Post-quantum cryptography

What is PQC?

Post-quantum cryptography is cryptographic algorithms designed to secure against quantum and classic computers. Unlike current standards that rely on integer factorization or discrete logarithms, PQC uses lattices, codes, and isogenies that quantum computers cannot solve efficiently.

Much of the encryption protecting federal data today could eventually be broken by a sufficiently capable quantum computer. Recent executive direction and OMB guidance established firm timelines for federal agencies to inventory their cryptography and migrate to post-quantum cryptography standards published by NIST.

• Harvest now, decrypt later. Sensitive data stolen today can be decrypted once quantum computers mature.
• Prevent national security vulnerabilities. Critical infrastructure and classified communications rely on algorithms susceptible to Shor’s algorithm.
• Avoid economic disruption. Financial transactions and blockchain integrity face existential threats without quantum-resistant standards.
• It pays to be prepared. Reactive costs can be much higher than proactive costs.

Why does PQC matter?

The transition to PQC is critical because Shor’s Algorithm could potentially break nearly all modern public-key encryption once cryptographically relevant quantum computers exist. The critical detail is where the vulnerable cryptography actually lives. How does an obscure 1994 mathematics result ends up shaping acquisition policy?

Shor’s algorithm breaks public-key cryptography specifically, and public-key cryptography isn’t something agencies write themselves. It’s embedded deep inside products they purchase: the TLS libraries in web servers, VPN concentrators and firewalls, hardware security modules, PIV credentials and smart cards, code-signing tools, firmware in network equipment, and the cloud services agencies increasingly run on.

Our role

Because Shor’s algorithm targets cryptography that arrives through the supply chain, remediating it is fundamentally a matter of what the government buys and what it requires of sellers. Agencies own the inventory and the migration plan; but the actual quantum-resistant products have to come through contracts.

As a large agency with its own migration obligation, we are both a buyer and an enabler. Our Office of Acquisition Solution Development works to build PQC requirements into the IT and telecommunications solutions agencies already use, so quantum-resistant products and services are readily available and compliant.

We help make PQC buyable and adaptable:

• Educating the acquisition workforce and industry on what to ask for.
• Embedding requirements into our vehicles like MAS, GWACs, and EIS, so agencies aren’t each negotiating quantum-resistance terms separately.
• Requiring cryptographic visibility from vendors.
• Using FedRAMP to press cloud service providers on cryptographic posture, since so much federal data now sits with them.

When selecting tools or services, prioritize accuracy, speed, user experience, compatibility, compliance support, risk‑based prioritization, and strong remediation guidance and vendor support.

Resources

• PQC buyer’s guide
• PQC roadmap

NIST and CISA roles

NIST

NIST leads the global effort to develop and standardize post-quantum cryptographic algorithms that can withstand future quantum attacks. They work closely with industry through the National Cybersecurity Center of Excellence to facilitate early adoption.

CISA

CISA oversees the implementation of post-quantum standards across federal networks and critical infrastructure to ensure national cyber resilience. They maintain the official catalog of PQC-capable product categories to guide agency procurement.

PQC laws, policy, and directives

• EO 14413: Ushering in the Next Frontier of Quantum Innovation
• EO 14412: Securing the Nation Against Advanced Cryptographic Attacks
• OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography
• EO 14306: Sustaining Select Efforts To Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144
• OMB Memorandum 23-02: Mitigating to Post Quantum Cryptography
• National Security Memorandum 10: Promoting United States Leadership in Quantum Computing While Mitigating Risk to Vulnerable Cryptographic Systems
• Quantum Computing Cybersecurity Preparedness Act
• NSM-10:  Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems
• Federal Information Processing Standard glossary