include energy water healthcare digital infrastructure waste management and digital service providers across all EU member states.
At Risk
All quantum-vulnerable cryptography in NIS2 essential services, TLS/IPsec for CI networks, SCADA encryption
PQC Replacement
ML-KEM/ML-DSA per ECCG ACM v2.0, hybrid implementations, PQC-by-default for new systems by 2030
- CriticalCritical InfrastructureNIST SP 800-82 / IEC...
ICS/SCADA protocol collective quantum vulnerability: Modbus DNP3 and OPC UA are foundational industrial control protocols deployed across energy water manufacturing transportation and defense. Modbus and DNP3 were designed without cryptographic authentication; modern deployments add TLS/VPN overlays using RSA/ECC. OPC UA integrates RSA/ECC certificate authentication natively. Quantum computers can forge OPC UA certificates masquerade as legitimate controllers decrypt historical VPN traffic and break firmware signatures enabling undetected tampering across all critical infrastructure sectors simultaneously.
At Risk
OPC UA RSA/ECC certificates, Modbus TCP over TLS (RSA key exchange), DNP3 Secure Authentication, VPN RSA/ECDH
PQC Replacement
Crypto-agile OPC UA with ML-KEM/ML-DSA, quantum-resistant VPN overlays for Modbus, post-quantum DNP3 SA
- CriticalCross-IndustryIBM Institute for Bu...
Quantum-safe readiness gap: Organizations score average 25/100 on IBM Quantum-Safe Readiness Index. 70% lack complete cryptographic inventory, creating massive vulnerability window. Estimated 5-6 year gap between CRQC arrival and organizational readiness completion.
At Risk
All asymmetric cryptography, PKI infrastructure, key management systems
PQC Replacement
Comprehensive CBOM, automated discovery tools, ML-KEM/ML-DSA migration
- CriticalCross-IndustryNIST IR 8547 Transit...
NIST IR 8547 proposed transition timeline: NIST Initial Public Draft (November 2024) establishes proposed timeline to deprecate RSA, ECDSA, ECDH, and EdDSA by 2030 and disallow them entirely after 2035. Sets 112-bit security minimum. Final version pending as of February 2026. Landmark publication making PQC migration a compliance requirement for federal systems.
At Risk
RSA-2048/3072/4096, ECDSA P-256/P-384, ECDH, EdDSA
PQC Replacement
ML-KEM-768/1024 (FIPS 203), ML-DSA-44/65/87 (FIPS 204), SLH-DSA (FIPS 205)
- CriticalCross-IndustryGlobal Risk Institut...
CRQC timeline uncertainty: Global Risk Institute 2025 survey of 26 quantum computing experts estimates 28-49% probability of a cryptographically relevant quantum computer (CRQC) within 10 years (up significantly from 19-34% in 2024) and 5-15% within 5 years. Majority of experts now consider a CRQC by 2035 quite likely. Harvest-now-decrypt-later attacks make immediate PQC migration urgent regardless of exact timeline.
At Risk
RSA-2048/4096, ECC P-256/384, ECDSA, ECDH, EdDSA
PQC Replacement
Immediate hybrid PQC deployment, ML-KEM-1024, ML-DSA-87
- CriticalCross-IndustryEuropean Commission ...
EU coordinated PQC transition roadmap: European Commission published coordinated PQC roadmap (June 2025) establishing EU-wide milestones. By December 2026: national transition roadmaps and initial identification steps. By December 2030: high-risk use cases transitioned and PQC-by-default for new systems. By December 2035: PQC transition completed for as many systems as feasible across all EU member states.
At Risk
All quantum-vulnerable cryptography in EU member state systems and critical infrastructure
PQC Replacement
ML-KEM, ML-DSA, SLH-DSA, hybrid implementations per EU coordinated timeline
- CriticalCross-IndustryIETF DNSSEC PQC Stra...
DNSSEC quantum signature forgery: DNSSEC uses RSA (RSASHA256 per RFC 6944) and ECDSA (ECDSAP256SHA256 per RFC 6605) to sign DNS records. Approximately 40% of global DNS domains have DNSSEC enabled including 92% root zone adoption. Quantum forgery of DNSSEC signatures enables DNS hijacking for any signed domain redirecting traffic to attacker-controlled servers. PQC signatures face challenges with DNS UDP packet size limits (~1232 bytes) requiring protocol-level changes. IETF draft-sheth-pqc-dnssec-strategy-00 addresses migration strategy.
At Risk
RSASHA256 (RFC 6944), ECDSAP256SHA256/ECDSAP384SHA384 (RFC 6605), DNSSEC zone signing keys and key signing keys
PQC Replacement
ML-DSA or FN-DSA for compact DNSSEC signatures, hybrid DNS signing, TCP fallback for larger PQC signatures
- CriticalCross-IndustryAPNIC / RIPE Labs RP...
BGP/RPKI route origin validation quantum vulnerability: RPKI uses RSA-2048 exclusively for signing Route Origin Authorizations (ROAs) that validate BGP route origins. As of 2025 54-59% of IPv4/IPv6 routes are covered by ROAs representing ~74% of global internet traffic. Quantum forgery of ROAs enables attackers to hijack arbitrary IP address prefixes globally redirecting internet traffic at scale. Post-quantum RPKI would increase data sizes from 1.2GB to 2.9-39.1GB depending on algorithm creating significant operational challenges.
At Risk
RSA-2048 ROA signatures, RPKI certificate hierarchy, BGP route validation
PQC Replacement
ML-DSA for ROA signing, hybrid RPKI certificates, bandwidth-optimized PQC for route validation
- CriticalCross-IndustryOpenSSH Post-Quantum...
SSH key quantum exposure: Billions of SSH keys globally use RSA-2048/4096 ECDSA and Ed25519 for server authentication and remote access. Historical SSH sessions captured today can be decrypted once CRQCs arrive exposing credentials and sensitive data. OpenSSH 10.0 (April 2025) made ML-KEM hybrid (mlkem768x25519-sha256) the default key exchange. GitHub enabled post-quantum SSH (sntrup761x25519-sha512) in September 2025. Legacy SSH deployments without PQC remain vulnerable to harvest-now-decrypt-later attacks.
At Risk
RSA-2048/4096 SSH host keys, ECDSA P-256/P-384 keys, Ed25519, Diffie-Hellman key exchange
PQC Replacement
mlkem768x25519-sha256 (OpenSSH 10.0 default), sntrup761x25519-sha512 hybrid, ML-KEM key exchange
- HighCross-IndustryIBM Institute for Bu...
Vendor dependency crisis: 62% of organizations incorrectly assume vendors will manage quantum-safe transition automatically. Lack of contractual PQC requirements and service-level agreements for crypto-agility.
At Risk
Third-party API keys, vendor-managed HSMs, cloud KMS
PQC Replacement
Vendor PQC roadmap requirements, contractual crypto-agility clauses
- HighCross-IndustryNIST FIPS 206 FN-DSA...
FIPS 206 FN-DSA (Falcon) standardization status: NIST published the Initial Public Draft of FIPS 206 (FN-DSA) in late 2025 with public comment period underway as of early 2026. Development has taken longer than initially projected due to the mathematical complexity of the algorithm. Once finalized, FN-DSA will provide a 4th PQC standard optimized for compact signatures.
At Risk
RSA/ECDSA certificates requiring compact signatures, root CA keys, constrained device authentication
PQC Replacement
FN-DSA (FIPS 206) for compact signatures, ML-DSA for general-purpose signing
- HighCross-IndustryNIST Post-Quantum Cr...
HQC selected as 5th PQC algorithm: NIST announced March 11 2025 the selection of HQC (Hamming Quasi-Cyclic) as a backup KEM to ML-KEM. HQC is based on error-correcting codes rather than lattices, providing algorithmic diversity in case a lattice-based vulnerability is discovered. Draft standard expected for public comment in early 2026 with final standard in 2027.
At Risk
All systems relying solely on ML-KEM without backup KEM
PQC Replacement
HQC as backup KEM alongside ML-KEM-768/1024, algorithm diversity strategy
- HighCross-IndustryNIST SP 800-227 Reco...
NIST SP 800-227 KEM recommendations: Published September 2025 as final guidance on key-encapsulation mechanisms. Provides definitions, security properties, and implementation recommendations for KEMs as companion guidance to FIPS 203 (ML-KEM). Establishes best practices for KEM usage in protocols, hybrid constructions, and key management — essential reference for correct PQC deployment.
At Risk
Incorrect or insecure KEM implementations, legacy key exchange protocols
PQC Replacement
FIPS 203 ML-KEM per SP 800-227 guidance, proper KEM-TLS integration
- HighCross-IndustrySigstore / OpenSSF S...
Container image signing quantum vulnerability: Sigstore/cosign uses ECDSA-P256 exclusively for container image signatures in CI/CD pipelines. Container registries serve as critical software supply chain trust anchors for cloud-native deployments. Quantum forgery of container signatures enables injection of backdoored images into registries undetected affecting every Kubernetes deployment that pulls them. Sigstore transparency log (Rekor) provides tamper resistance but signature verification still depends on ECDSA. PQC support is planned but not yet implemented in the Sigstore ecosystem.
At Risk
ECDSA-P256 cosign signatures, Fulcio short-lived certificates, container registry PKI
PQC Replacement
ML-DSA for container signing, PQC-enabled Fulcio certificates, hybrid signature verification
- HighCross-IndustryNIST SP 800-90B / Qu...
Quantum random number generation (QRNG) for PQC key security: PQC algorithm security depends on high-quality randomness for key generation. Classical PRNGs may contain algorithmic biases exploitable by sophisticated adversaries. QRNG uses quantum mechanical processes to generate theoretically unpredictable randomness. Quantinuum Quantum Origin became the first software QRNG to achieve NIST SP 800-90B entropy source validation (2024). Commercial QRNG products from ID Quantique Quside and QNu Labs are available for HSM IoT and automotive integration. QRNG complements PQC by ensuring cryptographic keys are non-predictable from generation.
At Risk
Classical PRNGs with potential algorithmic bias, hardware RNG with insufficient entropy
PQC Replacement
NIST SP 800-90B validated QRNG, quantum entropy sources for HSM key generation, hybrid classical-quantum RNG
- CriticalCryptocurrency / BlockchainFederal Reserve HNDL...
Bitcoin ECDSA transaction hijacking: Approximately $718B in quantum-vulnerable P2PK addresses with exposed public keys (price-dependent estimate). Early P2PK addresses including Satoshi's estimated 1.1M BTC are permanently vulnerable as public keys are exposed on-chain. P2PKH addresses are protected until first spend.
At Risk
secp256k1 ECDSA
PQC Replacement
P2QRH (BIP-360) proposal with ML-DSA and SLH-DSA
- CriticalCryptocurrency / BlockchainEthereum Foundation ...
Ethereum Foundation PQC initiative: Dedicated post-quantum security team established January 2026 with $2M across two research prizes (Poseidon Prize + Proximity Prize). Active development of account abstraction and Verkle tree migration paths. All Ethereum accounts that have transacted expose public keys making them quantum-vulnerable via secp256k1 ECDSA and BLS12-381.
At Risk
secp256k1 ECDSA, BLS12-381, keccak256 address derivation
PQC Replacement
Account Abstraction (EIP-4337), Verkle Trees, quantum-resistant signature schemes
- CriticalCryptocurrency / BlockchainFederal Reserve Boar...
Blockchain HNDL permanence risk: Federal Reserve research confirms distributed ledger networks face permanent data privacy risks from harvest-now-decrypt-later attacks even with future PQC deployment. On-chain transaction data is immutable — encrypted data harvested today remains permanently exposed once CRQCs arrive.
At Risk
RSA-2048, ECDSA, ECDH in blockchain protocols, BLS signatures
PQC Replacement
ML-KEM-1024, ML-DSA-87, SLH-DSA, validator PQC authentication
- CriticalCryptocurrency / BlockchainCryptocurrency Secur...
Cryptocurrency custody HSM quantum vulnerability: Institutional custody solutions managing billions in digital assets rely on secp256k1 ECDSA keys stored in HSMs. NIST PQC standardization identifies ECDSA as quantum-vulnerable. Custody HSM vendors face multi-year FIPS 140-3 recertification timelines for PQC-enabled modules, creating a gap between threat emergence and mitigation availability.
At Risk
secp256k1 ECDSA custody keys, RSA/ECDH key wrapping, HSM root keys
PQC Replacement
ML-KEM-1024, ML-DSA-87, PQC-enabled custody HSMs
- CriticalEducation / ResearchFERPA / US Departmen...
Student PII harvest-now-decrypt-later exposure: FERPA mandates protection of student education records but does not address post-quantum cryptography. Student records including SSNs transcripts disciplinary records and health data are retained 60+ years. PowerSchool breach (2024) exposed 62 million student records demonstrating massive data aggregation risk. Encrypted student databases harvested today become readable once CRQCs arrive.
At Risk
RSA/ECDSA protecting student information systems, TLS for SIS/LMS platforms, database encryption key wrapping
PQC Replacement
ML-KEM for database key management, AES-256-GCM, quantum-safe TLS for EdTech platforms
- CriticalEducation / ResearchInternet2 InCommon F...
SAML federation identity compromise: InCommon Federation provides SAML-based identity and access management for US research and education institutions. Federation metadata is signed with 4096-bit RSA keys. Quantum forgery of IdP signing keys enables forged SAML tokens and privilege escalation across all federated services including library systems research databases financial aid and student portals. eduroam WiFi authentication also relies on EAP with RADIUS using RSA/ECDSA certificates.
At Risk
RSA-4096 federation metadata signing, SAML assertion signatures (RSA/ECDSA), eduroam RADIUS certificates, EAP-TLS
PQC Replacement
ML-DSA for SAML assertion signing, PQC-enabled federation metadata, hybrid certificate chains for eduroam
- CriticalEducation / ResearchCMMC 2.0 / NIST SP 8...
Federally funded research data quantum exposure: Universities conducting defense-funded research handle ITAR/EAR/CUI data requiring decades-long protection. CMMC 2.0 mandates NIST SP 800-171 controls for DoD-funded research. Research data on quantum computing itself advanced materials genomics and AI represents high-value intelligence targets. Harvest-now-decrypt-later attacks on university research networks could compromise national security research programs.
At Risk
RSA/ECDSA protecting research data repositories, TLS for research collaboration platforms, VPN encryption for lab networks
PQC Replacement
CNSA 2.0 compliance for defense research, ML-KEM-1024 for data encryption, ML-DSA-87 for research data signing
- HighEducation / ResearchW3C Verifiable Crede...
Digital credential and diploma forgery: W3C Verifiable Credentials 2.0 and Open Badges 3.0 standards use ECDSA/RSA digital signatures for tamper-proof academic credentials. Universities worldwide are adopting blockchain-backed digital diplomas with permanent on-chain signatures. Quantum forgery enables creation of fraudulent academic credentials that are cryptographically indistinguishable from legitimate ones with permanent lifetime impact.
At Risk
ECDSA P-256 in W3C Verifiable Credentials, RSA in traditional diploma PKI, blockchain ECDSA signatures
PQC Replacement
ML-DSA for credential signing, SLH-DSA for long-term archival signatures, PQC-enabled credential verification
- HighEducation / ResearchCheck Point Research...
Education sector cyber attack escalation: Education is the most attacked sector globally with 4388 weekly cyberattacks per organization (2025) representing a 31% year-over-year increase. Average breach cost in higher education exceeds $3.7M. Schools use an average of 2591 EdTech tools per year each representing a potential attack surface. Quantum computing will amplify existing attack vectors by enabling cryptographic bypass of authentication and encryption across this already vulnerable sector.
At Risk
TLS protecting EdTech platforms, RSA/ECDSA API authentication, school network encryption
PQC Replacement
Hybrid TLS 1.3 with ML-KEM, ML-DSA for EdTech API signing, crypto-agile school network architecture
- CriticalEnergy / Critical InfrastructureIEC 62351 Power Syst...
Power grid SCADA quantum vulnerability: IEC 62351 specifies security for power system communications (DNP3, IEC 61850, IEC 60870-5-104) using RSA/ECDSA for authentication. Critical infrastructure with 20-30 year equipment lifecycles and limited OTA update capability creates massive quantum exposure window.
At Risk
RSA-2048 in SCADA authentication, ECDSA in IEC 61850, DNP3 Secure Authentication
PQC Replacement
IEC 62351 quantum update, ML-DSA for SCADA authentication, hybrid protocols
- CriticalEnergy / Critical InfrastructureNRC Cybersecurity Re...
Nuclear facility digital I&C quantum exposure: NRC 10 CFR 73.54 requires cybersecurity for nuclear power plant digital instrumentation and control systems. Nuclear plants operate under 40-year initial licenses with 20-year renewals (some seeking subsequent 20-year renewals to 80 years total). Digital safety systems deployed today will operate well into the CRQC era.
At Risk
Safety system digital I&C cryptography, nuclear safeguards data encryption
PQC Replacement
Defense-in-depth with ML-KEM/ML-DSA, CNSA 2.0 compliance for nuclear systems
- CriticalEnergy / Critical InfrastructureUniversity of Toront...
Smart grid quantum security research: University of Toronto CA$1.45M research project identifies real-time quantum attack scenarios targeting grid controllers, smart meters, and energy routers. Over 1 billion smart meters globally will require PQC migration; many lack OTA update capability requiring physical replacement.
At Risk
AMI mesh networking, smart meter PKI, PMU authentication, distribution automation
PQC Replacement
Quantum-safe AMI protocols, IEC 62351 PQC update, constrained device PQC
- HighEnergy / Critical InfrastructureIEC 62443 Industrial...
Pipeline and oil/gas SCADA quantum vulnerability: IEC 62443 governs industrial automation security for natural gas, oil, and water pipeline control systems. Equipment lifecycles of 20-30 years and air-gapped or semi-air-gapped network architectures complicate PQC migration. Pipeline SCADA systems are classified as critical infrastructure by CISA.
At Risk
ICS/SCADA protocols, VPN encryption for pipeline monitoring, RTU authentication
PQC Replacement
IEC 62443 PQC update, hybrid VPN protocols, ML-DSA for RTU authentication
- CriticalFinancial Services / BankingBank for Internation...
BIS Project Leap quantum-safe payment system cryptography: Phase 2 launched July 2025 with Bank of Italy, Bank of France, Deutsche Bundesbank, Nexi-Colt, and SWIFT testing hybrid PQC on TARGET2 real-time gross settlement system. Demonstrates quantum-safe cryptographic integration for cross-border payment infrastructure processing trillions daily.
At Risk
Payment system infrastructure, cross-border settlement, RSA-2048, ECDSA, TLS legacy
PQC Replacement
ML-KEM-1024, ML-DSA-87, hybrid TLS 1.3, HQC
- CriticalFinancial Services / BankingFederal Reserve Boar...
Harvest Now Decrypt Later (HNDL) attacks targeting long-lived financial data including transaction records and settlement logs. Federal Reserve research confirms cryptocurrency networks face permanent data privacy risks from HNDL even with future PQC deployment. Financial records retained for regulatory compliance spanning decades are prime targets.
At Risk
RSA-2048, ECDSA, ECDH, ECC-256/384
PQC Replacement
ML-KEM-1024, ML-DSA-87, SLH-DSA, AES-256
- CriticalFinancial Services / BankingNIST SP 800-227 KEM ...
HSM backup key extraction vulnerability: Master encryption keys wrapped with RSA in HSM backup archives become recoverable with quantum computers, exposing entire key hierarchies protecting decades of financial data. NIST SP 800-227 (September 2025) provides formal KEM guidance for transitioning key wrapping to quantum-safe mechanisms.
At Risk
RSA key wrapping in HSM backups, ECDH key agreement, archived master keys
PQC Replacement
ML-KEM-1024 per NIST SP 800-227, AES-256-GCM key wrapping
- HighFinancial Services / BankingG7 Cyber Expert Grou...
G7 Cyber Expert Group PQC roadmap: January 2026 statement coordinated by U.S. Treasury and Bank of England establishes G7-wide framework for financial sector quantum-safe migration. Calls for cryptographic inventory, vendor roadmap alignment, and coordinated transition planning across G7 financial systems.
At Risk
G7 financial infrastructure, cross-border payment systems, correspondent banking TLS
PQC Replacement
ML-KEM, ML-DSA, hybrid implementations, coordinated G7 PQC standards
- HighFinancial Services / BankingFS-ISAC — The Timeli...
FS-ISAC PQC migration urgency warning: Financial Services Information Sharing and Analysis Center (September 2025) warns that financial sector organizations have not defined or allocated resources for quantum-resistant migration, compressing transition into unrealistically short timeframes. Without immediate action, roadmap collapse by 2030 compliance deadlines is likely.
At Risk
RSA, ECC, TLS 1.2/1.3 key exchange, PKI certificates across financial infrastructure
PQC Replacement
ML-KEM, ML-DSA, hybrid implementations, immediate cryptographic inventory
- CriticalGovernment / DefenseNSA CNSA 2.0 Cyberse...
HNDL on classified data: TOP SECRET information requiring 25-75+ year protection is actively harvested for future quantum decryption. Current encryption provides no protection against this threat.
At Risk
RSA-2048/4096, ECDH P-384, ECDSA
PQC Replacement
ML-KEM-1024, ML-DSA-87, AES-256
- CriticalGovernment / DefenseNSA CNSA 2.0 Guidanc...
CNSA 2.0 compliance deadline pressure: NSA mandates CNSA 2.0 compliance with phased deadlines — software/firmware signing supported and preferred by 2025 (exclusively by 2030), networking equipment supported and preferred by 2026 (exclusively by 2030), NSS acquisitions by January 2027, web browsers/servers/cloud supported and preferred by 2025 (exclusively by 2033), full transition by 2035.
At Risk
Federal PKI, NSS communications, classified systems, defense supply chain
PQC Replacement
FIPS 140-3 validated PQC modules, CMVP certification acceleration
- CriticalGovernment / DefenseNSA CNSA 2.0 Cyberse...
Nuclear command and control quantum exposure: NC3 (Nuclear Command, Control, and Communications) systems operate on 50+ year lifecycles and represent the highest-consequence quantum threat scenario. NSA CNSA 2.0 specifically identifies national security systems including strategic communications as priority for PQC transition.
At Risk
All public-key cryptography in NC3 systems, strategic communications encryption
PQC Replacement
CNSA 2.0 full suite, AES-256, ML-KEM-1024, ML-DSA-87
- HighGovernment / DefenseCISA Product Categor...
Federal PQC procurement guidance: CISA January 2026 federal buying guidance pursuant to Executive Order 14306 (June 2025) recommends agencies procure quantum-resistant technology across designated product categories including cloud services, collaboration tools, web browsers/servers, and endpoint security. Note: EO 14306 removed the original procurement mandate but CISA's product categories list strongly encourages PQC-capable acquisitions.
At Risk
COTS products, federal IT infrastructure, defense systems
PQC Replacement
NIST FIPS 203/204/205 compliance, ACVP testing, vendor PQC roadmaps
- HighGovernment / DefenseFederal PKI Policy A...
Federal PKI signature forgery risk: Quantum-enabled impersonation of federal systems and fraudulent certificate issuance affecting government-wide trust infrastructure. The Federal PKI serves as the root of trust for digital identity across federal agencies, and quantum forgery of CA certificates would compromise the entire federal trust hierarchy.
At Risk
RSA-2048/4096 in Federal PKI, ECDSA P-256/P-384 intermediate certificates
PQC Replacement
ML-DSA-87, SLH-DSA, hybrid X.509 certificates
- CriticalHealthcare / PharmaceuticalHHS HIPAA Security R...
HNDL on patient records: Healthcare data has lifetime sensitivity; genomic data and mental health records remain sensitive indefinitely. HIPAA mandates 6+ year retention but records persist 25+ years.
At Risk
RSA, ECDH, ECDSA, TLS
PQC Replacement
ML-KEM-768/1024, ML-DSA, AES-256
- CriticalHealthcare / PharmaceuticalThales 2025 Data Thr...
Healthcare cloud encryption and breach crisis: Only 4% of healthcare operators encrypted 80%+ of sensitive cloud data. Thales 2025 report shows 59% prototyping or evaluating PQC but low actual deployment. 725 major breaches in 2023 (per HHS OCR) exposed 168M+ individuals (2024 figures pending final OCR reporting). Health records retain lifetime sensitivity making them prime HNDL targets.
At Risk
EHR databases, medical imaging, patient portals, health information exchanges, cloud encryption
PQC Replacement
ML-KEM-768/1024, ML-DSA, AES-256-GCM, quantum-safe TLS
- CriticalHealthcare / PharmaceuticalFDA Cybersecurity fo...
Connected medical device lifecycle quantum exposure: FDA Section 524B of FD&C Act requires cybersecurity for medical devices. Implantable and connected devices (pacemakers, insulin pumps, remote monitoring) with 10-20 year lifecycles being deployed today will operate well into the CRQC era. Limited computational resources and power constraints in implantable devices restrict PQC options.
At Risk
BLE cryptography, TLS in medical IoT, embedded ECC in implantable devices
PQC Replacement
Crypto-agile device design, hybrid firmware updates, ML-DSA for device authentication
- HighHealthcare / PharmaceuticalFDA Premarket Cybers...
FDA premarket cybersecurity guidance: FDA finalized guidance (September 2023) under Section 524B of FD&C Act (Consolidated Appropriations Act 2023). Requires cryptographic risk assessment and Software Bill of Materials for new device submissions. Medical devices with 10-20 year lifecycles deploying now will operate into the CRQC era.
At Risk
RSA-2048, ECDSA in device firmware, TLS in medical devices, PKI for device authentication
PQC Replacement
ML-KEM-768, ML-DSA, crypto-agile firmware update mechanisms
- HighHealthcare / PharmaceuticalFDA Drug Supply Chai...
Drug supply chain authentication quantum risk: Drug Supply Chain Security Act (DSCSA) mandates product serialization and verification to prevent counterfeit drug infiltration. EPCIS (Electronic Product Code Information Services) and verification systems rely on digital signatures and TLS. Quantum forgery of verification responses enables counterfeit drug injection into the legitimate supply chain.
At Risk
EPCIS digital signatures, TLS authentication for verification systems, manufacturer PKI
PQC Replacement
ML-DSA for supply chain signing, hybrid verification certificates, PQC-enabled EPCIS
- HighInsuranceNAIC Insurance Data ...
NAIC Insurance Data Security Model Law (MDL-668) quantum exposure: Adopted 2017 and enacted in 22+ states (as of late 2025), requires encryption of nonpublic information in transit and at rest. Actuarial models, claims history spanning decades, and underwriting algorithms represent long-lived sensitive data prime for HNDL attacks.
At Risk
RSA/ECDSA protecting policyholder data, TLS for claims processing, database encryption
PQC Replacement
ML-KEM for key exchange, AES-256-GCM, ML-DSA for document signing
- HighInsuranceNY DFS Cybersecurity...
New York DFS cybersecurity regulation (23 NYCRR 500) quantum gap: Requires risk assessment and encryption for financial services including insurance companies. Life insurance and annuity records with 50+ year retention periods are prime HNDL targets. Regulation does not yet address post-quantum cryptography.
At Risk
Database encryption, policyholder data TLS, claims management systems
PQC Replacement
PQC-enabled encryption, hybrid TLS 1.3, ML-KEM key management
- HighInsuranceGeneva Association S...
Systemic cyber risk to insurance sector: Geneva Association research identifies systemic cyber risk including quantum threats to insurance industry managing multi-decade policy data. Life insurance and pension records retain sensitivity for 50+ years. Reinsurance treaties with multi-year duration vulnerable to data manipulation.
At Risk
Actuarial model encryption, reinsurance platform crypto, policyholder PII protection
PQC Replacement
AES-256 with ML-KEM key exchange, ML-DSA for contract signing, crypto-agile platforms
- CriticalInternet of Things (IoT)Forescout Device Ris...
IoT device risk escalation: Forescout 2025 research reports overall average device risk scores increased 15% year-over-year, with significant country-level risk score increases. Billions of constrained devices using ECDSA P-256 and RSA-2048 with limited crypto-agility and no practical firmware update path for PQC migration.
At Risk
ECDSA P-256, RSA-2048, TLS 1.2 in IoT devices, device provisioning certificates
PQC Replacement
Lightweight PQC (FN-DSA, SLH-DSA), hybrid schemes for constrained devices
- CriticalInternet of Things (IoT)IEC 62443 Industrial...
Industrial IoT SCADA quantum vulnerability: IEC 62443 governs industrial automation security. OPC UA protocol uses RSA/ECDSA for authentication across manufacturing, energy, and critical infrastructure. IIoT environments with 15-25 year equipment lifecycles and air-gapped networks face complex PQC migration.
At Risk
OPC UA RSA/ECDSA, IEC 62443 authentication, industrial protocol encryption
PQC Replacement
OPC UA PQC implementation, IEC 62443 quantum update, hybrid industrial protocols
- HighInternet of Things (IoT)IETF SUIT Working Gr...
IoT firmware update security (IETF SUIT): The IETF SUIT working group defines firmware update architecture (RFC 9019) with COSE-based manifest signing (using ECDSA/EdDSA per RFC 9052/9053) for firmware authentication. Constrained devices (Class 1-3) cannot support full PQC signature verification creating a security gap during migration.
At Risk
COSE signatures (ECDSA/EdDSA), CoAP DTLS, firmware signing keys
PQC Replacement
Lightweight ML-DSA, SLH-DSA for stateless constrained devices or XMSS where state management is feasible, hybrid COSE signatures
- HighInternet of Things (IoT)ISO/IEC 30182 Smart ...
Smart city infrastructure quantum vulnerability: Traffic management, public safety cameras, environmental sensors, and municipal IoT systems form interconnected networks with diverse device types and long deployment cycles. ISO/IEC 30182 defines smart community infrastructure framework. City-wide mesh networks and cloud gateways aggregate sensitive data from thousands of endpoints.
At Risk
City-wide IoT mesh networking, cloud gateway TLS, sensor authentication, municipal PKI
PQC Replacement
Quantum-safe smart city architecture, hybrid mesh protocols, PQC-enabled gateways
- CriticalIT Industry / SoftwareOpenSSL PQC Integrat...
Open source cryptographic library PQC integration: OpenSSL 3.5 (April 2025) includes ML-KEM, ML-DSA, and SLH-DSA support with X25519MLKEM768 hybrid key exchange available in TLS (enabled by default in some configurations). Millions of applications depend on OpenSSL and similar libraries. Libsodium and other popular libraries lag behind creating widespread dependency risk during the PQC transition.
At Risk
Legacy RSA/ECDSA in crypto libraries, OpenSSL pre-3.5, libsodium, BoringSSL
PQC Replacement
OpenSSL 3.5+ with PQC, OQS provider, liboqs integration
- CriticalIT Industry / SoftwareCA/Browser Forum PKI...
Certificate authority and PKI PQC transition: CA/Browser Forum must coordinate migration of the global WebPKI trust hierarchy to post-quantum algorithms. Chrome and Firefox have shipped ML-KEM hybrid key exchange (X25519+ML-KEM-768). Root CA key migration requires coordinated trust store updates across all major browsers and operating systems.
At Risk
CA root keys (RSA-4096/ECDSA), intermediate certificates, TLS server certificates, S/MIME
PQC Replacement
Hybrid X.509 certificates, ML-DSA CA hierarchy, composite certificate standards
- CriticalIT Industry / SoftwareNIST FIPS 203/204/20...
NIST FIPS 203/204/205 standardization milestone: First official PQC standards published August 2024. FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) provide the foundation for all PQC migration. CMVP validation of implementations is ongoing with first validated modules expected 2025-2026.
At Risk
All RSA/ECDSA/ECDH implementations requiring FIPS compliance
PQC Replacement
FIPS 203 (ML-KEM-512/768/1024), FIPS 204 (ML-DSA-44/65/87), FIPS 205 (SLH-DSA)
- CriticalIT Industry / SoftwareSLSA Supply Chain Se...
Code signing and software supply chain quantum vulnerability: Software supply chain integrity depends on RSA/ECDSA code signing for open source repositories, package managers, and CI/CD pipelines. SLSA (Supply-chain Levels for Software Artifacts) framework identifies signing as critical trust anchor. Quantum forgery of code signatures enables malicious package injection at scale.
At Risk
RSA/ECDSA code signing, package manager signatures, CI/CD pipeline authentication
PQC Replacement
ML-DSA code signing, SLH-DSA for long-term artifacts, SLSA PQC integration
- HighIT Industry / SoftwareFIDO Alliance PQC Ro...
Authentication infrastructure quantum vulnerability: Enterprise authentication systems including X.509 digital certificates, SAML assertions, OAuth/OIDC tokens, and FIDO2 attestation rely on quantum-vulnerable PKI. FIDO Alliance has published a PQC roadmap for WebAuthn migration. Migration to PQC-compatible credential systems requires coordinated ecosystem updates.
At Risk
X.509 certificates, SAML assertions, OAuth/OIDC tokens, FIDO2 attestation keys
PQC Replacement
Hybrid certificate chains, ML-DSA certificates, PQC-enabled FIDO2 per FIDO Alliance roadmap
- CriticalLegal / Notary / eSignatureEU Regulation 910/20...
eIDAS long-term signature vulnerability: EU Regulation 910/2014 Article 25(2) grants qualified electronic signatures legal equivalence to handwritten signatures across 27 EU member states. Property deeds, constitutional documents, and notarial acts require 50-100+ year validity. Quantum signature forgery would retroactively undermine the integrity of millions of legally binding documents.
At Risk
RSA-2048/4096, ECDSA P-256/P-384, SHA-256 in AdES formats (XAdES, PAdES, CAdES)
PQC Replacement
ML-DSA-65/87, SLH-DSA for long-term archival signatures, XMSS
- HighLegal / Notary / eSignatureEU Regulation 2024/1...
eIDAS 2.0 Digital Identity Wallet quantum risk: Regulation 2024/1183 (entered force May 20, 2024) amends eIDAS to mandate European Digital Identity Wallets for all EU member states. Wallets must support qualified electronic attestations of attributes. Cryptographic protocols underpinning wallet-to-verifier authentication rely on RSA/ECDSA.
At Risk
ECDSA P-256, RSA-2048, ECDH in wallet authentication, X.509 certificates
PQC Replacement
ML-DSA-65/87, ML-KEM-768/1024, hybrid signature schemes
- HighLegal / Notary / eSignatureETSI EN 319 422 Qual...
Qualified timestamp quantum forgery risk: ETSI EN 319 422 governs qualified time-stamp authorities under the eIDAS framework using RFC 3161 time-stamp protocol. Timestamps cryptographically prove document existence at specific moments for legal evidence and IP filings. Quantum-capable adversaries could forge timestamps to backdate contracts or fabricate audit trails.
At Risk
RSA-2048/4096, ECDSA P-256/P-384 in RFC 3161 timestamp tokens, SHA-256
PQC Replacement
ML-DSA-65/87, SLH-DSA for long-term timestamp integrity
- HighLegal / Notary / eSignatureNIST SP 800-86 Guide...
Court electronic evidence repudiation risk: As quantum computing advances, defense attorneys may challenge the integrity of digitally signed electronic evidence, arguing signatures could have been forged. This introduces reasonable doubt for any evidence authenticated solely with quantum-vulnerable cryptography. Courts will need to establish new standards for digital evidence admissibility in the post-quantum era.
At Risk
RSA/ECDSA signatures on court filings, evidence chain of custody, forensic reports
PQC Replacement
PQC re-signing with archival timestamps, SLH-DSA for evidence integrity
- CriticalMedia / Entertainment / DRMAACS Licensing Admin...
Content encryption master key HNDL risk: AACS (Advanced Access Content System) protects Blu-ray and UHD content using RSA key hierarchy. Studio content libraries worth billions have indefinite commercial value. Master encryption keys harvested today enable future mass decryption of entire studio catalogs once CRQCs arrive.
At Risk
AACS RSA key hierarchy, PlayReady, FairPlay DRM key management
PQC Replacement
AES-256 with ML-KEM key wrapping, quantum-safe DRM key distribution
- CriticalMedia / Entertainment / DRMAACS / Content Prote...
Streaming platform DRM quantum vulnerability: Major streaming services (Netflix, Disney+, Amazon) use Widevine, PlayReady, and FairPlay DRM systems with RSA key hierarchies for content license distribution. Combined global streaming revenue exceeds $100B annually with content catalogs representing irreplaceable IP.
At Risk
RSA key exchange in Widevine/PlayReady/FairPlay, content encryption keys, license server PKI
PQC Replacement
ML-KEM key wrapping, quantum-safe license distribution, AES-256 content encryption
- HighMedia / Entertainment / DRMDVB Project — Condit...
Broadcast conditional access quantum exposure: DVB Conditional Access Systems use ECM (Entitlement Control Messages) with RSA/ECDSA encryption protecting pay-TV content distribution. Set-top boxes and smart TVs with 7-10 year lifecycles have limited crypto-agility for PQC migration.
At Risk
DVB-CSA encryption, ECM RSA/ECDSA, broadcast conditional access keys
PQC Replacement
AES-128/256 CAS upgrade, ML-KEM for ECM distribution
- CriticalPayment Card IndustryEMVCo Book 2 Securit...
EMV offline authentication quantum vulnerability: EMVCo specifications use RSA as the only approved asymmetric algorithm for offline card authentication (CDA/DDA). Approximately 14.7 billion EMV chip cards in circulation globally (end 2024). Quantum forgery of RSA signatures enables counterfeit card acceptance at any offline-capable terminal.
At Risk
RSA-1024/2048 in EMV CDA/DDA offline authentication, card personalization keys
PQC Replacement
ML-DSA hybrid offline authentication, FN-DSA for constrained chip environments
- HighPayment Card IndustryPCI Security Standar...
PCI DSS 4.0.1 cryptographic gap: PCI DSS requires 'strong cryptography' for cardholder data protection but does not yet mandate post-quantum algorithms. Organizations meeting current PCI compliance may still be quantum-vulnerable. Cryptographic inventory requirements (Req 3/4) do not address PQC readiness assessment.
At Risk
TLS protecting payment data, RSA/ECDSA certificates, HSM key wrapping for card data
PQC Replacement
PQC-enabled payment HSMs, hybrid TLS 1.3, ML-KEM for key exchange
- HighPayment Card IndustryPCI PIN Security Req...
PIN block encryption quantum vulnerability: PIN encryption at scale relies on 3DES DUKPT; the quantum attack surface is the RSA-based key injection ceremony at Key Injection Facilities (KIFs) used to load base derivation keys into terminals — quantum forgery of RSA key transport enables malicious key injection at scale. AES-256 DUKPT provides quantum-resistant symmetric alternative but terminal hardware replacement required at massive scale.
At Risk
3DES DUKPT base derivation keys, RSA key injection, PIN encryption
PQC Replacement
AES-256 DUKPT, ML-KEM key injection, quantum-safe PIN encryption
- CriticalRail / TransitEN 50159 Railway Com...
Railway signaling system quantum vulnerability: EN 50159 (Safety-related communication in railway systems) governs cryptographic authentication for ERTMS/ETCS (European Train Control System) train signaling. GSM-R and its successor FRMCS (Future Railway Mobile Communication System) provide the communication layer. Signaling infrastructure has 25-40 year lifecycles with limited upgrade paths. Quantum compromise of signaling authentication could enable unauthorized train movements.
At Risk
RSA/ECDSA in ERTMS/ETCS signaling authentication, GSM-R/FRMCS encryption, interlocking system crypto
PQC Replacement
ML-DSA for signaling authentication, PQC-enabled FRMCS, hybrid railway protocols
- CriticalRail / TransitFRA Positive Train C...
Positive Train Control (PTC) cryptographic migration: FRA regulations (49 CFR 236.1033) mandate cybersecurity for PTC systems controlling train movements across 57000+ miles of US freight and passenger rail. PTC uses wireless wayside-to-onboard communications with RSA/ECC for key establishment. Equipment lifecycles of 15-25 years mean systems deployed today will operate into the CRQC era. Limited computational resources in onboard units constrain PQC algorithm choices.
At Risk
RSA/ECC key establishment in PTC wireless communications, ISO/IEC 29192-4 lightweight crypto, firmware signing
PQC Replacement
Quantum-resistant lightweight AEAD, ML-KEM for wayside-to-vehicle key exchange, crypto-agile PTC firmware
- CriticalRail / TransitISO/SAE 21434 / IEC ...
Autonomous and driverless train system quantum exposure: Autonomous rail systems including CBTC (Communications-Based Train Control) and GoA4 driverless operations rely on continuous authenticated communication between trackside and onboard systems. ISO/SAE 21434 cybersecurity engineering standards and IEC 62443 industrial automation security govern these systems. Quantum forgery of infrastructure authentication enables unauthorized commands to driverless trains with potential for collisions or derailments.
At Risk
RSA/ECC for V2I authentication, certificate-based platform identity, Diffie-Hellman session keys, firmware signing
PQC Replacement
SLH-DSA for firmware signing, ML-KEM for V2I key encapsulation, post-quantum authenticated key exchange
- HighRail / TransitISO/IEC 14443 Contac...
Transit ticketing and access control quantum exposure: ISO/IEC 14443 contactless smart cards and NFC-based ticketing systems used by transit authorities worldwide rely on cryptographic authentication. MIFARE DESFire and similar platforms use AES/3DES symmetric encryption (quantum-resistant) but PKI infrastructure for card issuance, key management systems, and back-office settlement use RSA/ECDSA.
At Risk
Ticketing PKI, key management RSA/ECDSA, back-office settlement TLS, mobile ticketing
PQC Replacement
ML-KEM for key management, ML-DSA for PKI, PQC-enabled mobile ticketing
- HighRail / TransitUIC / ETSI FRMCS Spe...
GSM-R to FRMCS transition quantum vulnerability: European railways are transitioning from legacy GSM-R to FRMCS (Future Railway Mobile Communication System) based on 5G technology (2026-2035 timeline). FRMCS introduces IP-based networks with asymmetric cryptography for authentication and key exchange inheriting 5G quantum vulnerabilities. During the parallel operation period both legacy A5/1 (broken) and 5G crypto (quantum-vulnerable) coexist. Deutsche Bahn begins live FRMCS tests in 2027. Without PQC integration from the design phase FRMCS will require costly retrofitting.
At Risk
GSM-R A5/1 stream cipher, FRMCS 5G authentication (ECDSA/RSA), IKEv2 key exchange for railway backbone
PQC Replacement
ML-KEM hybrid for FRMCS key exchange, ML-DSA for railway signaling authentication, native PQC in FRMCS specification
- CriticalRetail / E-CommercePCI Security Standar...
E-commerce payment flow quantum vulnerability: PCI DSS 4.0.1 requires strong cryptography for online payment processing but TLS protecting checkout flows uses RSA/ECDSA key exchange vulnerable to quantum attacks. E-commerce transaction volume exceeds $6 trillion globally with payment data in transit continuously exposed.
At Risk
TLS 1.2/1.3 RSA/ECDSA key exchange, payment tokenization, POS encryption
PQC Replacement
Hybrid TLS 1.3 with ML-KEM, PQC-enabled payment gateways, quantum-safe tokenization
- HighRetail / E-CommerceNIST Cybersecurity F...
Customer data HNDL exposure: Retailers store customer PII, loyalty program data, payment history, and behavioral analytics for 5-10+ years for marketing and compliance. NIST Cybersecurity Framework identifies data protection as core function. Encrypted customer databases harvested today become readable with CRQCs.
At Risk
Database encryption (RSA/ECDSA key management), CRM system TLS, loyalty platform crypto
PQC Replacement
ML-KEM for database key management, AES-256-GCM, hybrid encryption for customer data
- HighRetail / E-CommerceGS1 Global Standards
Retail supply chain authentication: GS1 standards govern product identification and supply chain visibility for billions of products globally. RFID, EDI (AS2/AS4), and electronic product codes use digital signatures for authentication. Quantum forgery enables counterfeit product injection and supply chain manipulation.
At Risk
EDI AS2/AS4 encryption, RFID authentication, GS1 Digital Link signatures
PQC Replacement
ML-DSA for supply chain signing, PQC-enabled EDI, quantum-safe RFID
- HighSupply Chain / LogisticsIMO Maritime Cyber R...
Maritime cybersecurity quantum exposure: IMO MSC-FAL.1/Circ.3 guidelines address maritime cybersecurity. Maritime sector carries approximately 80% of world trade by volume. Port management systems, vessel identity PKI (used in ECDIS and GMDSS), and maritime VPN infrastructure use RSA/ECDSA — AIS itself is an unauthenticated broadcast protocol and is not quantum-affected until authenticated replacements are deployed.
At Risk
Port management system PKI, vessel identity certificate PKI, maritime VPN/TLS, electronic chart ECDIS authentication
PQC Replacement
ML-DSA for maritime authentication, PQC-enabled AIS, quantum-safe port systems
- HighSupply Chain / LogisticsDCSA Electronic Bill...
Electronic Bill of Lading quantum vulnerability: DCSA standards for electronic Bills of Lading (eBL) enable digital trade documentation for containerized shipping. Digital signatures on eBL documents prove ownership and transfer rights for cargo worth billions. Quantum forgery enables cargo theft and trade document fraud.
At Risk
eBL digital signatures (RSA/ECDSA), trade document PKI, shipping platform TLS
PQC Replacement
ML-DSA for eBL signing, hybrid trade document certificates, PQC-enabled shipping platforms
- HighSupply Chain / LogisticsWCO SAFE Framework o...
Customs and cross-border trade quantum risk: WCO SAFE Framework of Standards governs security and facilitation of international trade. Digital certificates for customs declarations, AEO (Authorized Economic Operator) credentials, and single window systems use RSA/ECDSA. Quantum forgery enables customs fraud at global scale.
At Risk
Customs declaration digital signatures, AEO certificates, single window system PKI
PQC Replacement
ML-DSA for customs signing, PQC-enabled single window, quantum-safe AEO credentials
- CriticalTelecommunicationsGSMA Security Guidel...
HNDL on subscriber data: Mobile network operators retain call detail records, location data, and encrypted communications for 2-10 years. 5G user data encrypted with vulnerable algorithms.
At Risk
RSA, ECDSA, ECDH (subscriber authentication and key exchange); AES-128 legacy bearers weakened by Grover's algorithm but not broken
PQC Replacement
ML-KEM-1024, ML-DSA, AES-256
- HighTelecommunicationsGSMA Post-Quantum Te...
GSMA Post-Quantum Telco Network Taskforce: Established September 2022 to coordinate quantum-safe migration for mobile network operators worldwide. Published PQ.03 guidelines (v2.0 October 2024) providing telecom-specific PQC migration guidance. Taskforce brings together major operators and vendors to develop industry-wide PQC migration roadmap for 5G/6G infrastructure.
At Risk
5G authentication (AKA), RAN encryption, IPsec/IKEv2 for network interconnects
PQC Replacement
3GPP PQC integration, ML-KEM for 5G security, hybrid authentication protocols
- HighTelecommunications3GPP TS 33.501 5G Se...
5G network security quantum vulnerability: 3GPP specifications define 5G security architecture (TS 33.501) using ECDSA and RSA for network authentication. 5G network slicing authentication and RAN encryption protect critical enterprise, IoT, and emergency services. N2/N3 interface security relies on IPsec with quantum-vulnerable key exchange.
At Risk
5G AKA protocol, network slice authentication, N2/N3 IPsec/IKEv2, RAN encryption
PQC Replacement
3GPP Release 19+ PQC integration, ML-KEM for 5G SA, hybrid IKEv2
- HighTelecommunicationsGSMA eSIM Specificat...
SIM card and eSIM authentication quantum vulnerability: Billions of SIM cards globally use RSA-2048 or ECDSA P-256 for authentication. GSMA eSIM remote provisioning (SGP.22) relies on PKI with quantum-vulnerable key exchange. SIM replacement cycles of 3-5 years provide a migration window but legacy devices will persist longer.
At Risk
RSA-2048, ECDSA P-256 in SIM authentication, eSIM remote provisioning PKI
PQC Replacement
ML-DSA for SIM authentication, PQC-enabled eSIM provisioning, hybrid schemes
- HighTelecommunicationsETSI ISG Quantum-Saf...
6G native PQC design window: 6G standards development (2025-2030 in 3GPP and ETSI) represents a critical opportunity to incorporate PQC from the design phase, avoiding the crypto-agility retrofit challenges facing 5G. ETSI ISG on Quantum-Safe Cryptography is providing input to 6G security architecture development.
At Risk
6G authentication protocols, air interface encryption, network slicing, edge computing
PQC Replacement
Native ML-KEM/ML-DSA in 6G specifications, quantum-safe by design per ETSI QSC
- CriticalWater / WastewaterEPA America's Water ...
Water treatment plant SCADA quantum vulnerability: America's Water Infrastructure Act (AWIA) of 2018 requires community water systems serving 3,300+ people to conduct risk and resilience assessments including cybersecurity. Water treatment SCADA systems use ICS protocols with RSA/ECDSA authentication. CISA identifies Water and Wastewater Systems as one of 16 critical infrastructure sectors. Equipment lifecycles of 15-25 years with limited remote update capability.
At Risk
SCADA/ICS authentication (RSA/ECDSA), VPN for remote monitoring, historian database encryption
PQC Replacement
IEC 62443 PQC update for water systems, ML-DSA for SCADA authentication, hybrid VPN
- CriticalWater / WastewaterFERC Security Progra...
Dam control system SCADA quantum vulnerability: FERC Security Program for Hydropower Projects governs cybersecurity for federally regulated dams. Dam SCADA systems control spillway gates water flow and emergency shutdowns with catastrophic failure consequences. Remote access gateways use RSA/ECC VPN authentication. Equipment lifecycles of 25-40 years with air-gapped architectures complicate PQC migration. FERC security requirements (Revision 3A 2016) have not been updated to address post-quantum threats.
At Risk
RSA/ECC VPN authentication for remote dam access, certificate-based SCADA authentication, AES with RSA key wrapping
PQC Replacement
ML-KEM for VPN key encapsulation, post-quantum certificate infrastructure, quantum-resistant remote access
- CriticalWater / WastewaterNIST NCCoE Water/Was...
Wastewater treatment SCADA quantum vulnerability: Wastewater SCADA systems are architecturally distinct from drinking water treatment serving sewage pumping biosolids handling and effluent discharge control. EPA/CISA guidance (August 2024) classifies wastewater under essential services. Newer systems use OPC UA and DNP3 Secure Authentication with RSA/ECC key establishment. Quantum-enabled decryption of control commands could corrupt treatment processes releasing untreated sewage into waterways with environmental and public health catastrophe.
At Risk
RSA/ECC in OPC UA certificates, DNP3 Secure Authentication, VPN for remote HMI access
PQC Replacement
Quantum-resistant OPC UA profiles, post-quantum DNP3 authentication, hybrid VPN for wastewater SCADA
- HighWater / WastewaterAWWA Cybersecurity G...
Smart water infrastructure quantum exposure: AWWA (American Water Works Association) standards govern smart water metering, leak detection sensors, and distribution network monitoring using IoT-connected devices. Advanced Metering Infrastructure (AMI) for water utilities faces similar PQC migration challenges as energy smart meters — constrained devices with limited crypto-agility deployed for 10-15 year cycles.
At Risk
AMI mesh networking, smart meter PKI, SCADA remote terminal units, cloud platform TLS
PQC Replacement
Quantum-safe AMI protocols, ML-KEM for device provisioning, constrained device PQC
- HighWater / WastewaterEPA Cybersecurity fo...
Water quality monitoring IoT sensor quantum exposure: EPA cybersecurity guidance (August 2024) addresses water sector IoT but lacks specific PQC requirements. Real-time water quality sensors monitoring pH turbidity dissolved oxygen and contaminants communicate via IoT protocols with RSA/ECC key bootstrap. Constrained sensors lack crypto-agility for mid-life PQC migration. Quantum-enabled data integrity attacks could inject false sensor readings causing treatment failures and public health emergencies.
At Risk
RSA/ECC sensor-to-gateway key bootstrap, TLS for cloud data aggregation, IoT provisioning certificates
PQC Replacement
Post-quantum key agreement for sensor provisioning, lightweight PQC for constrained IoT, hybrid gateway encryption