Preparing your cryptography for post-quantum computing

Some of the messaging around quantum computing suggests an impending catastrophe. We would put it differently.

The risk is real, but it is manageable if you start early and work through it in the right order.

In a recent webinar, we asked attendees from central government and the private sector about their current position:

• Seventy-three per cent were aware but had no formal plans.
• Twenty per cent had started planning
• Seven per cent were actively preparing.

This shows organisations are facing a real challenge in figuring out where to begin.

Helpfully, structured guidance does exist. Five governments have now published migration timelines, and they set out a clear order of work rather than just a deadline.

Where we currently are – the current global guidance

Five jurisdictions have now published formal migration timelines, and they broadly agree on the shape.

The UK National Cyber Security Centre (NCSC) sets three phases: discovery and planning to 2028, high-priority migration to 2031, and full completion by 2035.

The National Institute of Standards and Technology's (NIST) transition guidance deprecates RSA and elliptic curve after 2030, meaning they remain usable during migration but not for new deployments, and disallows them entirely after 2035.