Post-Quantum Cryptography: What to Do Now, Not Later

Post-quantum cryptography attracts either dismissal as a distant concern or breathless urgency, and neither serves planning well. The realistic position: no quantum computer currently threatens widely used public-key cryptography, standards for replacement algorithms now exist, and there is one specific scenario that makes preparation genuinely time-sensitive today.

What the threat actually is

Widely deployed public-key cryptography — the algorithms securing key exchange and digital signatures — relies on mathematical problems that a sufficiently capable quantum computer could solve efficiently. Such a machine does not currently exist, and credible timelines vary widely.

Symmetric encryption is affected far less. Current guidance is that adequate symmetric key sizes remain sound, so the migration concern centres on public-key algorithms rather than on encryption at rest with strong symmetric keys.

Why some of it is urgent now

The reason preparation cannot simply wait is the harvest-now-decrypt-later scenario. An adversary capable of capturing encrypted traffic today can store it and decrypt it once capability exists.

That converts a future capability into a present risk for any data whose confidentiality must survive a long time — state secrets, health records, source code, long-term contracts, intellectual property, and personal data with lasting sensitivity. If your data stops mattering in two years, this is a manageable future project. If it must remain confidential for fifteen, traffic captured today is already exposed.

Where the standards are

NIST has completed its selection process and published standards for post-quantum algorithms covering key encapsulation and digital signatures. That removes the main reason organisations previously deferred planning, since the target is now defined rather than speculative.

Deployment is progressing in stages across the ecosystem. Hybrid approaches — combining a classical algorithm with a post-quantum one so security holds if either remains sound — have appeared in browsers and major services, and represent the sensible transition path rather than an abrupt switch.

What to actually do now

1. Build a cryptographic inventory. Where is public-key cryptography used — TLS termination, VPNs, code signing, document signing, embedded devices, third-party services? Most organisations cannot currently answer this, and the inventory is the prerequisite for everything else.
2. Identify long-lived confidential data and the channels carrying it. This is where harvest-now-decrypt-later actually applies and where migration should be prioritised.
3. Assess crypto agility. How hard would it be to change algorithms in each system? Hard-coded algorithms, embedded devices and long-lifecycle hardware are the genuine difficulty, not the mathematics.
4. Raise it with suppliers. Much of your cryptography is implemented by vendors, so their roadmaps determine much of yours. Ask now, and consider adding it to procurement criteria.
5. Track certificate and key lifetimes that extend beyond your planning horizon, particularly for long-lived signing keys and embedded systems.
6. Plan for hybrid deployment rather than an abrupt cutover.
7. Avoid rushing bespoke implementations. Cryptographic implementation errors are far more likely to harm you than a quantum computer in the near term.

Keeping it in proportion

For most organisations this is a planning and inventory exercise now, and a migration project over the coming years — not an emergency.

It is worth being direct: an organisation with unpatched internet-facing systems and no multi-factor authentication should address those first. Post-quantum readiness is a genuine long-term requirement, but it should not displace controls addressing the attacks that are actually happening.

Related from TechBiz Security

• Security audits
• Risk assessment
• Compliance consulting

Sources & further reading

• NIST — Post-Quantum Cryptography project
• NIST — Post-Quantum Cryptography standards
• CISA — Post-Quantum Cryptography Initiative
• NCSC — Preparing for Post-Quantum Cryptography

Frequently asked questions