Quantum threat: Washington’s race to change its digital locks

Consider a government agency upgrading its encryption. Years earlier, an adversary had copied some of its traffic. If a sufficiently powerful quantum computer eventually breaks the old protection, the upgraded system will leave that earlier copy untouched. The federal government’s July 2024 report describes this risk. It gives the American migration its urgency: a secret needs protection for as long as the information remains valuable. ⁹

In June 2026, Washington set new deadlines for priority systems: the end of 2030 for establishing keys and the end of 2031 for digital signatures. Post-quantum cryptography is designed to resist known quantum attacks. Deploying it means working through older applications, equipment and suppliers that move on different schedules. ^{2, 3}

This investigation follows that practical work. The federal audit published in October describes preparations observed through September 2025. Standards and requirements have since advanced; the public record examined as of November 5, 2026 still leaves the overall state of execution unresolved. The $7.1 billion figure is an initial estimate made in 2024 for a defined set of priority systems. Together, the documents explain the technical and economic dependencies of the transition, with their dates and limits kept visible. ^{1, 3, 9}

An audit completed in 2025 and published in 2026

The Government Accountability Office (GAO), Congress’s audit institution, conducted its work from February 2024 to September 2025. A sensitive report was issued in September 2025. The public version appeared on October 6, 2026 and was revised on October 14, following coordination with agencies to remove sensitive information. ¹

In that assessment, none of the twenty-four Chief Financial Officers Act agencies fully met all three preparatory practices: developing a prioritized inventory, identifying funding needs and testing post-quantum cryptography. One agency fully addressed the inventory practice; twenty-one addressed it partially. For testing, one was rated “partially addressed,” while the other twenty-three were rated “not addressed.” ¹

These ratings assess migration preparations and the evidence supplied to the auditors. For the twenty-three agencies in the lowest testing category, the finding concerns the practice GAO evaluated through September 2025. Measuring protected connections, intrusions or exposed files would require separate indicators. ¹

National Security Systems, or NSS, follow a separate policy track. The preparation framework reviewed by GAO covers prioritized systems outside NSS. In October 2026, the National Security Agency (NSA), the US cryptology and signals-intelligence agency, announced separate NSS requirements: new commercial systems must be capable of supporting quantum-resistant algorithms from 2027, while incompatible legacy systems must be phased out by 2030. Tracking their implementation would require evidence specific to that population. ¹¹³

Method and scope

One symbol represents one agency, assessed independently for each practice. Inventory: 1 full, 21 partial, 1 minimal and 1 not addressed. Funding: 21 partial and 3 not addressed. Testing: 1 partial and 23 not addressed. No agency falls in the substantially addressed category on these rows. This is documented readiness during the audit, excluding national security systems; it does not measure the share of protected systems in November 2026.

GAO’s shortcomings remain documented findings for the period audited. Measuring subsequent progress would require follow-up evidence after September 2025, using the same population and definitions. Until that comparison is available, the documents establish policy tightening more clearly than operational results.

The conversation key and the software signature

A secure connection performs several jobs. It lets two machines establish a secret, encrypt the messages they exchange and authenticate who is communicating. Those functions rely on different mechanisms. In a key-encapsulation mechanism, or KEM, two parties obtain a shared secret using a public key and an encapsulation message. The recipient uses its private key to recover the secret associated with the encapsulation message. That secret can then be used to derive the keys that protect application data through symmetric cryptography. ⁵⁸

Digital signatures answer a different question: was this message, certificate or software update produced by the expected key holder, and has it remained unchanged since signing? A software-update chain can depend on signatures well before a user opens a connection. Upgrading the confidentiality of traffic therefore leaves another job: maintaining trust in identities and software. ⁶¹⁸

The National Institute of Standards and Technology (NIST), the federal standards agency, published its initial post-quantum standards on August 13, 2024. ML-KEM, specified in FIPS 203, establishes a shared secret. ML-DSA and SLH-DSA, specified in FIPS 204 and 205, provide signatures. ML-KEM and ML-DSA use lattice-based constructions; SLH-DSA uses hash functions. Each standard specifies its own security function. ⁵⁶⁷

Method and scope

In the KEM model, the recipient makes its public key available. The sender creates an encapsulation message and a secret; the recipient recovers that secret using its private key. The shared secret is then used to derive symmetric-encryption keys. For signatures, the producer signs with its private key and the verifier uses the corresponding public key. Origin and integrity checks operate within a trust policy. This functional drawing simplifies the exchanges; it is neither a complete TLS connection nor an operational configuration.

A sufficiently capable future quantum computer could undermine certain public-key methods used today. Exploiting that capability would require the relevant captured data and public material, enough computing power, and a protection scheme vulnerable to the attack. The documents reviewed still describe a future capability with an uncertain arrival date. ¹³⁹

For a system owner, the practical priority is identifying information whose required secrecy lasts long enough to encounter that threat. A record’s confidentiality requirement can outlive the equipment that processes it, the maintenance contract and the political term under which the system was bought.

Captured copies outlive the migration

The threat commonly called “harvest now, decrypt later” exploits that difference in lifetimes. An adversary can retain encrypted traffic and the public material associated with establishing its keys. If the protection later becomes breakable, the stored copy acquires new value and remains available after the original service is upgraded. The government’s July 2024 report describes the mechanism alongside constraints on access, identifying useful data and storage. ⁹

Consider a deliberately hypothetical example. A conversation is recorded in 2026 and must remain confidential until 2041. The service migrates in 2030. Suppose a relevant quantum computer arrives in 2038: traffic captured before migration could then become exploitable while its secrecy still matters. 2038 is a date chosen for this example. The scenario illustrates why the useful lifetime of a secret belongs in migration priorities.

Method and scope

The example chooses a recording in 2026, service migration in 2030, an assumed decryption capability in 2038 and confidentiality required until 2041. All rows use the same time scale, horizontal on desktop and vertical on mobile. The copy retains its original protection after service migration. Exploitation still requires vulnerable protection, a relevant and usable copy, and sufficient computing capability. None of these dates forecasts the arrival of a cryptographically relevant quantum computer.

Signatures also underpin trust in software, identities and documents. Migrating them depends on the lifetime of devices that verify signatures and on how that trust will be maintained. Priorities therefore follow the security function, a distinction reflected in the revised federal timetable. ²⁶

Washington brought the priority deadlines forward

Executive Order 14412, issued on June 22, 2026, requires post-quantum key establishment for federal High Value Assets and high-impact systems outside NSS by December 31, 2030. Their digital signatures must follow by December 31, 2031. Memorandum M-26-15 from the Office of Management and Budget (OMB), the White House budget office, sets out implementation phases from June 24: discovery and planning, pilots, then prioritized migration. A final phase aims to complete migration of remaining systems by 2035, taking account of risk and commercial availability. ²³

The memorandum also requires migration plans within 120 days. Calendar arithmetic places the deadline on October 22, 2026, before this investigation’s cutoff. A tally of submissions and an agency-by-agency assessment of their quality remain missing from the public material reviewed. The status of those submissions is therefore an open question in this investigation. ³

On October 27, 2026, NIST published the final version of IR 8547. The relevant sections of the full report examined for this investigation cover dependencies, hybridisation and deadlines. They connect the overall 2035 transition goal with the earlier priority-system requirements. The November 2024 version was a draft. ⁴

Assessing the timetable’s impact will mean tracking the uses covered in each agency, the dependencies still awaiting change and the duration of accepted exceptions. Shared deadlines help coordinate purchasing. They could also concentrate demand for testing and expertise in the same period, an organizational risk whose scale remains to be measured.

The first bill is for finding the dependencies

A useful cryptographic inventory needs more than an algorithm name. It must connect a use to a service, software version, device, owner and confidentiality requirement. Discovering that a library can run ML-KEM says little by itself about the route data actually takes. OMB calls for a continuously updated understanding of the estate and encourages automation. The 2024 report already warned that discovery tools can leave gaps outside their visibility. ³⁹

Imagine an administrative application maintained by an integrator and hosted by a cloud provider. Access might depend on a directory, certificates, a network appliance and the signing process for software updates. In this illustrative architecture, upgrading the host completes one step. Compatibility still needs checking across the path, with a clear owner for each connection between components.

That dependency has become an explicit policy concern. M-26-15 asks agencies to define responsibilities with cloud providers authorized through the federal FedRAMP program, and provides for coordination around services shared by multiple agencies. A common platform can avoid repeated work while bringing customers together around the same releases or validation processes. The savings achievable depend on each service’s architecture and contracts. ³

Work is already under way in several areas. In January 2026, the Cybersecurity and Infrastructure Security Agency (CISA) announced categories of products using post-quantum standards or undergoing transition. In August, the General Services Administration (GSA), which provides shared federal services and procurement, described work on identities, access and testing for physical access controls. These publications make institutional activity visible. Establishing the conformity of individual products or actual deployment in agencies would require assessments of those specific subjects. ¹¹¹²

A $7.1 billion estimate for priority systems

The public estimate identified here comes from the July 2024 report by OMB and the Office of the National Cyber Director. It puts migration of prioritized information systems during 2025–2035 at approximately $7.1 billion in 2024 dollars. National Security Systems have separate estimates. This initial projection remains a rough order of magnitude with substantial uncertainty around inventories and costing methods. ⁹

The estimate addresses a funding need over several years. Following that need through appropriations, contracts and payments would require other records. Its distribution across agencies also remains to be established: each operates a different technology estate. Both the priority-system boundary and the 2024 price basis therefore belong alongside any use of the figure.

The report describes replacing systems unable to accommodate new cryptographic mechanisms as a significant cost component, giving a qualitative assessment of its share. This makes replacement cycles important. Adding an upgrade to a planned refresh has different budget consequences from retiring recently purchased equipment early. The difference would need to be established contract by contract, taking account of remaining service life. ⁹

OMB now requires the transition to be incorporated into cloud moves, software development and hardware refreshes. The economic benefit would come from coordinating work, some of which would have happened anyway. Waiting until the final deadline could narrow the choice between a supported modification and emergency replacement. That explains a cost mechanism whose effect on the total bill remains to be measured. ³

A few thousand bytes can change the integration job

The standards make part of the problem concrete. For ML-KEM-768, the public encapsulation key is 1,184 bytes, the encapsulation ciphertext 1,088 bytes, and the shared secret 32 bytes. FIPS 203 defines those sizes. The encapsulation message helps establish the shared secret; keys derived from that secret then protect application content. ⁵

For signatures, ML-DSA-65 produces a 3,309-byte signature with a 1,952-byte public key, according to FIPS 204. Each parameter set combines its own sizes with a security level. Selection should follow the protection needed and the service’s constraints; the effect on network speed needs measuring under actual operating conditions. ⁶

Method and scope

FIPS 203, table 3: ML-KEM-512, 768 and 1024 have public keys of 800, 1184 and 1568 bytes, and encapsulation messages of 768, 1088 and 1568 bytes. All three use a 32-byte shared secret. FIPS 204, table 2: ML-DSA-44, 65 and 87 have public keys of 1312, 1952 and 2592 bytes and signatures of 2420, 3309 and 4627 bytes. Each panel has a separate zero-based scale, extending to 1600 or 5000 bytes. The parameters have different security levels. These individual objects represent neither a complete connection’s data volume nor a throughput or latency benchmark.

These sizes provide a concrete reason to test the equipment, exchanges and software concerned. Execution time, power consumption and latency also depend on certificates, encoding, the protocol, implementation and hardware. A modern server and a constrained embedded device can therefore face different problems. Testing needs to cover the complete service, including recovery after an error. ⁵⁶¹⁸

Assessing the quantum resistance of a TLS 1.3 connection means examining the algorithms actually used for key establishment and authentication. A configuration can still depend on methods vulnerable to quantum computing. Migration tracking therefore needs to reach those cryptographic choices and their implementation. ¹⁸

Buying the ability to change

On November 4, 2026, NSA, CISA and ASD’s Australian Cyber Security Centre jointly announced guidance on questions to ask suppliers. The agencies place these conversations within procurement, renewals and vendor assurance: even organizations with strong internal expertise depend on partners’ transparency and delivery schedules. This recent announcement gives the dependency problem a practical procurement framework. ¹⁹

Cryptographic agility means being able to change cryptographic mechanisms across protocols, software, hardware and firmware while preserving security and operations. NIST updated a publication on the subject in June 2026. For a buyer, the questions are practical: who can change the algorithm, through which process, with what tests, and for how long will the product remain supported? ¹⁰

A procurement claim of “post-quantum compatibility” should be tied to a specific use and a deliverable version. The evidence needs to cover certificates, dependencies, updates and service support. Each cryptographic validation has a scope that must be connected to the complete architecture. A contract can specify the evidence and responsibilities while protecting the confidentiality of the technical inventory. ³⁹¹⁰

Hybrid constructions offer a transition route: combining classical and post-quantum components in a mechanism designed to retain protection if one remains secure. France’s national cybersecurity agency, ANSSI, emphasizes the value of avoiding regression. This requires correct composition and controlled implementation, with tests covering protocol resistance, fallback behavior and error handling. ¹⁵

Federal purchasing can influence that market. The June executive order instructs the Federal Acquisition Regulatory Council, or FAR Council, to publish a proposed rule for covered contractors, with a December 2030 compliance date. Its concrete scope will depend on the rulemaking process, adopted clauses and contracts covered. The economic effect will then turn on the requirements actually checked. ²

Europe faces the same mismatch of lifetimes

The European roadmap adopted in June 2025 recommends that all Member States begin the transition by the end of 2026 and migrate high-risk uses by the end of 2030. It provides a coordinated framework addressed to Member States. France’s 2026–2027 priorities for government cybersecurity include transition preparation and inventories. ¹⁴¹⁶

A French public body or company faces a similar planning problem: aligning the useful life of a secret with equipment and contract lifetimes. ANSSI’s FAQ recommends inventorying uses and engaging suppliers. British guidance distinguishes complex organizations from users of standard products. For some of the latter, migration may arrive through routine vendor updates. ¹⁵¹⁷

Available standards, integration work at suppliers and agencies, and normal replacement cycles offer real routes through the transition. Risk concentrates in overlooked dependencies, hard-to-update equipment and data whose required secrecy outlasts those cycles. Distinguishing those cases helps target the work still needed.

Count completed transitions, with a meaningful denominator

Useful monitoring would start by identifying the systems and uses covered by the inventory. It would document end-to-end tests passed in deployed versions, then the older protections still required, with an owner and a planned retirement date. These are proposed monitoring criteria; filling them would require new data.

Progress can then be tracked against stable denominators and visible exceptions. A reduction in unknown dependencies may mean more than another pilot announcement. Removing an incompatible device supplies different evidence from declaring a software release ready. Aggregated reporting could make progress visible without disclosing detailed access paths and configurations that agencies need to protect.

The documentary verdict is limited but clear: preparation gaps are established for the audit period; a tighter timetable is established for 2026; a complete picture of execution is unavailable in the public material reviewed. The central task is to preserve the confidentiality of data long after creation while renewing the infrastructure that handles it. A new standard makes that possible. Actual protection depends on completed migrations, and on the copies of data that a late migration can never retrieve.

Limitations

This documentary investigation draws exclusively on public sources consulted on November 5, 2026. Federal networks and sensitive inventories remain outside its scope. GAO’s findings describe an audit completed in September 2025; GSA and NSA announcements are attributed to their authors. An exhaustive account of submitted plans, migrated systems and actual spending remains to be established in the public material reviewed. Work inside the agencies may extend beyond that visibility.

Dates represent requirements or objectives according to each source; evidence of completion needs separate examination. The historical cost estimate uses 2024 prices. Cryptographic object sizes come from standards, while their performance would require measurement. The 2026–2041 scenario is hypothetical. The relevant sections of the full final IR 8547 report were examined; sources and precise locators follow. The sharing image is a conceptual illustration.

Further reading

Bitcoin’s post-quantum migration examines signatures, custody equipment and protocol rules. The economics of restarting after a cyberattack explores another set of dependencies: restoring a service requires technical and financial coordination.

Sources

1. S01 · GAO · 2026-10-06 · updated 2026-10-14 · Accessed : 2026-11-05Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat (GAO-27-108740)
   Passages and scope

   Assessment of preparatory practices at 24 CFO Act agencies. Performance audit: February 2024–September 2025; public release October 2026. Counts concern preparation, not compromised systems or current protection rates.

   Additional official document

2. S02 · White House · 2026-06-22 · Accessed : 2026-11-05Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks
   Passages and scope

   Sections 4(b), 5(c), 6 and 7. Priority deadlines concern non-NSS High Value Assets and high-impact systems. The contractor provision calls for a proposed FAR rule, subject to subsequent rulemaking.

3. S03 · OMB · 2026-06-24 · Accessed : 2026-11-05M-26-15: Execution of the Migration to Post-Quantum Cryptography
   Passages and scope

   Sections 1, 3B, 3C.3–5 and 3D. Plan deadline calculated as June 24 plus 120 days. Covers non-NSS systems; integrates migration with cloud, software and equipment renewal.

4. S04 · NIST · 2026-10-27 · Accessed : 2026-11-05Transition to Post-Quantum Cryptography Standards, IR 8547 (Final)
   Passages and scope

   Final report, sections 2.2, 3, 3.1, 3.2, 4 and 4.1, printed pages 5–17; tables 2 and 4. Full text examined. Earlier priority-system deadlines coexist with the overall 2035 transition goal. Associated news announcement updated November 2, 2026.

   Additional official document

   Full final report

5. S05 · NIST · 2024-08-13 · Accessed : 2026-11-05FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard
   Passages and scope

   Introduction and table 3, printed page 39 / PDF page 48. Fixed ML-KEM object sizes in bytes, not a complete connection or performance measurement.

6. S06 · NIST · 2024-08-13 · Accessed : 2026-11-05FIPS 204: Module-Lattice-Based Digital Signature Standard
   Passages and scope

   Table 2, printed page 16 / PDF page 26. ML-DSA public-key and signature sizes. Parameter sets have different security categories.

7. S07 · NIST · 2024-08-13 · Accessed : 2026-11-05FIPS 205: Stateless Hash-Based Digital Signature Standard
   Passages and scope

   Publication record and abstract. Final hash-based SLH-DSA signature standard, published August 13, 2024.

8. S08 · NIST · 2025-09-18 · Accessed : 2026-11-05SP 800-227: Recommendations for Key-Encapsulation Mechanisms
   Passages and scope

   Publication record and abstract. Final recommendations on key encapsulation and shared secrets, used with symmetric cryptography.

9. S09 · OMB / ONCD · 2024-07 · Accessed : 2026-11-05Report on Post-Quantum Cryptography, required by the Quantum Computing Cybersecurity Preparedness Act
   Passages and scope

   Sections 1 and 2; cost estimate on PDF page 11. Approximately $7.1 billion in 2024 dollars for prioritized systems in 2025–2035, excluding NSS. Initial rough order of magnitude, with high uncertainty.

10. S10 · NIST · 2025-12-19 · updated 2026-06-29 · Accessed : 2026-11-05CSWP 39 upd1: Considerations for Achieving Crypto Agility: Strategies and Practices
    Passages and scope

    Publication record, abstract and history. Crypto-agility strategies across protocols, software, hardware and firmware; updated June 29, 2026.

11. S11 · CISA · 2026-01-23 · Accessed : 2026-11-05CISA Releases Product Categories to Aid in Post-Quantum Cryptography Adoption
    Passages and scope

    Official January 23, 2026 bulletin announcing product categories using or transitioning to PQC. The announcement is not a certification of all products in those categories.

12. S12 · GSA · 2026-08-24 · Accessed : 2026-11-05GSA leads the transition to quantum-resistant technology
    Passages and scope

    GSA account of identity architecture and physical-access-control testing. An agency description of its own work, not an independent audit of completed migration.

13. S13 · NSA · 2026-10-01 · Accessed : 2026-11-05NSA Announces Post-Quantum Cryptography Measures to Safeguard National Security Systems Against Quantum Computing Threats
    Passages and scope

    October 1, 2026 announcement of CNSS Policy 15. Quantum-resistant capability for new commercial NSS from 2027; phase-out by 2030 of incompatible legacy systems. Separate scope from OMB M-26-15.

14. S14 · Commission européenne · 2025-06 · updated 2026-10-20 · Accessed : 2026-11-05Post-quantum cryptography
    Passages and scope

    Coordinated roadmap adopted in June 2025; policy page updated October 20, 2026. Recommends starting national transitions by end-2026 and addressing high-risk use cases by end-2030.

15. S15 · ANSSI · undated page · Accessed : 2026-11-05FAQ – Cryptographie post-quantique
    Passages and scope

    Guidance on inventories, hybridisation, crypto agility and supplier discussions. An undated page accessed November 5, 2026; technical recommendations have their stated scope.

16. S16 · ANSSI · 2026-04-09 · Accessed : 2026-11-05Feuille de route des efforts prioritaires en matière de sécurité numérique de l’État 2026–2027
    Passages and scope

    April 9, 2026 announcement of French state cybersecurity priorities for 2026–2027. Preparation and inventories are work commitments, not measured migration rates.

17. S17 · NCSC · 2025-03-20 · Accessed : 2026-11-05Timelines for migration to post-quantum cryptography
    Passages and scope

    March 20, 2025 guidance, including 2028/2031/2035 phases. Distinguishes complex estates and bespoke systems from users relying on standard-product updates.

18. S18 · IETF · 2018-08 · Accessed : 2026-11-05RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3
    Passages and scope

    Sections 2, 4.2.8, 4.4.3 and 7.4. TLS 1.3 key establishment and authentication are distinct functions; the version label alone does not establish post-quantum protection.

19. S19 · NSA / CISA / ASD ACSC · 2026-11-04 · Accessed : 2026-11-05NSA Joins ASD’s ACSC and CISA to Provide Practical Questions to Evaluate Third-Party Readiness for Post-Quantum Cryptography
    Passages and scope

    US joint announcement on November 4, 2026, covering procurement, renewals and vendor assurance. The underlying Australian page records initial publication July 16 and review November 5, 2026.

    Additional official document