up:: For Policymakers MOC

What is technically happening to national systems?

Three things distinguish the national picture from the corporate one, and each has a technical cause rather than a political one.

Classified material is inside its own exposure window. Diplomatic and defense traffic carries confidentiality requirements measured in decades, and material recorded today is meant to stay secret well past the point where the machine to open it plausibly exists.

National trust anchors fail differently from data. A passport chip, a national identity credential, or a government certificate authority proves that something is genuine. When that proof becomes forgeable, the failure is immediate and system-wide rather than retroactive and gradual.

Allies are choosing different algorithms. The United States accepts the new algorithms deployed on their own. France and Germany want them paired with the old ones. That’s a defensible technical disagreement, and it produces systems that have to be deliberately engineered to talk to each other.

The short version:

• One half of cryptography fails and the other survives. Public-key mathematics breaks; the scrambling itself holds with larger keys.
• Classification horizons run 25, 50, and 75 years, which places today’s traffic squarely inside the exposure window.
• The forgery half arrives all at once, on the day a capable machine exists, with no warning and no staging.
• Collection leaves no trace, which removes detection, attribution, and any event a disclosure law would recognize.
• Allied algorithm choices already differ, on parameter strength and on whether to pair old with new.
• Estimates have moved sharply, from 20 million noisy qubits in 2019 to under 1 million in 2025, which is a moving planning input rather than a countdown.

What exactly breaks, technically?

Public-key cryptography rests on 2 problems that are slow for conventional computers: factoring a very large number into its primes, and the discrete logarithm. That slowness is the security. In 1994 Peter Shor published a method letting a quantum computer solve both efficiently, which recovers a private key directly from its matching public key.

Source: Peter W. Shor, “Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer,” SIAM Journal on Computing 26(5), 1997, arXiv:quant-ph/9508027.

Symmetric encryption and hashing contain no such structure. The only quantum attack against them is a general search speedup that roughly halves effective strength, and NIST’s position is that this “does not render cryptographic technologies obsolete,” and that “doubling the key size will be sufficient to preserve security.”

Source: NIST, “Report on Post-Quantum Cryptography,” NISTIR 8105, April 2016, csrc.nist.gov.

Two facts from that asymmetry shape national policy directly:

1. The migration is overwhelmingly a public-key migration. Legislation or guidance aimed at “replacing encryption” is aimed too broadly, and the narrower target is key establishment and digital signatures.
2. Elliptic-curve cryptography falls to a smaller machine than RSA at comparable classical strength, because it needs fewer error-corrected qubits. Systems modernized toward elliptic curve moved toward the earlier failure rather than away from it.

Source: Martin Roetteler, Michael Naehrig, Krysta M. Svore, Kristin Lauter, “Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms,” ASIACRYPT 2017, arXiv:1706.06752.

Why does classified material sit inside its own exposure window?

Because the government sets the confidentiality lifetime in writing, and it’s longer than the machine’s plausible arrival.

Under the U.S. classification framework, information is marked for declassification at 25 years, extendable to 50 years for material that would identify a confidential human source or reveal weapons-of-mass-destruction design, and to 75 years for a narrow category beyond that. Those numbers are a formal statement that the material still causes damage if disclosed on that horizon.

Source: Executive Order 13526, “Classified National Security Information,” §§ 3.3(a), 3.3(h), December 29, 2009, archives.gov.

Set that against a machine plausibly arriving inside 10 to 15 years, and traffic protected today under the old key exchange is inside its own window by a wide margin. This is the reasoning behind every national deadline in the field, and it doesn’t depend on predicting the machine’s arrival precisely. It depends on the classification period, which is already decided.

There’s a documented precedent for exactly this pattern at national scale. Starting in 1943, American codebreakers intercepted and stored Soviet cables protected by one-time pads, which are unbreakable when used correctly and were genuinely unreadable at the time. Wartime pressure caused pad pages to be duplicated, and from around 1946 the Venona project began reading the stored backlog. The work ran for decades, and the project didn’t formally close until 1980.

Source: NSA, “Venona” historical release, nsa.gov.

Why do national trust anchors fail differently from data?

Because they prove authenticity rather than protect secrecy, and authenticity fails forward.

A government runs a small number of cryptographic keys that everything else depends on: the authority behind government website certificates, the key that signs passport chips, the credential behind a national identity scheme, the key that signs software and firmware updates for public systems. Every one of those is a private key whose matching public key is published by design.

When a machine can recover a private key from a public one, an attacker mints credentials that verify as genuine, with no defect any inspection can detect. There’s nothing to record in advance, because the raw material was already public, and there’s no partial failure. It works on the day the machine works.

This has happened once without any quantum computer. In 2011 a Dutch certificate authority was breached, and the attacker issued at least 531 fraudulent certificates, using 1 of them to intercept the email of roughly 300,000 people in Iran. The certificates were mathematically valid, and every browser that saw them displayed a padlock.

Source: Fox-IT, “Black Tulip: Report of the investigation into the DigiNotar Certificate Authority breach,” 2012, Fox-IT Black Tulip report, hosted by ENISA.

National system	What the cryptography proves	What forgery would mean
Government certificate authority	This site or service genuinely belongs to the government	Credible impersonation of any public service
Passport and travel documents	This chip was issued by this country	Documents that verify at a border
National identity credentials	This person is who the credential says	Fraudulent authentication to public services
Software and firmware signing	This update came from the authorized source	Malicious updates accepted as genuine by public infrastructure
Command authentication in infrastructure	This instruction came from the control room	Instructions that operate equipment and verify correctly

The last row is why the infrastructure sector is treated separately, and it’s covered at What critical infrastructure is exposed.

Why is nobody detecting the collection?

Because there’s nothing to detect. Copying traffic off a network path is passive: it enters no system, alters nothing, and leaves no artifact on either endpoint. Storage costs a fraction of a cent per gigabyte per month, so the economics permit collecting broadly and sorting later.

Three agencies stated the concern jointly in August 2023, writing that attackers “could be targeting data today that would still require protection in the future… using a catch now, break later or harvest now, decrypt later operation.”

Source: CISA, NSA, and NIST, “Quantum-Readiness: Migration to Post-Quantum Cryptography,” August 21, 2023, CSI factsheet.

Three policy consequences follow directly from the absence of a detectable event:

1. No disclosure duty is triggered. Breach notification statutes turn on unauthorized acquisition being discovered, and there’s nothing to discover. See What is not legislated yet.
2. Attribution is unavailable. No party can be named and proven for any specific dataset, which removes the usual basis for a diplomatic or legal response.
3. There’s no incident to respond to, and no incident to point at when asking for a budget. This is the structural reason the work competes badly for funding against visible threats.

Why does it matter that allies chose different algorithms?

Because interoperability between allied systems depends on both sides supporting a common configuration, and the current national positions differ on 2 axes.

Whether to pair old with new. France and Germany treat the pairing of a proven classical algorithm with a post-quantum one as a standing requirement, so that the combination is never weaker than the classical algorithm alone, and France applies it to signatures as well as key establishment. The United States accepts the new algorithms deployed on their own, on a published schedule. Both positions are defensible: the first hedges against a flaw being found in young algorithms, the second avoids carrying 2 systems indefinitely.

Which strength to require. The U.S. national security suite requires the strongest parameter set of each algorithm, while the U.K.’s guidance recommends a middle parameter set for general use. Systems built to those 2 recommendations don’t automatically negotiate a common configuration.

Source: ANSSI, “ANSSI views on the Post-Quantum Cryptography transition,” cyber.gouv.fr; BSI, Technical Guideline TR-02102-1, bsi.bund.de; NSA, “CNSA 2.0 FAQ,” media.defense.gov; NCSC, “Timelines for migration to post-quantum cryptography,” March 20, 2025, ncsc.gov.uk.

The practical consequence is that a single global configuration satisfies no one automatically. Coalition communications, shared intelligence systems, and joint procurement all need the compatibility question answered deliberately, and the window to answer it cheaply is while systems are being specified rather than after they’re fielded. See Is anyone coordinating this internationally.

Which national systems are hardest, and why?

Ranked by how little can be done after deployment.

1. Satellites and space systems. Hardware that physically can’t be reached after launch, with command links protected by cryptography fixed at manufacture. A satellite launched today with a 15-year design life carries whatever it launched with.
2. Industrial and military equipment with fixed firmware. Field lifetimes measured in decades, cryptography embedded in hardware, and safety certification that makes any change a re-certification event.
3. Archived classified material. Already collected by whoever collected it, so nothing can change its exposure retroactively. The only remaining lever is what happens to traffic from here forward.
4. National trust anchors. Technically replaceable, and replacing a root of trust means updating every system and device that trusts it, which is a multi-year coordination problem rather than a technical one.
5. Ordinary government IT. The tractable majority, where migration is library updates, configuration, and testing.

Questions people ask

Does a quantum computer exist that can do this? No. Estimates of what it would take have moved sharply, from 20 million noisy qubits in a 2019 analysis to under 1 million in a 2025 revision, and the largest machines built so far are in the low thousands of noisy qubits. The direction of that movement is the reason the deadlines exist.

Source: C. Gidney and M. Ekerå, “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits,” Quantum 5, 433, 2021, arxiv.org; C. Gidney, “How to factor 2048 bit RSA integers with less than a million noisy qubits,” 2025, arxiv.org.

Are air-gapped classified networks safe? From the collection half, substantially yes, since traffic that never crosses a collectible path can’t be recorded. From the forgery half, less so, because those networks still verify software updates and credentials using the same mathematics.

Does quantum key distribution solve this? It addresses key exchange over a dedicated physical link, and it addresses none of the signature and authentication half, which is the larger share of a government estate. Several national authorities have declined to recommend it as a general replacement.

Can we simply keep the old systems and accept the risk? For short-lived material, that’s a legitimate call worth making explicitly. For material inside a 25-year classification horizon, accepting the risk means accepting eventual disclosure.

Why is this described as urgent when the machine doesn’t exist? Because the collection is present-tense and the migration takes years. The urgency comes from the confidentiality lifetime plus the migration duration, rather than from the machine’s arrival date.

What does a government control that a company doesn’t? Procurement, certification, and the standards its own systems are built to. Those 3 levers reach the market faster than legislation does. See What should a government actually do.

Where to go next

• What critical infrastructure is exposed covers the operational-technology sector in depth.
• What should a government actually do covers the 12 available measures.
• What are other countries doing compares the national positions.
• What does history tell us about broken codes covers the precedent record.
• For Policymakers MOC is the full legislative route.

Go deeper into the technical detail

The technical layer: Shor’s Algorithm, Forge-Later Attack, PKI Collapse, PQC in Satellites and Space, QKD vs PQC, and Cryptographic Interoperability.

These open the Post-Quantum Field Guide, a separate site written for security professionals.

---

Last verified 2026-07-30 · Maintained by Addie LaMarr, LaMarr Labs.