Geo-Specific
,
Next-Generation Technologies & Secure Development
France Invokes Geopolitical Instability to Mandate 2030 Deadline
A working quantum computer is probably at least a decade away. The rush to adopt encryption algorithms that can withstand the onslaught of a qubit attack has already begun, with European countries feeling variable levels of urgency.
See Also: Does Office 365 Deliver The Email Security and Resilience Enterprises Need?
France appears to be at the forefront of European efforts to prepare for the arrival of quantum computing and its potential impact on cybersecurity, with an aggressive 2030 transition timeline for the implementation of post-quantum cryptography.
Quantum computers are still experimental. If and when they become a commercial reality, such computers should be capable of breaking classical cryptographic algorithms with relative ease. Because it will take years to migrate complex systems across to post-quantum computing, organizations of all kinds are being urged to start preparing for the transition now (see: Google’s 2029 Quantum Deadline Is a Wake-Up Call).
France’s National Cybersecurity Agency, known as ANSSI, this month laid out a framework for reaching a post-quantum future. “The transition to algorithms resistant to this threat is a long-term undertaking and must therefore be anticipated and initiated now,” it states, invoking “a context of generally rising threats and a degraded geopolitical situation.”
Under the plan, French ministries will have to deploy post-quantum encryption for systems handling sensitive information by the end of 2030, and thereafter only use encryption products capable of withstanding a quantum onslaught.
Germany’s Federal Office for Information Security set out a similar deadline for protecting sensitive information in February, while also recommending that classical asymmetric encryption methods and classical digital-signature algorithms should no longer be used in isolation by the end of 2031 and 2035, respectively. The 2035 deadline for the transition is also included in a coordinated post-quantum implementation road map agreed to by European Union member states – and supported by the European Commission – in June last year.
“Sooner is better in principle, but 2035 is still a workable deadline,” said Louis Atkin, research analyst at Juniper Research. One of the biggest fears surrounding the quantum computing revolution is the possibility of “harvest now, decrypt later” schemes – hence the first deadline in the French timeline. By the end of this year, ministries will need to have inventoried the “durably sensitive” data that will need to be prioritized when implementing post-quantum encryption.
“The real risk is that data can be collected now and decrypted later, so organizations with sensitive or long-lived data don’t really have the luxury of waiting,” Atkin said. “France’s more forward-thinking approach reflects that, but 2035 still gives others a realistic window to complete what is a complex transition.”
The EU road map includes a milestone at the end of this year, when countries will need to have started transition planning and pilots for high- and medium-risk use cases. If compromising confidentiality would cause significant damage a decade down the line, the use case is high risk and the data should be protected by the end of 2030. “Note that the recommended deadline may in fact not always be sufficient and a national implementation plan should prioritize protecting the most critical assets,” the document notes.
By way of comparison, the U.K.’s National Cyber Security Centre last year recommended a timeline that also recommends to government – and the industry – a 2035 deadline for completing post-quantum cryptography migrations. It said planning should start in 2028 and the highest-priority migration activities should be completed by 2031. In the United States, federal agencies face a 2035 deadline for “mitigating as much of the quantum risk as is feasible” under a 2022 directive signed by then-President Joe Biden.
French ministries have until the end of 2027 to figure out which technical building blocks to use – but it is likely that they will opt for the algorithms being standardized by the U.S. National Institute of Standards and Technology.
With the exception of China, governments appear to be converging ML-KEM key-encapsulation mechanism, whose development was partly funded by the EU, and which is contained in NIST’s FIPS 203 standard. It is also sometimes known by its original name, Kyber. NIST has also selected a backup algorithm called HQC, which uses a different but also quantum-resistant problem, but that algorithm has not yet been included in a standards draft.
The three digital-signature algorithms that NIST chose are ML-DSA and SLH-DSA – described in the FIPS 204 and FIPS 205 Fstandards, respectively – and FN-DSA, which is on its way to becoming FIPS 206.
In its February guidance, Germany’s BIS said ML-KEM and rival quantum-ready mechanisms FrodoKEM and Classic McEliece were all suitable for protecting confidential information. It said the same recommendation would probably apply to HQC, once NIST completes its standardization of that backup algorithm.
Juniper recommends that organizations deploy a hybrid of classical cryptographic and post-quantum cryptography algorithms in the near term. It says use both because the quantum-safe algorithms may be vulnerable in ways that classical algorithms such as RSA are not, and because it mitigates the potential fallout from an early, experimental implementation going wrong.
The European Telecommunications Standards Institute published two transition-minded standards last year that cover quantum-safe hybrid key establishment and exchange, with the promise of “empowering organizations to safeguard their sensitive data both for today and for the decades ahead.” The documents reference FIPS 203.
The EU road map estimates the migration period at between five and 10 years, and says it is “highly recommended to ensure that products entering the market with an expected lifetime beyond 2030 should be upgradable.” Atkin told ISMG on Tuesday that the transition would be “a significant lift, mainly because cryptography sits so deep in modern systems.”
“You’re not just swapping out one tool. You’re touching everything from devices and networks to certificates and APIs,” Atkin said. “For a lot of organizations, the biggest challenge is simply understanding where cryptography is used in the first place. Most transitions will happen gradually, using hybrid approaches and prioritizing the most critical systems first.”
Atkin also warned that, while it is certainly possible to prepare for the post-quantum era, some unknowns remain, “especially around timelines and which standards will ultimately dominate.”
“The real focus isn’t on getting it perfect today; it’s on being flexible. And organizations that build in flexibility now will be in a much stronger position to adapt as the technology and threat landscape evolve,” Atkin said.