[{"data":1,"prerenderedAt":227},["ShallowReactive",2],{"blog-\u002Fblog\u002Fpqc-faq":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":7,"body":8,"canonical":7,"category":40,"date":41,"description":42,"draft":43,"extension":44,"faqs":45,"findingsSource":7,"geo":121,"howto":7,"howtoTitle":7,"image":7,"industries":123,"keyFindings":7,"meta":127,"modified":128,"navigation":129,"path":130,"pullquote":7,"recommendations":7,"references":131,"related":180,"seo":211,"seoTitle":212,"signposts":7,"slug":213,"stats":214,"stem":218,"tags":219,"tldr":225,"__hash__":226},"blog\u002Fblog\u002Fpqc-faq.md","Post-Quantum Cryptography FAQ: 25 Questions CISOs Ask Most","ArcQubit Team",null,{"type":9,"value":10,"toc":35},"minimark",[11,16,29],[12,13,15],"h2",{"id":14},"the-answer-up-front","The answer, up front",[17,18,19,20,24,25,28],"p",{},"Post-quantum cryptography replaces public-key algorithms that a large quantum computer could break. NIST has finalized three standards (ML-KEM, ML-DSA, SLH-DSA). The first U.S. deadline arrives at the end of 2026, when new National Security System acquisitions must be CNSA 2.0 compliant, and federal civilian systems face key-establishment migration deadlines starting in 2030. The 25 answers below give the short version, and each links to a primary source ",[21,22,23],"span",{},"1",", ",[21,26,27],{},"2",".",[17,30,31],{},[32,33,34],"em",{},"Last verified: Sep. 30, 2026.",{"title":36,"searchDepth":37,"depth":37,"links":38},"",2,[39],{"id":14,"depth":37,"text":15},"Security","2026-08-18","Answers to 25 post-quantum cryptography questions CISOs ask most: basics, NIST standards, hybrid key exchange, inventory, deadlines and planning.",false,"md",[46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118],{"q":47,"a":48},"What is post-quantum cryptography?","Post-quantum cryptography (PQC) is a family of encryption and digital signature algorithms designed to resist attacks from both classical and quantum computers. It runs as ordinary software and firmware on today's hardware, so you do not need a quantum computer to use it. Executive Order 14412 sets the U.S. federal migration policy [1].",{"q":50,"a":51},"What is a cryptographically relevant quantum computer?","A cryptographically relevant quantum computer (CRQC) is a quantum computer powerful enough to decrypt data protected by many common forms of cryptography and to defeat existing authentication protocols. OMB uses the term in its migration memo and states that such a machine is not yet known to exist [2].",{"q":53,"a":54},"Has anyone broken RSA-2048 with a quantum computer?","No. OMB states that a cryptographically relevant quantum computer is not yet known to exist, although steady advances in the field may yield one in the coming decade. Resource estimates describe what a machine would need, not a demonstration, so treat the risk as future but planned for now [2].",{"q":56,"a":57},"What is harvest now, decrypt later?","Harvest now, decrypt later (HNDL) means a threat actor intercepts encrypted information, stores it, and decrypts it once sufficiently powerful quantum computers exist. The attacker needs no quantum computer today. Canada's Cyber Centre defines the threat and tells departments to treat exposed long-lived data as high priority [13].",{"q":59,"a":60},"Which algorithms are quantum-vulnerable?","OMB lists RSA, Diffie-Hellman, ECDH, ECDSA, DSA, and MQV as quantum-vulnerable. It tells agencies to treat any asymmetric algorithm not known to resist quantum attack the same way. In practice, public-key key exchange and digital signatures need replacement, and TLS, VPNs, and certificates depend on both [2]. ## The standards",{"q":62,"a":63},"Which NIST post-quantum standards are final?","Three are final, all published in August 2024: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA), a hash-based backup signature. FN-DSA (FIPS 206) and HQC are still pending, so adopt the three finished standards now [3].",{"q":65,"a":66},"What is ML-KEM?","ML-KEM is the module-lattice key-encapsulation mechanism in NIST FIPS 203. It establishes a shared secret between two parties, and it replaces the key-exchange job that Diffie-Hellman and elliptic-curve key exchange perform today. It already runs on the internet inside hybrid TLS groups such as X25519MLKEM768 [3].",{"q":68,"a":69},"What is ML-DSA?","ML-DSA is the module-lattice digital signature standard in NIST FIPS 204. It signs certificates, code, and documents, and it is the default general-purpose choice among the finished signature standards. Its signatures run from 2,420 to 4,627 bytes depending on the parameter set, which is far larger than elliptic-curve signatures, so plan for bandwidth and storage [4].",{"q":71,"a":72},"What is SLH-DSA?","SLH-DSA is the stateless hash-based signature standard in NIST FIPS 205. Its security rests on hash functions instead of lattices, so it works as a fallback if someone breaks a lattice assumption. The tradeoff is size: signatures run to tens of kilobytes, and signing is slower [5].",{"q":74,"a":75},"What is FN-DSA and is it final?","FN-DSA, based on the Falcon algorithm, produces compact signatures and is planned as FIPS 206. As of Sep. 30, 2026, NIST lists it as in development, and I found no public draft or comment period. NIST has announced no final date, so do not deploy it yet. Check NIST's project page for the current status [16].",{"q":77,"a":78},"What is HQC?","HQC is a backup key-encapsulation mechanism that NIST selected on Mar. 11, 2025. It rests on error-correcting codes, not lattices, so it protects you if a flaw appears in ML-KEM. NIST plans a draft standard and a 2027 final, but as of Sep. 30, 2026 I found no published draft. Keep migrating to ML-KEM [6], [16].",{"q":80,"a":81},"Do I need to replace AES?","No. NIST states that current applications can continue to use AES with 128, 192, or 256-bit keys. Grover's algorithm speeds up brute-force key search only quadratically and is hard to parallelize, and NIST says AES-128 will remain secure for decades. The migration targets public-key algorithms [7]. ## Hybrid and key exchange",{"q":83,"a":84},"What is hybrid key exchange?","Hybrid key exchange runs a classical algorithm and a post-quantum algorithm together and combines their outputs into one shared secret. The result stays secure as long as at least one component stays secure. RFC 10024 defines hybrid groups for TLS 1.3, so browsers and servers can negotiate them [8].",{"q":86,"a":87},"What is X25519MLKEM768?","X25519MLKEM768 is a TLS 1.3 hybrid group that pairs classical X25519 with ML-KEM-768. RFC 10024 defines it, and the IANA registry marks it as recommended. Its client key share is 1,216 bytes and its server key share is 1,120 bytes, so handshakes grow larger than classical ones [8]. ## Inventory and agility",{"q":89,"a":90},"What is a CBOM?","A cryptographic bill of materials (CBOM) is a machine-readable inventory of cryptographic assets such as algorithms, certificates, protocols, and keys. CycloneDX defines the format, and Ecma International ratified the CycloneDX specification as ECMA-424. A CBOM helps you find, track, and report vulnerable cryptography [9].",{"q":92,"a":93},"What is crypto agility?","NIST defines crypto agility as the capabilities needed to replace and adapt cryptographic algorithms in protocols, applications, software, hardware, firmware, and infrastructures while preserving security and ongoing operations. In practice, you keep algorithm choices in configuration, not code, so a swap does not require a redesign [15]. ## Deadlines and mandates",{"q":95,"a":96},"What is the U.S. federal deadline?","Executive Order 14412 directs OMB to require agencies to move high-value assets and high-impact systems to post-quantum key establishment by Dec. 31, 2030, and to post-quantum digital signatures by Dec. 31, 2031. National Security Systems are excluded. OMB memo M-26-15 sets five phases running to full migration by 2035 [1], [2].",{"q":98,"a":99},"What are the CNSA 2.0 dates?","NSA's FAQ states that under CNSSP 15, all new National Security System acquisitions must be CNSA 2.0 compliant by Jan. 1, 2027, the earliest hard U.S. deadline, arriving at the end of 2026. Equipment that cannot support CNSA 2.0 must transition by Dec. 31, 2030. CNSA 2.0 calls for ML-KEM-1024 and does not require hybrid solutions [10].",{"q":101,"a":102},"What is the UK timeline?","The UK NCSC sets three milestones: define goals and complete discovery by 2028, finish the highest-priority migration by 2031, and complete migration of all systems, services, and products by 2035. It expects some rarely used technologies may need longer than 2035 [11].",{"q":104,"a":105},"What is the EU timeline?","The EU's coordinated roadmap, published Jun. 23, 2025, asks Member States to take first steps and set initial national roadmaps by the end of 2026, secure high-risk use cases by the end of 2030, and complete the transition for as many systems as feasible by the end of 2035. It is a recommendation, not a regulation [12].",{"q":107,"a":108},"What is the Canadian timeline?","Canada's roadmap asks federal departments to develop an initial plan in April 2026, finish migration of high-priority systems by the end of 2031, and finish all remaining systems by the end of 2035. It covers federal non-classified IT, and it defines completion as vulnerable algorithms disabled, isolated, or tunnelled [13].",{"q":110,"a":111},"What is Australia's date?","In its Information Security Manual, the Australian Signals Directorate recommends ceasing use of traditional asymmetric cryptography by the end of 2030. ASD does not recommend hybrid schemes but does not prohibit them, and it says organizations should expect to move to purely post-quantum algorithms in the future [14].",{"q":113,"a":114},"Does the mandate apply to private companies?","Not directly, with two exceptions: federal contractors, once the FAR rule that Executive Order 14412 orders takes effect, and vendors selling to National Security Systems. The dates still set the market, because customers, auditors, and insurers will read them and ask for your plan [1]. ## Planning",{"q":116,"a":117},"How long does migration take?","The UK NCSC expects large organizations, and those that run their own IT infrastructure, to need two to three years for discovery, assessment, strategy, and initial planning, and another two to three years for early migration and plan refinement. Smaller organizations that mostly use commodity IT may find migration more straightforward, but plan for years, not months [11].",{"q":119,"a":120},"Where do I start?","Name a migration owner, then build a cryptographic inventory, starting with an incomplete one and improving it. OMB's first phase covers strategy, planning, and discovery in 2026 to 2027. Next, rank systems by data shelf life and exposure, and ask vendors for post-quantum roadmaps [2].",[122],"global",[124,125,126],"Cross-Sector","Government Facilities","Defense Industrial Base",{},"2026-09-30",true,"\u002Fblog\u002Fpqc-faq",[132,135,138,141,144,147,150,153,156,159,162,165,168,171,174,177],{"label":133,"url":134},"Executive Office of the President, \"Securing the Nation Against Advanced Cryptographic Attacks,\" Executive Order 14412, 91 Fed. Reg. 38483, Jun. 25, 2026","https:\u002F\u002Fwww.federalregister.gov\u002Fdocuments\u002F2026\u002F06\u002F25\u002F2026-12909\u002Fsecuring-the-nation-against-advanced-cryptographic-attacks",{"label":136,"url":137},"Office of Management and Budget, \"Execution of the Migration to Post-Quantum Cryptography,\" Memorandum M-26-15, Jun. 24, 2026","https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FM-26-15-Execution-of-the-Migration-to-Post-Quantum-Cryptography.pdf",{"label":139,"url":140},"National Institute of Standards and Technology, \"Module-Lattice-Based Key-Encapsulation Mechanism Standard,\" FIPS 203, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F203\u002Ffinal",{"label":142,"url":143},"National Institute of Standards and Technology, \"Module-Lattice-Based Digital Signature Standard,\" FIPS 204, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F204\u002Ffinal",{"label":145,"url":146},"National Institute of Standards and Technology, \"Stateless Hash-Based Digital Signature Standard,\" FIPS 205, Aug. 2024","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Ffips\u002F205\u002Ffinal",{"label":148,"url":149},"National Institute of Standards and Technology, \"NIST Selects HQC as Fifth Algorithm for Post-Quantum Encryption,\" NIST News, Mar. 11, 2025","https:\u002F\u002Fwww.nist.gov\u002Fnews-events\u002Fnews\u002F2025\u002F03\u002Fnist-selects-hqc-fifth-algorithm-post-quantum-encryption",{"label":151,"url":152},"National Institute of Standards and Technology, \"Post-Quantum Cryptography FAQs,\" NIST Computer Security Resource Center, last modified Aug. 5, 2026","https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Fpost-quantum-cryptography\u002Ffaqs",{"label":154,"url":155},"K. Kwiatkowski, P. Kampanakis, B. E. Westerbaan, and D. Stebila, \"Post-Quantum Traditional (PQ\u002FT) Hybrid Key Agreement Mechanisms for TLS 1.3,\" RFC 10024, Aug. 2026","https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc10024",{"label":157,"url":158},"CycloneDX Cryptography Working Group, \"Implement Cryptography Bill of Materials for Post-Quantum Systems and Applications: Guide to CBOM,\" 2nd ed., OWASP Foundation, Oct. 21, 2025","https:\u002F\u002Fcyclonedx.org\u002Fguides\u002FOWASP_CycloneDX-Authoritative-Guide-to-CBOM-en.pdf",{"label":160,"url":161},"National Security Agency, \"The Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ,\" Ver. 2.1, Dec. 2024","https:\u002F\u002Fmedia.defense.gov\u002F2022\u002FSep\u002F07\u002F2003071836\u002F-1\u002F-1\u002F0\u002FCSI_CNSA_2.0_FAQ_.PDF",{"label":163,"url":164},"National Cyber Security Centre, \"Timelines for migration to post-quantum cryptography,\" NCSC, Mar. 20, 2025","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fpqc-migration-timelines",{"label":166,"url":167},"NIS Cooperation Group and European Commission, \"A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography,\" European Commission, Jun. 23, 2025","https:\u002F\u002Fdigital-strategy.ec.europa.eu\u002Fen\u002Flibrary\u002Fcoordinated-implementation-roadmap-transition-post-quantum-cryptography",{"label":169,"url":170},"Canadian Centre for Cyber Security, \"Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001),\" Communications Security Establishment Canada, Jun. 2025","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Froadmap-migration-post-quantum-cryptography-government-canada-itsm40001",{"label":172,"url":173},"Australian Signals Directorate, \"Planning for post-quantum cryptography,\" Australian Cyber Security Centre","https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fsecure-design\u002Fquantum\u002Fplanning-for-post-quantum-cryptography",{"label":175,"url":176},"E. Barker et al., \"Considerations for Achieving Crypto Agility: Strategies and Practices,\" NIST CSWP 39upd1, Jun. 29, 2026","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fcswp\u002F39\u002Fupd1\u002Fconsiderations-for-achieving-crypto-agility\u002Ffinal",{"label":178,"url":179},"National Institute of Standards and Technology, \"Post-Quantum Cryptography,\" NIST Computer Security Resource Center","https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Fpost-quantum-cryptography",[181,184,187,190,193,196,199,202,205,208],{"label":182,"url":183},"Post-Quantum Cryptography Explained","\u002Fblog\u002Fpost-quantum-cryptography-explained",{"label":185,"url":186},"Harvest Now, Decrypt Later","\u002Fblog\u002Fharvest-now-decrypt-later",{"label":188,"url":189},"What Is Q-Day?","\u002Fblog\u002Fwhat-is-q-day",{"label":191,"url":192},"NIST PQC Standards Guide","\u002Fblog\u002Fnist-pqc-standards-guide",{"label":194,"url":195},"Migration Roadmap","\u002Fblog\u002Fpqc-migration-roadmap",{"label":197,"url":198},"Cryptographic Inventory and CBOM","\u002Fblog\u002Fcryptographic-inventory-cbom",{"label":200,"url":201},"Crypto Agility","\u002Fblog\u002Fcrypto-agility",{"label":203,"url":204},"Global Mandates and Deadlines","\u002Fblog\u002Fpqc-mandates-deadlines",{"label":206,"url":207},"Hybrid vs. Pure Post-Quantum","\u002Fblog\u002Fhybrid-vs-pure-post-quantum",{"label":209,"url":210},"Readiness Self-Assessment","\u002Fblog\u002Fquantum-readiness-assessment",{"title":5,"description":42},"Post-Quantum Cryptography FAQ: 25 Questions","pqc-faq",[215,216,217],"NIST finalized three post-quantum standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) (National Institute of Standards and Technology, 2024).","Executive Order 14412 sets Dec. 31, 2030 for post-quantum key establishment and Dec. 31, 2031 for post-quantum digital signatures (Executive Office of the President, 2026).","NSA requires all new National Security System acquisitions to be CNSA 2.0 compliant by Jan. 1, 2027 (National Security Agency, 2024).","blog\u002Fpqc-faq",[220,221,222,223,224],"post-quantum cryptography","PQC migration","NIST PQC standards","for CISOs","primer","Post-quantum cryptography replaces public-key algorithms a quantum computer could break, and the first U.S. deadline arrives at the end of 2026, when new National Security System acquisitions must be CNSA 2.0 compliant.","ccpTz27Z6BVx8F_Yz6TxAXHdd3IXrPQbDyM-gMG15zY",1792182883986]