Post-Quantum Cryptography: Enterprises Must Shift Encryption Now

When the board asks whether quantum computers pose a risk to encryption, the honest answer is: yes, and not just twenty years from now. Since August 2024, the American National Institute of Standards and Technology has finalized three post-quantum standards. BSI recommends completing migration by 2030 at the latest for critical infrastructure. And intelligence agencies are already collecting encrypted data today, ready to decrypt it once the technology matures.

Key Takeaways

• NIST finalized three post-quantum standards in August 2024: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures.
• Harvest Now, Decrypt Later describes a real threat: attackers are storing encrypted data today to decrypt it with future quantum computers.
• BSI sets the PQC migration deadline at 2030 for critical infrastructure and 2032 for all other organizations.
• Fewer than 5 percent of enterprises have a formal migration plan for quantum-safe cryptography in place.
• The new algorithms run on existing hardware. Migration requires no new equipment, only updated software and protocols.

Harvest Now, Decrypt Later: Why the Threat Starts Today

The strategy sounds simple, and that is exactly what makes it so dangerous: intelligence agencies and state-sponsored attackers are intercepting encrypted data streams today and storing them. Once a cryptographically relevant quantum computer becomes available, those archives will be decrypted. The method is called Harvest Now, Decrypt Later, and it affects every organization whose current data will still be sensitive in five, ten, or fifteen years.

That includes financial services firms with customer data and transaction histories. It includes companies with intellectual property that remains competitively relevant for years. It includes government agencies handling classified information. And it includes healthcare providers whose patient data requires protection without any time limit.

The question is not whether quantum computers will break today’s encryption. The question is when. The Global Risk Institute estimates in its Quantum Threat Timeline 2026 that a cryptographically relevant quantum computer is likely within ten years and very likely within fifteen. That means data encrypted today using RSA or elliptic curves could be decryptable within minutes by the early 2030s.

“The quantum age is no longer when, but now.”

BSI (Bundesamt fur Sicherheit in der Informationstechnik), PQC Migration Guidance

The Three NIST Standards: What Concretely Changes

On August 13, 2024, NIST published the first three finalized post-quantum cryptography standards. These are no longer drafts – they are production-ready Federal Information Processing Standards ready for immediate deployment.

In March 2025, NIST additionally selected the HQC algorithm (Hamming Quasi-Cyclic) as a backup for ML-KEM. The final standard is expected in 2027. This means two independent mathematical approaches for quantum-safe key exchange will soon exist: ML-KEM based on lattice structures, HQC on error-correcting codes. That diversity is critical. If a mathematical breakthrough were to compromise one approach, the other remains as a fallback.

One practical consideration: the key and signature sizes of the new algorithms are significantly larger than their classical predecessors. An ML-KEM-768 public key is approximately 1,184 bytes, compared to 32 bytes for ECDH. ML-DSA-65 signatures run around 3,309 bytes versus 64 bytes for ECDSA. This affects TLS handshakes, certificate chains, and IoT devices with limited bandwidth. The hybrid approach addresses this by preserving the performance baseline of the classical algorithm.

Timeline: The Roadmap to Quantum-Safe Encryption

What Migration Actually Means in Practice

The good news first: post-quantum algorithms run on existing hardware. No organization needs to replace servers or network equipment to deploy quantum-safe encryption. Migration affects software, libraries, protocols, and certificates.

The recommended starting point is the hybrid approach: existing classical algorithms run in parallel with post-quantum algorithms. If one fails, the other protects. Google Chrome and Cloudflare have been deploying hybrid TLS connections with ML-KEM since 2024. Signal has also transitioned its messaging encryption to hybrid PQC. Apple introduced iMessage PQ3, one of the first protocols to bring post-quantum security to billions of users.

For enterprises, hybrid mode is the safest migration path: it already protects against Harvest Now, Decrypt Later without breaking compatibility with existing systems. The Internet Engineering Task Force (IETF) has laid the technical groundwork for hybrid key agreement in TLS 1.3 through RFC 9370 and additional drafts. The major cryptography libraries including OpenSSL 3.x, BoringSSL, and liboqs already support the NIST algorithms.

Migrating a typical enterprise involves four phases: inventorying all cryptographic assets, risk assessment based on data lifespan, migration prioritization, and phased implementation. According to a study in the MDPI journal, migration takes five to seven years for small organizations, eight to twelve years for mid-sized ones, and twelve to fifteen years for large enterprises. The implication is clear: anyone who wants to be ready by 2032 must start now.

A joint study by BSI and KPMG found that the quantum computing threat to information security in Germany is widely underestimated. Fewer than 5 percent of organizations have a formal migration plan in place. Financial services, telecommunications, and the public sector are furthest along, but even there most organizations are still in the exploration phase.

The Case For and Against: Migrate Now or Wait?

The balance tips clearly: for organizations whose data has a lifespan of more than five years, the arguments for starting immediately outweigh those for waiting. The hybrid approach minimizes compatibility risk because classical encryption remains as a fallback. Anyone who delays until 2028 or 2029 will struggle to meet the BSI 2032 deadline.

One frequently overlooked consideration is crypto-agility. Many organizations have their cryptographic algorithms baked deep into application code, configuration files, and hardware security modules. Switching algorithms then requires changes across dozens of systems. Introducing an abstraction layer now that decouples the specific algorithm from application logic not only simplifies the PQC migration. It also prepares organizations for future algorithm changes, which are inevitable in a rapidly evolving cryptographic landscape.

For financial services and healthcare, a regulatory dimension adds further weight: the European Central Bank published a recommendation on PQC readiness for payment service providers in November 2025. DORA (Digital Operational Resilience Act) requires financial firms to maintain an up-to-date cryptography inventory. Framing PQC migration as part of DORA compliance makes it significantly easier to secure budget and management attention.

Checklist: The First 90 Days of PQC Migration

Month 1: Inventory and Risk Assessment

• Build a cryptographic inventory: which algorithms are used where?
• Classify data by protection duration: which data will still be sensitive in 10 or 15 years?
• Document VPN tunnels, TLS certificates, code signing, and S/MIME usage
• Audit third-party dependencies: which vendors use which cryptography?

Month 2: Prioritization and Piloting

• Highest-risk-first: migrate systems with long data lifespans first
• Test hybrid TLS mode: ML-KEM alongside ECDH in test environments
• Assess crypto-agility: can algorithms be swapped without code changes?
• Plan budget and resources for the multi-year migration effort

Month 3: Governance and Roadmap

• Document the PQC migration plan and get CISO sign-off
• Align milestones with BSI deadlines: 2030 for KRITIS, 2032 for all others
• Assign ownership: who drives migration for which systems?
• Establish a quarterly review cycle and track progress

Bottom Line: Migration Starts With the Inventory

Post-quantum cryptography is no longer a future topic. The standards are finalized, the deadlines are set, and the threat from Harvest Now, Decrypt Later is real. If you have not yet taken stock of your cryptographic assets, start this week. The first step requires no budget and no external consultant: list every place your organization uses RSA, ECDH, or ECDSA. For each system, assess how long the data it protects will remain sensitive. That exercise alone will show you how large the task is, where the priorities lie, and which systems to migrate first. The standards are here. The deadlines are set. What is missing is your first move.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.

What is post-quantum cryptography?

Post-quantum cryptography refers to cryptographic methods that remain secure even against attacks by quantum computers. The NIST-standardized algorithms ML-KEM, ML-DSA, and SLH-DSA are based on mathematical problems such as lattice structures and hash functions that, based on current knowledge, cannot be efficiently solved by quantum computers. These algorithms run on conventional hardware.

What does Harvest Now, Decrypt Later mean?

Harvest Now, Decrypt Later describes an attack strategy in which encrypted data is intercepted and stored today for decryption with quantum computers in the future. The threat affects all data that will remain sensitive for more than five to ten years. Intelligence agencies and state-sponsored actors are already practicing this strategy today.

By when must organizations transition to PQC?

BSI sets the deadline at 2030 for operators of critical infrastructure and 2032 for all other organizations. Since average migration duration is five to twelve years according to research, organizations should begin inventory and piloting now. Deploying classical and quantum-safe cryptography in hybrid mode is the recommended starting point.

Which algorithms does NIST recommend?

NIST recommends ML-KEM (FIPS 203) for key exchange as a replacement for RSA and ECDH, ML-DSA (FIPS 204) for digital signatures as a replacement for RSA and ECDSA signatures, and SLH-DSA (FIPS 205) as a conservative backup option for signatures. HQC has also been selected as a backup algorithm for key exchange, with its final standard expected in 2027.

Do I need to buy new hardware?

No. The new post-quantum algorithms run on existing hardware. Migration affects software libraries, protocol configurations, and certificates. That said, post-quantum keys and signatures are larger than their classical counterparts, which should be factored in for bandwidth-sensitive applications or embedded systems. Performance testing in your own environment is part of the piloting phase.