The U.S. Government Advances Transition to Post-Quantum Encryption by 5 Years

The moment when a quantum computer will be sufficiently powerful to break currently used public key cryptography is approaching rapidly—and indeed, much faster than expected. This is why the U.S. government has chosen to advance by 5 years the deadline for federal agencies to fully transition to new post-quantum encryption methods, and by 4 years for post-quantum digital signatures.

Goodbye to Insecure Ciphers Arrives Sooner Than Expected

What seemed like a distant issue is turning out to be closer than anticipated. Improvements in hardware are making significant strides and will reach a point where they allow for commercially viable calculations in just a few years.

On the other hand, enhancements in algorithms are drastically reducing the number of qubits needed to break currently used public key ciphers. This means that the time frame for when this will occur is not in 20 or 30 years, as previously thought, but sooner—potentially much sooner.

This realization has prompted the White House to issue a new executive order titled "Securing the Nation against Advanced Cryptographic Attacks", which imposes new deadlines for transitioning "high-value and high-impact" systems to post-quantum cryptographic systems: public key ciphers must change by December 31, 2030, while digital signatures must transition by December 31, 2031, as reported by Ars Technica.

This represents a five-year acceleration, which is an eternity in the tech world, compared to the previously set deadline of 2035. This acceleration is justified by the constant and significant decrease in the number of qubits believed necessary to break these ciphers: for example, breaking RSA at 2048 bits, commonly used for key exchange when connecting to a website, was thought to require one billion qubits in 2012, 20 million in 2019, and only one million by 2025.

The most significant problem, despite having post-quantum ciphers available (as they are certified by NIST), remains their implementation, which is particularly complex due to the immense number of devices and applications using ciphers vulnerable to quantum attacks, including distributed network devices and legacy systems that are not easily updatable. This particular aspect makes the advancement to 2030 even more significant, as it imposes a huge amount of work in a relatively short time frame. Currently, there are no reports of similar measures in Italy.