Technology
Post-quantum cryptography: what agencies should do now
Quantum computers will eventually break today's public-key encryption. The preparation is inventory and agility, not panic.
The public-key algorithms that protect web traffic, VPNs, digital signatures, and encrypted records will be breakable by a sufficiently capable quantum computer. Nobody knows when that will exist, but data encrypted today can be captured and decrypted later, and standards bodies have already published replacement algorithms. Agencies do not need to migrate today. They need to be able to.
What has happened
The National Institute of Standards and Technology has published post-quantum cryptographic standards. Federal agencies have been directed to inventory their cryptography and plan migration. Browsers, operating systems, and cloud providers have begun adding post-quantum options to their protocols.
What "harvest now, decrypt later" means
Records with long confidentiality requirements, such as health, criminal justice, and personnel data, are at risk if intercepted now and decrypted in the future. That is why the timeline for protecting them starts before quantum computers exist.
What agencies should do
Inventory. Where cryptography is used: TLS certificates, VPNs, email signing, document signing, encrypted storage, authentication tokens, and embedded devices. Most agencies have never listed this.
Prioritize. Systems protecting long-lived sensitive data, and systems that will be hard to change, such as embedded and operational technology.
Require agility. In procurements, require that products support updating cryptographic algorithms and that vendors have a post-quantum roadmap.
Follow platforms. Enable post-quantum options in browsers, operating systems, VPNs, and cloud services as they become available and stable.
Plan replacement. Devices and applications that cannot be updated need an end-of-life plan.
What not to do
Buy products marketed as quantum-proof without standards backing, or rip out working cryptography ahead of stable implementations.
Where HQT fits
Cryptographic inventory as part of a security assessment, procurement language, and migration planning for systems the agency builds or operates.