US government slashes time to prepare for post-quantum future

Brings it in line with UK and EU guidance

Atom have a glowing core and orbits in a laboratory device connected with cables and surrounded by supercomputers. Illustration of the concept of quantum mechanics and quantum computer

The US government has shortened the deadline for federal agencies and organisations to be quantum-resistant by five years, but is it soon enough?

Q-Day, the day when a sufficiently powerful quantum computer can break public-key cryptography, is approaching. It might not be just around the corner, but the threat is no longer a distant hypothetical.

In a surprisingly forward-looking move, the US government has shortened the timeframe for government agencies and organisations to be prepared to defend against quantum attacks. Under the new guidance, they will have to transition to post-quantum cryptographic key establishment schemes by 31^st December 2030, and to quantum-safe digital signature schemes 12 months later.

This represents a five-year reduction in the time most bodies previously had to get ready, although “National Security Systems” had to be ready by 2030 (defence) or 2033 (intelligence).

The White House’s latest order similar guidance from private firms and public bodies.

Google, for example, has set a 2029 date to move off of vulnerable systems; while the UK’s National Cyber Security Centre says all organisations should complete their discovery and assessment phase by 2028, mitigate their highest-risk systems by 2031 and remove all vulnerable cryptography by 2035.

The EU says all member states should have a post-quantum roadmap in place by the end of this year, with high-risk systems migrated by the end of 2030 and medium- and low-risk by 2035.

The need for post-quantum security is now widely accepted, but the timeline is still under debate. As we wrote in research published earlier this year, “We don't know the date, we don't know which systems will be hit first, and the fix is complex.”

There is also a temptation to continue fighting the fires threatening us right now, rather than looking to future threats. In that same research, respondents were split almost directly down the middle as to whether the danger is real and needs planning now, or if it’s real but still far off.