The foundation of modern digital trust is built on public-key cryptography. Every online transaction, encrypted email, VPN tunnel, and digital signature relies on mathematical algorithms like RSA and Elliptic Curve Cryptography (ECC). However, a seismic shift is approaching: the advent of Cryptographically Relevant Quantum Computers (CRQCs) capable of breaking these foundational algorithms.

Organizations face a critical dilemma: wait for quantum hardware to mature and risk retroactive data decryption, or begin migrating immediately despite the complexity of upgrading global IT infrastructures. This comprehensive article explores the state of quantum computing threat timelines, emerging international regulatory mandates, key national target dates, and the technical standards—such as hybrid digital certificates (RFC 9794)—enabling a seamless transition.

TMS Software is also preparing this transition with the addition of a first PQC algorithm in its Cryptography Pack: ML-DSA, as standardized in NIST FIPS-204.

1. The threat horizon: what is a CRQC and when will it arrive?

Algorithmic Optimizations: Recent mathematical advancements (such as optimized modular multiplication circuits and lattice-based attacks) continuously reduce the required physical resource estimates, bringing the threat closer over time.

The Consensus Timeline (2030–2035)

Hardware roadmaps from major quantum developers (IBM, IonQ, Quantinuum, PsiQuantum, Google Quantum AI) aim to demonstrate fault-tolerant logical qubits in the late 2020s. Consequently, major cybersecurity agencies (NSA, ANSSI, BSI, NCSC) and academic consensus project that a functional CRQC could emerge between 2030 and 2035.

The "Harvest Now, Decrypt Later" (HNDL) Threat

The urgency to act is not dictated by the date a CRQC powers on, but by present-day adversary behavior. 

Threat actors and state-sponsored entities are currently intercepting and storing high-value encrypted network communications (TLS streams, VPN payloads, IPsec traffic). Once a CRQC becomes operational, this stored data will be decrypted retroactively. 

Sensitive assets with long confidentiality requirements—such as state secrets, intellectual property, defense communications, medical records, and long-term financial contracts—are already vulnerable to HNDL attacks today.

2. Global regulatory landscape: US vs. EU approaches

Governments worldwide have transitioned from passive academic research to active regulatory enforcement, creating mandatory compliance frameworks.

The United States: Standard-Setting and Federal Mandates

The US leads global technical standardization through the National Institute of Standards and Technology (NIST):

Official FIPS Standards: In August 2024, NIST finalized its first post-quantum encryption standards:

• FIPS 203 (ML-KEM): Module-Lattice-Based Key-Encapsulation Mechanism (derived from CRYSTALS-Kyber) for general encryption and key exchange.
• FIPS 204 (ML-DSA): Module-Lattice-Based Digital Signature Algorithm (derived from CRYSTALS-Dilithium) for general digital signatures.
• FIPS 205 (SLH-DSA): Stateless Hash-Based Digital Signature Algorithm (derived from SPHINCS+) as a fallback signature mechanism.
• Federal Guidance (NIST IR 8547): Published in late October 2026, NIST IR 8547 provides operational migration strategies and deprecation timelines for federal agencies and technology suppliers.

National Security Commitments: Under National Security Memorandum 10 (NSM-10) and CISA/NSA directives, US federal agencies and Defense Industrial Base (DIB) partners face strict milestones to audit crypto-assets and phase out legacy public-key algorithms by 2030–2035.

The European Union: Sovereignty, Directives, and Compliance

The EU integrates PQC requirements into its broader cybersecurity legislative framework:

EU Coordinated Migration Recommendation: Adopted in June 2025, the European Commission set a unified roadmap instructing Member States to establish national migration plans by late 2026, targeting full protection of high-risk infrastructure by 2030 and medium-risk assets by 2035.

NIS2 Directive & DORA: The Network and Information Security Directive (NIS2) and the Digital Operational Resilience Act (DORA) mandate crypto-agility and risk assessment for critical sectors (energy, banking, transport, health). Entities must maintain up-to-date inventories of cryptographic assets and implement risk mitigations against HNDL.

National Agency Policies: 

• ANSSI (France): Strongly advocates for a transitional hybridation phase (combining classical and PQC algorithms) and plans to restrict non-PQC products in official security qualifications post-2027, making non-PQC solutions unpurchasable for state systems after 2030.
• BSI (Germany): Recommends early adoption of hybrid key exchange for TLS 1.3 and IPsec, providing detailed national guidelines for federal migration.

3. Country-by-country target migration dates

The table below summarizes the strategic milestones targeted by major economies for post-quantum migration across public, private, and critical infrastructure sectors:

4. Technical implementation: hybrid digital certificates & RFC 9794

Upgrading millions of web servers, mobile devices, and IoT endpoints to pure post-quantum algorithms overnight is impossible without triggering widespread network failures. Pure PQC keys and signatures are significantly larger than RSA/ECC equivalents, creating severe backwards compatibility issues.

The Backward Compatibility Dilemma

Replacing a standard RSA or ECDSA certificate directly with a pure ML-DSA certificate introduces major operational challenges:

1. Legacy Breakage: Older client devices (legacy web browsers, embedded hardware, industrial controllers) cannot parse PQC OIDs (Object Identifiers) or public key formats, resulting in failed TLS handshakes.
2. Key and Signature Size Overhead:
   * RSA-2048 Public Key: ~256 bytes | Signature: ~256 bytes
   * ML-DSA-65 (FIPS 204): Public Key: 1,952 bytes | Signature: 3,293 bytes
   * SLH-DSA-128f (FIPS 205): Public Key: 32 bytes | Signature: 17,088 bytes
3. Performance Impact: Increased payload size leads to packet fragmentation in network protocols like TLS over UDP/QUIC and TCP, increasing latency during connection establishment.

Hybrid Cryptography and standardisation (RFC 9794)

To bridge the gap between classical reliance and quantum security, standard bodies like the IETF (Internet Engineering Task Force) have established standardized hybrid models [3]:

What is a Hybrid Certificate? A hybrid digital certificate combines a classical algorithm (e.g., ECDSA or RSA) with a post-quantum algorithm (e.g., ML-DSA) within a single X.509 certificate or paired linked certificates.
The Role of RFC 9794: Published to define standardized terminology, structures, and protocol mechanics for hybrid public key infrastructures (PKI), RFC 9794 provides a common framework for vendor interoperability:
Dual Validation: A modern, PQC-aware client validates both the classical and the post-quantum signature. If either algorithm fails or shows signs of compromise, the trust validation fails.
Graceful Degradation: A legacy client ignores the post-quantum extensions or secondary keys and validates only the classical signature, maintaining operational continuity.
Composite Signatures vs. Linked Certificates: Standards bodies support two primary deployment modes:
  1. Composite Certificates: A single X.509 certificate carrying multiple public keys and a combined signature value.
  2. Dual/Alternative Certificates (RFC 9794 / Alternative Keys): A primary classical certificate containing extensions that reference a secondary post-quantum certificate or embed alternative public keys.

Through hybrid certificates, organizations achieve immediate protection against "Harvest Now, Decrypt Later" for key exchange, maintain fallback protection if a new PQC algorithm exhibits cryptographic flaws, and retain 100% compatibility with legacy systems.

5. Conclusion: why organizations must prepare to switch now

The migration to post-quantum cryptography is not a distant task for the 2030s—it is a critical operational requirement today. Given the multi-year lifecycles of enterprise software, hardware procurement cycles, and data retention laws, waiting for an operational CRQC to emerge will guarantee security failures.

To build quantum resilience, organizations should execute a three-phase action plan immediately:

1. Conduct a Cryptographic Inventory: Discover and catalogue all instances of public-key cryptography across your enterprise architecture (certificates, SSH keys, TLS endpoints, code signing keys, and third-party SaaS dependencies).
2. Implement Crypto-Agility: Upgrade security libraries, API gateways, and PKI platforms to support hybrid cryptography (such as RFC 9794 implementations) allowing seamless algorithm rotation without code rewrites.
3. Align Migration Schedules with Regulatory Deadlines: Map internal IT roadmaps against federal and regional targets (such as NIS2, DORA, and NIST IR 8547), aiming to secure all high-risk data assets well before the 2030 deadline.

The transition to post-quantum cryptography represents the largest structural upgrade to global digital infrastructure in decades. By taking proactive steps today, you can secure your applications against current interception and ensure digital trust in the quantum era. TMS Cryptography Pack 5.4.0.0 includes ML-DSA and will integrate other NIST standards in future releases. You can then start getting familiar with PQC algorithms and prepare the tranistion while preserving compatibility with existing standards.


*** REFERENCES ***

[1] Peter W. ShorTitre : Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer, Proceedings of the 35th Annual Symposium on Foundations of Computer Science (IEEE, 1994). SIAM Journal on Computing, Vol. 26, No. 5, pp. 1484–1509, 1997. DOI / Archive: arXiv:quant-ph/9508027

[2] F. Pappalardo, A. Goudarzi et al. (Équipe Alice & Bob & Inria) Shor’s algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days. ePrint: IACR Cryptology ePrint Archive, Report 2026/2665 (Octobre 2026). IACR ePrint 2026/2665

[3] Bill Buchanan, One of the Greatest Changes in Digital Trust in Decades: Hybrid Digital Certificates, https://medium.com/asecuritysite-when-bob-met-alice/one-of-the-greatest-changes-in-digital-trust-in-decades-hybrid-digital-certificates-41663af98620