Post-Quantum Cryptography

Post-quantum cryptography is no longer a research topic. NIST has published its first post-quantum standards, and NSA's CNSA 2.0 sets migration timelines for national security systems. For programs building or modernizing infrastructure now, the question is not whether to migrate but how to plan for it without stalling delivery.

These articles cover the architecture side of that work: building a cryptographic inventory, assessing hardware that can't simply be patched, designing for cryptographic agility, and sequencing migration by risk. They're written for program managers, architects, and security leads making decisions today about systems that will still be running when current public-key encryption is no longer safe to rely on.

The common thread is timing. Systems designed this year will be in service well into the period when quantum-capable adversaries are a planning assumption, and data captured today can be stored and decrypted later. Treating migration as a future software update leaves programs with hardware, protocols, and vendor commitments that are expensive to unwind.

All Insights

Download the one-page brief (PDF)

Articles

All Insights
The PQC Migration Is Not a Software Update
The PQC Migration Is Not a Software Update

Encryption has a limited lifespan, the standards are finalized, and the case for migrating is settled. What most programs underestimate is what migration actually entails — a cryptographic inventory, a hardware recap most budgets haven't absorbed, and a review cycle that runs on someone else's clock.

Read more →
Your Encryption Has an Expiration Date. Here’s What That Means for the Systems You’re Building Now.
Your Encryption Has an Expiration Date. Here’s What That Means for the Systems You’re Building Now.

Sensitive data captured today can be decrypted later. That makes the encryption protecting long-lived data a dated asset, not a permanent one — and it changes what "secure enough" means for systems being designed right now..

Read more →