CISA Says 2035 Quantum Deadline Remains Achievable Despite Recent Breakthroughs
The U.S. federal government’s 2035 mandate for agencies to adopt quantum-resistant cryptography remains a “realistic” timeline, even in light of Google’s recent quantum chip breakthrough, said the nation’s cyber defense agency.
See Also: The CIS Security Operations Center (SOC)
Google’s new Willow quantum chip, which the tech giant claims is capable of solving problems that would take traditional supercomputers up to 10 septillion years, has been hailed as a landmark in scientific innovation. But the development didn’t come as a surprise to Garfield Jones, associate chief of strategic technology for the Cybersecurity and Infrastructure Security Agency.
By unveiling its 105-qubit quantum processor earlier this month, Google seemingly surpassed a critical error-correction threshold, just weeks after the National Institute of Standards and Technology released its first set of finalized encryption tools designed to withstand a quantum computer attack.
Jones described the development as “somewhat expected.”
“We need to keep focusing on integrating the algorithms that NIST developed into products, developing more data protection solutions, and gathering accurate inventories of agencies’ assets,” Jones said. He added that while the current pace of the inventories is progressing, it could accelerate significantly once the federal government transitions from manual to automated methods.
CISA has been collaborating with NIST, the Office of the National Cyber Director, the Office of Management and Budget and other federal agencies to assess tools designed to automatically identify and track the cryptographic systems used by federal agencies, helping ensure they are ready for the transition to quantum-resistant encryption across the civilian branches of the government. Federal agencies estimate that devices capable of breaking current encryption methods could emerge within a decade, but experts warn that it may already be too late for agencies to fully protect themselves from the potential risks of quantum computing.
“It’s already too late for agencies to be fully insulated from quantum threats,” Rex Booth, former chief of cyber threat analysis for CISA and CISO of the security firm SailPoint, told Information Security Media Group. “Our adversaries have been collecting our traffic for years, just waiting to apply quantum technology to break the encryption.”
Government watchdogs have long urged the federal government to increase its investment in quantum preparedness, as adversaries like China continue to pour resources into efforts to outpace the U.S. in quantum computing research and development. Experts told ISMG in September that federal networks remain vulnerable to future quantum-enabled risks, citing bureaucratic red tape and unforeseen costs that could significantly hinder the government’s efforts to stay ahead (see: Quantum Risks Pose New Threats for US Federal Cybersecurity).
The 2035 target for federal agencies to adopt quantum-resistant cryptography remains a “cautious yet pragmatic benchmark that organizations should take seriously,” said Marc Manzano, head of the quantum security group at SandboxAQ, a company specializing in artificial intelligence and quantum sensing technologies.
“The 2035 target offers a structured roadmap,” Manzano said, noting that “the process remains challenging due to the complexity of replacing legacy cryptographic systems” and significant resource constraints, including limited access to automated tools. He added that agencies should “focus on systems integral to critical infrastructure or those with long-term data sensitivity.”
During the Quantum World Congress summit in September, Department of Defense officials highlighted several initiatives to boost quantum readiness, including a Defense Advanced Research Projects Agency program that explores the possibility of accelerating the development of quantum computers beyond current expectations. Even with ongoing advancements in quantum preparedness, transitioning the federal government to quantum-resistant systems could still be a significant challenge, as recent White House reports estimate the cost of updating key federal systems to post-quantum encryption at least $7.1 billion through 2035.
OMB and NIST did not respond to requests for comment.