Why Post-Quantum Migration Starts Years Before A Quantum Computer Exists

No one has yet shown a quantum computer that can break the public-key cryptography in everyday use. Governments are still telling organisations to start replacing that cryptography now. That can look like a contradiction, but it follows from two simple facts: replacing cryptography across a large organisation takes years, and some of the data protected today will still need protecting when such a machine arrives.

This article explains both facts, uses a past algorithm change to show how long these transitions really take, and sets out what “starting early” means in practice. Later articles in this section cover each step in detail.

What Changes When A Quantum Computer Arrives

Security agencies use the term cryptographically relevant quantum computer, or CRQC, for a quantum computer powerful enough to break today’s public-key algorithms such as RSA and elliptic curve cryptography. These algorithms are used to agree encryption keys and to create digital signatures, so they sit underneath web traffic, VPNs, software updates, payment cards and identity systems.

As of October 2026, the US Office of Management and Budget describes a CRQC as “not yet known to exist” and says one could appear within the coming decade.¹ When it does, two kinds of damage become possible. Recorded encrypted traffic can be decrypted, and signatures can be forged, which lets an attacker impersonate people, servers or software publishers.

NIST’s National Cybersecurity Center of Excellence (NCCoE) points to a particular weak spot: software images signed with a vulnerable algorithm on devices whose root of trust cannot be upgraded.² A root of trust is the small set of keys and code built into a device that it trusts without question, for example to check that a software update is genuine. A device like that may be in service for many years after the algorithm it trusts has stopped being safe.

The Data Problem: Harvest Now, Decrypt Later

An attacker does not need a quantum computer today to cause harm later. They can copy encrypted data now and keep it until it can be decrypted. This is usually called harvest now, decrypt later, or store now, decrypt later.² The Harvest Now, Decrypt Later article in The Quantum Threat section covers the attack in detail.

Michele Mosca’s well-known rule of thumb turns this into a planning test.³ Take the number of years your data must stay confidential and add the number of years your migration will take. If the total is longer than the time until a CRQC exists, some of your data will be exposed. The test shows that migration time is just as important as data lifetime, and migration time is the part an organisation controls.

Why Migration Takes So Long

Swapping one algorithm for another sounds like a configuration change. In a real organisation it rarely is. The NCCoE notes that an algorithm cannot be replaced until every component that has to process it is ready, and that protocols, schemes and infrastructure often need updating too.² It also warns that almost all information systems lack crypto-agility, the ability to change algorithms without major rework, and that some components stay in service for a decade or more, giving electricity generation and distribution as an example.²

The NCCoE’s view is that the move to post-quantum cryptography is likely to be harder than past algorithm changes, and that without serious planning it could take decades to replace most vulnerable systems.²

A Lesson From SHA-1

The retirement of the SHA-1 hash function shows how slowly these changes move, even when the problem is well understood and the replacement is ready.

SHA-1 entered federal standards in 1995.⁴ Public web certificate issuance using it mostly ended in January 2016, and Firefox planned to start showing an error for such certificates in early 2017.⁵ The first public collision was announced on 23 February 2017.⁶ NIST still set the final phase-out for 31 December 2030, which will make 35 years from first standard to scheduled retirement, and told module vendors they had eight years to submit updated products.⁴ That span covers the whole life of the algorithm, not only the move away from it. Counting only from the end of public web certificate issuance in 2016, the final phase-out still comes 14 years later.

SHA-1 is a single hash function. Post-quantum migration touches key agreement and signatures in almost every protocol an organisation uses, which is why the NCCoE expects it to be harder than past algorithm changes.²

The Replacements Already Exist

Organisations are not waiting for new algorithms. NIST has published three post-quantum standards: FIPS 203 (ML-KEM) for key establishment, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. OMB’s guidance notes that further schemes, such as FALCON and HQC, may follow.¹ The open questions are about deployment: which systems can use the new algorithms, in what order, and with what help from suppliers.

That is why every major government roadmap begins in the same place. The CISA, NSA and NIST joint factsheet of 2023 asked organisations to build a quantum-readiness roadmap, prepare a cryptographic inventory, and engage their technology vendors.⁷ The official timelines article shows how those steps have since turned into dated milestones.