up:: For Press
The primary documents behind every claim
Every factual claim in this resource traces to a document below. Each row names the issuer, the date, and what that document actually establishes, so a claim can be checked against the original rather than against a summary of it.
Where a document is a draft, that’s stated. Where a figure inside it carries the issuer’s own uncertainty language, that’s stated too.
The short version:
- The U.S. schedule comes from 4 instruments, and their dates sit years apart from each other.
- The most-quoted date, 2035, comes from the softest document, a policy goal with “as is feasible” written into the sentence.
- The retirement schedule is still a draft, so its years are stated intent rather than settled rule.
- Seven countries or blocs have published their own timelines, and they differ on strategy as well as on dates.
- The mathematics rests on 1 paper from 1994, and the hardware estimates on 2 papers 6 years apart.
- The precedent record is documentary, drawn from court opinions, regulator settlements, and incident investigations rather than from analysis.
Which documents set the United States schedule?
| Document | Issuer, date | What it establishes |
|---|---|---|
| National Security Memorandum 10 | The White House, May 4, 2022 | The whole-of-government goal of mitigating quantum risk “as is feasible” by 2035. The hedge is in the operative sentence, which is why this is the softest of the 4. bidenwhitehouse.archives.gov |
| Memorandum M-23-02 | Office of Management and Budget, November 18, 2022 | Requires federal civilian agencies to submit a prioritized, algorithm-level cryptographic inventory annually, first due May 2023, and reaches contractor-operated systems. whitehouse.gov |
| Report on Post-Quantum Cryptography | Office of Management and Budget, report to Congress, July 2024 | The **7.1 billion in 2024 dollars.” National security systems are outside the report’s scope. It calls the number an initial projection reflecting “a high, but expected, level of uncertainty.” bidenwhitehouse.archives.gov |
| Executive Order 14412 | The White House, June 22, 2026 | Federal civilian High Value Assets and high impact systems migrated for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. The scope qualifier is load-bearing: §4(b)(ii) and §4(b)(iii) reach HVAs and high impact systems, not every federal civilian system. whitehouse.gov |
| The CNSA 2.0 and Quantum Computing FAQ | National Security Agency, cybersecurity information sheet, December 2024 Ver. 2.1 | Every substantive CNSA 2.0 claim in this resource comes from the FAQ, which restates the CNSSP 15 schedule: by January 1, 2027 all new national security system acquisitions are required to be CNSA 2.0 compliant, by December 31, 2030 all equipment and services that cannot support CNSA 2.0 must be phased out, and by December 31, 2031 CNSA 2.0 algorithms are mandated for use. Each of the 3 carries “unless otherwise noted,” and CNSSP 15 rather than the FAQ is the binding instrument. Keeps AES and directs “Use 256-bit keys for all classification levels.” FAQ · the September 7, 2022 announcement carries the release itself and names no algorithm or date |
| NIST IR 8547 | NIST, initial public draft, November 2024 | The retirement schedule: 112-bit RSA and elliptic-curve deprecated after 2030, all classical public-key disallowed after 2035. A draft, so the years are NIST’s stated intent. csrc.nist.gov |
| Quantum-Readiness joint factsheet | CISA, NSA, and NIST, August 21, 2023 | The government’s own statement that attackers “could be targeting data today that would still require protection in the future… using a catch now, break later or harvest now, decrypt later operation.” Also the source of the inventory-first sequence. cisa.gov · factsheet PDF |
| NSPM-12 | The White House, June 12, 2026 | Rewrites cybersecurity governance for national security systems, rescinding NSD-42 (1990) and NSM-8 (2022), and naming CNSSP 15 as the commercial cryptographic standard for those systems. Contains no explicit mention of post-quantum cryptography and sets no migration date. whitehouse.gov |
| Executive Order 13526 | The White House, December 29, 2009 | The classification clock. §1.5(b) marks material for declassification at 10 years, or up to 25 where the classifying authority determines the sensitivity requires it; §3.3 declassifies automatically at 25 years, with exemption paths running to 50 and 75, and 75 requiring approval by the Interagency Security Classification Appeals Panel. The document that puts today’s classified traffic inside its own exposure window. archives.gov |
Which documents are the standards themselves?
| Document | Issuer, date | What it establishes |
|---|---|---|
| FIPS 203, 204, and 205 | NIST, August 13, 2024 | The first 3 finalized post-quantum standards: ML-KEM for key establishment, ML-DSA and SLH-DSA for signatures. This is the date that ends “the standards aren’t ready.” nist.gov |
| HQC selection | NIST, March 2025 | A fifth algorithm selected as a backup key-establishment mechanism, built on error-correcting codes rather than the structured lattices behind ML-KEM. A selection rather than a finished standard: NIST planned a draft “for public comment in about a year” and a final standard in 2027. nist.gov |
| NISTIR 8105 | NIST, April 2016 | The authority for what survives: Grover’s algorithm “does not render cryptographic technologies obsolete,” and “doubling the key size will be sufficient to preserve security.” csrc.nist.gov |
| SP 800-63B-4 | NIST, July 2025 | The federal digital identity guidance behind password practice, including the rule that verifiers “SHALL store passwords in a form that is resistant to offline attacks.” Revision 3 carries its own withdrawal notice, “This revision of NIST SP 800-63 has been superseded by NIST SP 800-63-4 as of August 1, 2025,” so cite this edition. csrc.nist.gov · revision 3’s notice |
Which documents set the international schedules?
| Document | Issuer, date | What it establishes |
|---|---|---|
| Cyber Resilience Act, Reg (EU) 2024/2847 | European Union | Binds any manufacturer worldwide placing a connected product on the EU market. Reporting obligations from September 11, 2026, full obligations from December 11, 2027. Names no algorithm and sets no post-quantum date. Art. 64(2) sets the top penalty tier at up to 15 million euro or 2.5% of total worldwide annual turnover, whichever is higher, with lower tiers at Art. 64(3) and 64(4). The Commission summary carries the scope and the dates and states no fine amounts. eur-lex.europa.eu · Commission summary |
| Coordinated Implementation Roadmap | EU Member States through the NIS Cooperation Group, supported by the European Commission, June 2025 | Where the EU’s actual post-quantum dates live: start by end of 2026, high-risk use cases by end of 2030, complete by end of 2035. The first deliverable of the post-quantum work stream the Commission recommended in April 2024, carrying “a set of recommendations that Member States need to implement” rather than a binding obligation. digital-strategy.ec.europa.eu |
| Timelines for migration to PQC | UK NCSC, March 20, 2025 | Discovery and plan by 2028, highest-priority migrations by 2031, all systems by 2035. Advisory, and used by UK buyers as a vendor expectation. ncsc.gov.uk |
| Guidelines for cryptography, Information Security Manual | Australian Signals Directorate | The most aggressive national schedule: traditional public-key cryptography out by the end of 2030, 5 years ahead of most peers. cyber.gov.au |
| Implementation of Quantum Safe Ecosystem in India | Department of Science and Technology, Government of India, report of the task force, February 4, 2026 | India’s national roadmap, published as “Recommendations of the Task Force” rather than as a government mandate. Phased milestones for critical information infrastructure: foundations by 2027, high-priority migration by 2028, full adoption by 2029. Enterprises: 2028, 2030, 2033. Milestone 1 has adopting organizations “mandate CBOM submissions from vendors” starting FY 2027-28, and Milestone 2 has them enforce “no new classical-only deployments.” dst.gov.in |
| ITSM.40.001 | Canadian Centre for Cyber Security, June 23, 2025 | Departmental plans by April 2026, high-priority systems by end of 2031, remainder by end of 2035. cyber.gc.ca |
| Technical Guideline TR-02102-1 | German BSI, version 2026-01 | Germany’s position: hybrid deployment for long-term confidentiality, and the most conservative classical sizing of the major authorities. bsi.bund.de |
| ANSSI views on the PQC transition | French ANSSI, January 4, 2022 | France’s position: hybrid-first as a standing rule with no security regression, applied to signatures as well as key establishment. The staging runs in 3 phases tied to French security visas, phase 1 being the situation at publication, “Phase 2 (not earlier than 2025)” adding claimed quantum resistance while hybridization stays mandatory, and “Phase 3 (probably not earlier than 2030): optional standalone post-quantum cryptography.” cyber.gouv.fr |
Which papers underpin the technical claims?
| Paper | Author, date | What it establishes |
|---|---|---|
| Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer | Peter W. Shor, presented 1994, journal version SIAM J. Computing 26(5), 1997 | The single paper the entire subject rests on. Never overturned. arxiv.org |
| How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits | Craig Gidney and Martin Ekerå, Quantum 5, 433, 2021 | The 2019 resource estimate, and the earlier of the 2 numbers in the widely cited collapse. arxiv.org |
| How to factor 2048 bit RSA integers with less than a million noisy qubits | Craig Gidney, 2025 | The revised estimate, roughly a 20-fold reduction in qubits over 6 years, at a runtime that rises from 8 hours to “less than a week.” Gidney makes “the same assumptions as in 2019” about the hardware, so the pair is the strongest available evidence on methods rather than on hardware trajectory. arxiv.org |
| Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms | Roetteler, Naehrig, Svore, and Lauter, ASIACRYPT 2017 | Why elliptic-curve cryptography falls to a smaller machine than RSA, which runs against most people’s intuition. arxiv.org |
| Quantum Threat Timeline Report 2025 | Michele Mosca and Marco Piani of evolutionQ Inc., for the Global Risk Institute | The expert survey behind every probability range quoted in this field: 28% to 49% within 10 years, 51% to 70% within 15, from 26 specialists. Both authors work for a commercial post-quantum vendor, which belongs alongside the figure. globalriskinstitute.org |
| How Quantum Computers Fail | Gil Kalai, June 2011 | The most credible standing argument that a fault-tolerant quantum computer may never be built. The strongest version of the skeptic case. arxiv.org |
| Identity inference of genomic data using long-range familial searches | Erlich, Shor, Pe’er, and Carmi, Science 362(6415), November 2018 | The ~60% familial-match figure: the authors project that a genealogy-database search for a person of European descent in the U.S. returns a third cousin or closer. It is a projection rather than a measured rate, and the authors state it that way. science.org |
| Operationalising Post-Quantum TLS | Balaji et al., 2026 | An analysis of Nginx TLS configurations published to public GitHub repositories, finding 28.9% specifying an RSA key exchange with no forward secrecy. Read the qualifiers before quoting it: the corpus is 8,443 configuration files rather than a scan of live servers, the 28.9% is a share of the 5,982 TLS-enabled server-block contexts that “form the core dataset for all subsequent analysis” rather than of the 8,443 files, 42.6% of those contexts use “likely non-production hostnames,” 2,919 of the files come from archived repositories, and the authors include a commercial post-quantum vendor and the bank that funded the study and hosted its deployment. arxiv.org |
| Quantum computers and the Bitcoin blockchain | Itan Barmes, Bram Bosch, and Olaf Haalstra, Deloitte | Over 4 million BTC in addresses with exposed public keys: “there are still over 4 million BTC (about 25% of all Bitcoins) which are potentially vulnerable to a quantum attack.” Its components are circa 2M in p2pk addresses that have never moved, plus 2.5M in reused p2pkh. The 25% is the share at the time of Deloitte’s analysis rather than a current one, and the page carries no publication date. deloitte.com |
Which documents make up the precedent record?
Every historical parallel in this resource is drawn from an investigation, a court record, or a regulator’s own account rather than from commentary.
| Document | Issuer, date | What it establishes |
|---|---|---|
| Venona historical release | National Security Agency | Cables intercepted from 1943 and stored unreadable, read from around 1946 onward, with the project running until 1980. The documented precedent for collecting now and decrypting later. nsa.gov |
| APT1: Exposing One of China’s Cyber Espionage Units | Mandiant, February 19, 2013 | Intellectual property taken from at least 141 organizations across 20 major industries, hundreds of terabytes, when each intrusion still had to be worked by hand. services.google.com |
| ”Operation Black Tulip: Certificate authorities lose authority” | ENISA, position paper on the Fox-IT investigation into the 2011 DigiNotar breach | ”In the attack false certificates were created for hundreds of websites, including Google and Skype,” and Fox-IT’s investigation suggests that for almost 2 months they were used to eavesdrop on email and web browsing in Iran. DigiNotar’s logs showed 300,000 OCSP requests from Iranian IP addresses, which ENISA calls “only an indication” rather than a victim count. What a forged trust anchor does in practice, with no quantum computer involved. The often-quoted figure of 531 fraudulent certificates is not in this paper: it comes from Fox-IT’s own report, which this resource has not been able to obtain, so treat it as resting on a document nobody here has read. enisa.europa.eu |
| Equifax settlement announcement | Federal Trade Commission, July 22, 2019 | 147 million people exposed, at least $575 million in settlement. The FTC describes the stolen data as taken “mostly from consumers who had purchased products from Equifax such as credit scores, credit monitoring, or identity theft prevention services.” ftc.gov |
| Merck & Co. v. ACE American Insurance | N.J. Superior Court, Appellate Division, opinion approved for publication May 1, 2023 | A hostile-or-warlike-action exclusion held not to reach the NotPetya attack on a non-military company. Merck’s all-risks property program ran in 3 layers with “150 million deductible,” and the 8 insurers left in the case “disputed about $700 million in coverage or just under 40% of Merck’s total coverage for the policy period.” The parties settled confidentially in January 2024. The opinion sits behind a host that refuses automated retrieval, so those figures come from the settlement report rather than from the opinion. njcourts.gov · settlement report |
| Travelers v. International Control Services | C.D. Ill., stipulation filed August 26, 2022 | The insurer and the insured jointly asked the court to rescind a cyber policy and declare it “null and void, from its inception,” after Travelers said the insured had misrepresented its use of multi-factor authentication on the application. They then “entered an order to dismiss with prejudice,” so no court ruled on the merits. insurancejournal.com |
| Market Bulletin Y5381 | Lloyd’s of London, August 16, 2022 | State backed cyber-attack exclusions required in “all standalone cyber-attack policies falling within risk codes CY and CZ,” from March 31, 2023 “at the inception or on renewal of each policy,” rather than across the whole market at once. lloyds.com |
| 23andMe settlement and consumer alerts | Texas Attorney General; California Attorney General | 6.9 million people exposed from 14,000 compromised accounts, a state consumer alert dated March 21, 2025, bankruptcy days later, and the company later sued as “Chrome Holding Co., formerly known as 23andMe.” Texas AG · California AG alert · California AG suit |
| Y2K spending report | U.S. Senate Special Committee, S. Prt. 106-42 | The ~8.5 billion was federal, in the Committee’s own summary sentence. Its costs section attributes the 8.34 billion, and it carries competing U.S. totals of 150 to $225 billion from Gartner. The anchor for every Y2K comparison. govinfo.gov |
Which documents are argument rather than record?
Three sources that carry weight in this debate and are analysis, projection, or a record of what people said, rather than findings of fact. Each is worth citing, and each needs its nature stated alongside it.
| Document | Author, date | What it is, and what to attach to it |
|---|---|---|
| ”The Coming Quantum National Security Crisis” | Anne Neuberger, Foreign Affairs, June 2026 | The highest-profile recent policy essay on the subject, by a former U.S. Deputy National Security Adviser (2021 to 2025) who is now General Partner and Head of Global Affairs at the venture firm a16z. It argues China and Russia are already collecting encrypted data to decrypt later. The essay attributes the harvesting to “reports from U.S. intelligence agencies” rather than to any public document, so a reader cannot check it, and it names China and Russia specifically without attribution. Cite it as a named argument by a former senior official rather than as an established finding. foreignaffairs.com |
| ”Quantum Computing On Track to Create Up to $850 Billion of Economic Value By 2040” | Boston Consulting Group, July 18, 2024 | The source of the 850 billion economic-value figure, sustaining a projected 170 billion market for hardware and software providers. A consultancy projection to 2040, so attribute it and label it a forecast. bcg.com |
| The Report: Quantum USA 2026 | Forum Global, Washington D.C., June 18, 2026 | A record of what was said at a named conference, with named attribution and commercial interests carried inline. Useful for attributable positions from NIST, industry, and vendors. Its publisher states plainly that third-party figures, projections, intelligence-community characterizations, and vendor claims belong to the sources who advanced them and are not findings. Treat every number inside it as a claim by its named speaker. |
The pattern across all 3: they’re citable and they’re arguments. A projection restated as a measurement, or a vendor’s Q-Day estimate restated as a consensus timeline, is the most common way an otherwise careful piece goes wrong. See What gets reported wrong.
Which documents cover deployment and market reality?
| Document | Issuer | What it establishes |
|---|---|---|
| PQXDH specification | Signal, revision 3, 2023 | The key-agreement protocol that adds post-quantum forward secrecy to Signal’s existing X3DH handshake by layering a post-quantum key encapsulation mechanism over the elliptic-curve exchange. A protocol specification rather than a record of what shipped when. signal.org |
| iMessage with PQ3 | Apple, February 2024 | Post-quantum protection deployed to iMessage. security.apple.com |
| A new path for Kyber on the web | Google, September 2024 | Chrome’s switch from hybrid Kyber to hybrid ML-KEM in Chrome 131. Chrome only: the post names no other browser, so Edge needs the Microsoft Edge release notes instead. security.googleblog.com |
| Firefox 132 release notes | Mozilla, October 29, 2024 | ”Added support for a post-quantum key exchange mechanism for TLS 1.3 (mlkem768x25519) which secures communications against advanced / long-term threats.” This is where Firefox shipped it, and the release note says “Added support for” rather than enabled by default. Firefox 135, February 2025, only extended the same mechanism to HTTP/3, so it is not the date Firefox first shipped ML-KEM. firefox.com |
| Post-quantum adoption dashboard | Cloudflare Radar | Live measurement of how much of the traffic crossing Cloudflare’s own network uses post-quantum key exchange. It measures one network rather than the internet as a whole, and the figure moves, so cite the dashboard rather than pinning a percentage. radar.cloudflare.com |
| Measuring digital development: Facts and Figures 2025 | International Telecommunication Union | ”almost three-quarters of the world’s population are now online,” and “2.2 billion people remain offline,” most of them in low and middle income countries. The landing page carries the headline finding rather than the underlying counts, so a stated percentage or population total needs the publication itself. itu.int |
| Report on the Cybersecurity Insurance Market | NAIC, 2025 report on 2024 data | U.S. cyber direct written premium of roughly $9.14 billion in 2024, down about 7%, its first annual contraction. naic.org |
| Minimum Elements For a Software Bill of Materials | NTIA, July 12, 2021 | The U.S. definition of a software bill of materials, the mechanism that makes vendor-supplied cryptography checkable. ntia.gov |
| Shared Responsibility Model | AWS | Where the cloud provider’s responsibility ends and the customer’s begins: AWS carries “Security of the Cloud” and the customer carries “Security in the Cloud,” which for abstracted services means “managing their data (including encryption options), classifying their assets, and using IAM tools to apply the appropriate permissions.” Scoped to AWS, so it does not establish how any other provider draws the line. aws.amazon.com |
| Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions | U.S. Food and Drug Administration, final guidance, February 2026 | FDA’s “recommendations to industry regarding cybersecurity device design, labeling, and the documentation that FDA recommends be included in premarket submissions for devices with cybersecurity risk.” The binding obligation sits in section 524B of the FD&C Act, which the guidance addresses rather than creates. It supersedes the June 27, 2025 edition of the same guidance. fda.gov |
| Privacy in Genomics | National Human Genome Research Institute | The federal position on genomic privacy. genome.gov |
| Retention rules | 45 CFR § 164.316; 17 CFR § 240.17a-4 | The retention periods that set data confidentiality lifetimes by law. § 164.316 is titled “Policies and procedures and documentation requirements” and holds HIPAA compliance documentation for 6 years; HIPAA sets no retention period for medical records themselves, which are governed by state law. § 240.17a-4 sets the securities records periods, “not less than 6 years” for some categories and 3 for others. 45 CFR 164.316 · 17 CFR 240.17a-4 |
| Finding the Right Loan | Freddie Mac | The 30-year fixed-rate mortgage is “the product of choice for nearly 90% of homebuyers,” which is one document set that stays live for 3 decades. That is the share choosing at origination rather than the share currently holding one. myhome.freddiemac.com |
Questions people ask
Which single document should I read first? The CISA, NSA, and NIST joint factsheet from August 2023. It’s short, it’s signed by 3 agencies, and it contains the government’s own statement of the harvesting concern.
Which numbers here are drafts or estimates rather than settled facts? Three: the NIST IR 8547 retirement years sit in an initial public draft, the $7.1 billion is ONCD’s projection carrying the report’s own uncertainty language, and the Global Risk Institute probabilities are an expert survey rather than a measurement.
Which figures change over time? Post-quantum adoption moves continuously, so the Cloudflare dashboard should be cited rather than a pinned percentage, and read it as a measurement of Cloudflare’s own network. Hardware qubit records also move, which is why the resource estimates matter more than any machine’s specification.
Are any of these behind a paywall or otherwise out of reach? Three: the Science paper on familial matching, the New Jersey appellate opinion in the Merck case, and the Fox-IT Black Tulip report, which is why the DigiNotar and Merck rows above say which figures rest on a document this resource has not read. Every other government document, standard, and arXiv paper listed here is freely accessible.
Why does the 1994 date appear alongside a 1997 citation? Shor presented the algorithm in 1994, and the peer-reviewed journal version appeared in SIAM Journal on Computing in 1997. Both dates are correct for different things.
Is anything important missing from this list? Two categories, deliberately. Vendor white papers and market-forecast reports are excluded, because commercial interest sits behind the numbers. And no classified or non-public material is cited anywhere in this resource.
How current is this? Each page in this resource carries its own last-verified date in the byline, and the schedules move as drafts finalize.
Where to go next
- Every figure and where it comes from is the same material sorted by number rather than by document.
- Corrections and verification is how to report an error or verify a claim before publishing.
- What gets reported wrong covers the recurring errors and the accurate version of each.
- A glossary of the terms you will meet defines the vocabulary.
- For Press is the full index.
Last verified 2026-09-17 · Maintained by Addie LaMarr, LaMarr Labs.