The computation power of quantum computers introduces new security threats in Public Key Infrastructure (PKI), a system used by many governments to secure their digital public services and communication. This calls for an inevitable need for governments to be quantum-safe (QS) by modifying their PKI systems to be resistant to the attacks of quantum computers. However, there is limited academic literature on a QS PKI system, and in this limited literature, the transition challenges are perceived as exclusively technological. This paper aims to create a structured overview of challenges when transitioning to a QS PKI system. We do this by reviewing literature and classifying the challenges using Technology-Organization-Environment (TOE) framework and using an expert workshop to explore the challenges in the context of the PKI system in the Dutch government. The main challenges in the technological context include no universal QS solution, legacy system, complex PKI interoperability, and vulnerable Root CA. The main challenges in the organizational context include knowledge gap, unclear governance, lack of urgency, and in-house management support. Furthermore, the main challenges in the environmental context include institutional void, stakeholder collaboration, lack of awareness, and policy guidance. The results indicate that the QS transition from the current PKI system is complex, and the challenges are socio-technical. For policy-makers, this implies that they should start early to prepare, whereas organizations are hardly aware of the process of QS transition and the topic of quantum computing is yet to develop the urgency in organizations.
The computation power of quantum computers introduces new security threats in Public Key Infrastructure (PKI), a system used by many governments to secure their digital public services and communication. This calls for an inevitable need for governments to be quantum-safe (QS) by modifying their PKI systems to be resistant to the attacks of quantum computers. However, there is limited academic literature on a QS PKI system, and in this limited literature, the transition challenges are perceived as exclusively technological. This paper aims to create a structured overview of challenges when transitioning to a QS PKI system. We do this by reviewing literature and classifying the challenges using Technology-Organization-Environment (TOE) framework and using an expert workshop to explore the challenges in the context of the PKI system in the Dutch government. The main challenges in the technological context include no universal QS solution, legacy system, complex PKI interoperability, and vulnerable Root CA. The main challenges in the organizational context include knowledge gap, unclear governance, lack of urgency, and in-house management support. Furthermore, the main challenges in the environmental context include institutional void, stakeholder collaboration, lack of awareness, and policy guidance. The results indicate that the QS transition from the current PKI system is complex, and the challenges are socio-technical. For policy-makers, this implies that they should start early to prepare, whereas organizations are hardly aware of the process of QS transition and the topic of quantum computing is yet to develop the urgency in organizations.
Public Key Infrastructures (PKIs) provide digital public services and communication by securing information-sharing and strong credentials for digital identity management to individuals, businesses, and government agencies. While cryptographic algorithms that current PKI systems depend on are mostly resilient against hacks and other threats launched from computers we use today, the advancement of quantum computing technology introduces new security threats. This calls for current PKI systems to be modified with quantum-safe cryptographic algorithms. However, transitioning to Quantum-safe (QS) PKI systems remains complex, and the challenges are socio-technical. The research aims to guide organizations transitioning towards QS PKI systems. In doing so, we will deconstruct the QS transition into a series of stages and paths using growth models and examine how organizations can transit over time towards QS PKI systems.
By utilizing the properties of quantum mechanics, quantum computers have the potential to factor a key pair of a large prime number and break some of the core cryptographic primitives that most information infrastructures depend on. This means that today's widely used cryptographic algorithms can soon become unsafe and need to be modified with quantum-safe (QS) cryptography. While much work is still needed in developing QS cryptographic algorithms, the institutional, organizational, and policy aspects of transitioning the current infrastructures have received less attention. This paper provides an empirical analysis of QS transition challenges and policy recommendations for moving to a QS situation. We analyzed the data collected through interviews with experts and practitioners from the Dutch government. The results reveal that institutional, organizational and policy aspects of QS transitions are interconnected, and solutions for QS transitions are scattered. Consequently, organizations may face a Catch-22 loop without further actionable approaches and planning for QS transitions.
Ensuring the secure provision of data and services using critical information infrastructures amidst the evolving technology landscape is a crucial yet recurrent task. However, these infrastructures can become vulnerable due to developments in quantum computing and modifying the infrastructures with quantum-safe (QS) technology is unlike regular control and maintenance. Organizations need to modify their cryptographic layers, which act as the fundamental building blocks of infrastructures. For organizations, many uncertainties pose challenges across technological, organizational and ecosystem areas. While QS technology is new and not yet available for implementation and adoption, changes in critical information infrastructures require collaboration among multiple public and private organizations spanning industries and borders. By understanding the roles, organizations may better understand what should be done for QS transitions. Until now, there has been no academic research examining the roles that government could or should play in QS transitions. This paper reveals 12 different roles, showing the diversity and breadth of actions needed. While there are many possible roles that still need to be allocated for coordinated efforts, there is a high reliance on the government, and organizations are waiting for and expecting governments to take more active roles in QS transitions. The results also signals that QS transition research is at its early stage with a clear governance void and lack of collective urgency in the ecosystem.
Development of Quantum Computers are growing rapidly, the security of today’s cryptographic systems which are working with Public Key Infrastructure (PKI) is at serious risk. RSA and ECC algorithms are the backbone of secure communication and digital identity can be breakable by quantum algorithms such as Shor’s. Hence, a transition is required to Post-Quantum Cryptography (PQC), which is designed to handle quantum attacks. This work provides a detailed review of how PQC can be integrated with the existing PKI, with a special focus on the auto-enrollment process. Auto-enrollment is an essential process but often overlooked mechanism, responsible for automatically issuing and renewing digital certificates. First, we explored how current PKI systems are exposed to the quantum threats and the readiness. The performance of the algorithms that are standardized by NIST, such as Kyber and Dilithium were discussed. We analyze the technical and operational challenges of transitioning to PQC by referencing both research studies and real-world implementations from major industry players such as Google and Microsoft. These include large key size, certificate size, compatibility issues, complex computations and need for crypto-agility. We also examine the hybrid approaches that combine classical and post-quantum methods as traditional strategies. The survey concludes by outlining best practices, deployment considerations, and open research challenges that must be addressed for a smooth, secure, and scalable shift to quantum-safe PKI. This work aims to guide researchers, engineers, and policymakers in building the next generation of cryptographic infrastructure that can stand the test-time even in a quantum world.
As the development of quantum computers advances, actors relying on public key infrastructures (PKI) for secure information exchange are becoming aware of the disruptive implications. Currently, governments and businesses employ PKI for many core processes that may become insecure or unavailable when quantum computers break the cryptographic algorithms foundational to PKI. While standardization institutes are currently testing quantum safe cryptographic algorithms, there are no globally agreed-upon cryptographic solutions available. Actors looking to prepare for the implementation of quantum safe cryptographic algorithms lack methods that allow for collective planning and action across organizations, sectors, and nations. The goal of this policy paper is to elicit requirements for a serious game on QS PKI, and derive policy guidelines that actors can use to prepare and formulate governance arrangements. We followed a two-step approach, drawing on technology threat avoidance theory and collective action theory, followed by empirical grounding through a focus group. The results from the literature confirm that a serious game could be a suitable governance mechanism for QS PKI. The focus group results discussed 12 requirements and the requirement's relation to the theoretical background. From this, the findings section arrived at four policy guidelines derived from the requirements that can function as focus areas for further requirement development and as input for policy makers. The policy guidelines concluded are (1) prioritize increasing collective awareness through emphasizing social networks, (2) acknowledge the interdependencies in migrating towards QS PKI, (3) create an understanding of the technical standards in the field and their issuers, and (4) being highly realistic with both negative and positive scenarios to center the players’ understanding of real-world impact.
The rapid development of quantum computing is one of the most transformative technological developments of the twenty-first century with profound implications for cybersecurity, digital governance and the future of secure communication systems. Traditional cryptographic infrastructures have fundamentally underpinned digital trust in banking, healthcare, defense, cloud computing, and global communication networks, but the advent of quantum computational power has led to increasing concern about the future of existing standards for encryption. This qualitative study critically examines the changing relationship between quantum computing and post-quantum cryptography through an analysis of the technological, institutional, ethical and governance challenges in the transition to quantum-secure digital systems. The study adopts an interpretivist and exploratory qualitative orientation that aims to understand how governments, cybersecurity experts, technology institutions and policy frameworks are responding to the disruptive potential of quantum technologies. Data were collected using thematic analysis of academic literature, cybersecurity policy documents, archival technological reviews, expert commentaries, institutional reports, and emerging case studies related to the development of quantum-resistant cryptography. The results show that quantum computing presents serious threats to existing public-key cryptographic systems, especially in terms of theoretical abilities of Shor’s algorithm and future quantum decryption models. Meanwhile, the paper outlines post-quantum cryptography as a vital avenue for safeguarding digital privacy, institutional credibility, and cybersecurity robustness in an ever more networked society. The analysis also points to ongoing challenges around technological readiness, regulatory uncertainty, global standardization, resource inequality and ethical issues around surveillance, privacy and digital sovereignty. Yet, the research points to the potential for secure digital transformation, resilient cybersecurity governance, and the re-inventing of future communication infrastructure through post-quantum innovation. The research finds that the transition to quantum-secure systems is not just a technological challenge, but a multidimensional governance and policy challenge requiring international cooperation, ethical foresight and proactive institutional change.