This chapter identifies quantum threats to modern cryptographic systems and outlines mitigation strategies. It classifies vulnerabilities by cryptographic type: asymmetric (broken by Shor's algorithm), symmetric (weakened by Grover's algorithm), and digital signatures. It emphasizes risks such as compromised software updates, blockchain manipulation, and the “harvest now, decrypt later” threat. The chapter reviews national and international roadmaps by NIST, NSA, ETSI, WEF, and ENISA, highlighting timelines for inventory, migration, and validation. It presents case studies from Google, Microsoft, IBM, and others piloting post-quantum cryptography. Recommended remediation includes inventorying cryptographic assets, adopting hybrid schemes, and implementing crypto-agile infrastructure. A proposed “quantum-safe stack” aligns resilient algorithms (e.g., CRYSTALS-Kyber, Dilithium, AES-256) with key security tasks. The chapter concludes with practical checklists and a phased roadmap for organizations to begin immediate planning and transition, recognizing a multi-year effort is needed to achieve post-quantum readiness before full-scale quantum computing becomes operational.
This chapter identifies quantum threats to modern cryptographic systems and outlines mitigation strategies. It classifies vulnerabilities by cryptographic type: asymmetric (broken by Shor's algorithm), symmetric (weakened by Grover's algorithm), and digital signatures. It emphasizes risks such as compromised software updates, blockchain manipulation, and the “harvest now, decrypt later” threat. The chapter reviews national and international roadmaps by NIST, NSA, ETSI, WEF, and ENISA, highlighting timelines for inventory, migration, and validation. It presents case studies from Google, Microsoft, IBM, and others piloting post-quantum cryptography. Recommended remediation includes inventorying cryptographic assets, adopting hybrid schemes, and implementing crypto-agile infrastructure. A proposed “quantum-safe stack” aligns resilient algorithms (e.g., CRYSTALS-Kyber, Dilithium, AES-256) with key security tasks. The chapter concludes with practical checklists and a phased roadmap for organizations to begin immediate planning and transition, recognizing a multi-year effort is needed to achieve post-quantum readiness before full-scale quantum computing becomes operational.
This chapter explains the evolution and future risks to cryptography from quantum computing. It outlines key historical developments from ancient ciphers through World War II (WWII) innovations like Enigma and Colossus, to modern symmetric and asymmetric encryption systems. It highlights RSA, Diffie-Hellman, and AES, and introduces digital certificates and HTTPS protocols. The chapter then shifts to the quantum threat, explaining how Shor's algorithm breaks asymmetric encryption and Grover's weakens symmetric methods. It details the “harvest now, decrypt later” risk, emphasizing the urgency of post-quantum cryptography. NIST's efforts to standardize quantum-resistant algorithms are noted. The chapter concludes with a breakdown of symmetric, asymmetric, and hash-based cryptographic methods, their applications, and quantum-era challenges. The focus is on the need for proactive migration strategies and resilient cryptographic frameworks before quantum systems become practically deployable, potentially by 2030. The chapter serves as a foundational guide for understanding and responding to the quantum disruption of cryptographic security.
Abstract Classical computing architectures cannot reasonably solve computationally challenging problems, such as those of RSA public-key encryption, Diffie-Hellman key exchange, and elliptic curve cryptography, which form the cryptographic foundations of modern enterprise information security. Superposition and entanglement phenomena can be used to make quantum computers efficient in solving these problems, which are efficiently solved by Shor's algorithm and Grover's algorithm, and make existing cryptographic infrastructure entirely insecure. While quantum computing is fault-tolerant and still under development, the 'harvest now, decrypt later' threat model by which adversaries can harvest encrypted data now to be decrypted later when they can operate quantum systems signals that the cryptographic threat is present, not future. The objective of this study is to examine the current state of enterprise cryptographic readiness against threats in the quantum era and to create a model for organizational transition to the new cryptographic standards in the quantum era, which is called the Quantum-Resilient Security Architecture (QRSA) Framework. It uses a mixed-methods research methodology, consisting of a systematic literature review, an expert Delphi survey of 38 cybersecurity practitioners from 16 countries, and a qualitative analysis of five enterprise organizations, to examine the state of quantum-capable cryptographic protocols, the readiness of organizations in the technical, governance and capability aspects, and the most important enablers and blockers for the post-quantum migration. The key findings include that: 94 percent of enterprise systems assessed are today still using quantum-vulnerable cryptographic primitives; less than 12 percent of organizations surveyed have started formal planning efforts for quantum migration; and, in most of the cases analyzed, the National Institute of Standards and Technology (NIST) post-quantum cryptography standardization process has not made significant impacts on enterprise security roadmaps. The QRSA Framework offers a staged migration architecture based on the NIST standardized algorithms such as CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+ that integrates with the enterprise security infrastructure. Contributions include cybersecurity governance scholarship, enterprise risk management theory, and information security policy.
Quantum computing poses an immense threat to classical digital infrastructure security, as existing encryption schemes are vulnerable to Shor’s and Grover’s algorithms. The accelerating quantum computing timeline makes this risk particularly imminent. Harvest-now-decrypt-later threats elevate the security risks further. While enterprises will eventually adopt the recently standardized post-quantum cryptograph (PQC) schemes as a way to defend against these attacks, many challenges remain to be addressed. To begin with, crypto observability in large enterprises is a challenging task, given the wide variety of hardware, applications, and software deployed with cryptography artefacts used across the depth and breadth of the infrastructure. We also cannot fully rely solely on PQC schemes to make an infrastructure quantum-safe, since just because they have not been broken yet does not mean they can never be broken in the future. Therefore, we need crypto resiliency, where we need to augment the use of PQC with other quantum-resistant network protocols. Finally, we need crypto agility as a foundational paradigm to deal with the constant new threats to ensure fast response and remediation to emerging threats. Enterprises need to consider all three approaches in a holistic manner in order to achieve a practical path towards quantum resistance.
The impressively fast development of quantum computing is a serious threat to classical public-key cryptography, and algorithms such as Shor's and Grover's will render RSA and elliptic curve systems essentially useless as soon as a cryptanalytically relevant quantum computer becomes available. Although it is still some way off before such machines are available, the harvest-now-encrypt-later threat highlights the need for proactive defense. In response, the National Institute of Standards and Technology (NIST) published the first post-quantum cryptography standards in 2024, including ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) for digital signatures and SLH-DSA (SPHINCS+) as a stateless hash-based alternative. This paper is a summary of the evolving post-quantum landscape, starting with the standards and their underlying security and then moving on to migration policies such as CNSA 2.0 and CISA, NSA and NIST guidance. It also looks at integration patterns for important protocols such as TLS, IPsec, SSH, and code signing. A performance, interoperability and overhead evaluation methodology is presented with results showing that hybrid deployment and crypto-agile architectures make PQC adoption a viable option. The paper concludes by providing a governance-oriented roadmap, where inventory, prioritization and pilot deployments are identified as near-term actions, with open questions remaining on performance optimization, implementation security and algorithm resilience over time.
This paper examines the growing threat that quantum computing presents to blockchain security. Core blockchain cryptographic frameworks, specifically the Elliptic Curve Digital Signature Algorithm and the Secure Hash Algorithm 256, are vulnerable to quantum algorithms. Both the Shor algorithm and the Grover algorithm are capable of breaking the Elliptic Curve Digital Signature Algorithm, enabling attackers to calculate private keys from public keys, while the Grover algorithm can also compromise hash-based systems that depend on brute-force methods, such as Proof-of-Work. On-chain analysis indicates that billions of dollars’ worth of crypto-assets are held in addresses susceptible to these quantum attacks. A proposed countermeasure is migration to Post-Quantum Cryptography, which incorporates quantum-resistant algorithms, such as CRYSTALS-Dilithium and Falcon. However, this migration introduces a trilemma among network security, decentralization, and performance. Post-Quantum Cryptography algorithms significantly increase transaction sizes and computational costs, which pose economic and technical challenges for large blockchain networks. The paper further discusses how the timeline for quantum advancements will be shaped by geopolitical competition, and how the catch-the-crop, decrypt-later strategy puts current data at risk from future quantum decryption. It emphasizes that active migration to Post-Quantum Cryptography is urgent, calling on stakeholders to prioritize system audits, transition to cryptographically flexible infrastructures, promote research into quantum-resistant solutions, and establish governance frameworks that enable prompt and decentralized upgrades.
Quantum computing poses an existential threat to classical public-key cryptography, particularly RSA and elliptic-curve systems, which form the backbone of secure communication, authentication, and digital trust. Once scalable quantum computers emerge, algorithms such as Shor’s will be capable of breaking these schemes, jeopardizing confidentiality and integrity across the internet and enterprise systems. Post-quantum cryptography (PQC) offers a viable defense, providing quantum-resistant algorithms that can be implemented on today’s hardware and protocols. Recent standardization milestones—including NIST’s approval of ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) for signatures, and the selection of HQC as a complementary KEM—mark a turning point for practical adoption. This paper surveys the quantum threat model, algorithm families, performance trade-offs, and integration patterns such as hybrid modes and crypto-agile architectures. It further outlines a phased migration roadmap for enterprises, emphasizing harvest-now-decrypt-later risks and compliance imperatives. By bridging technical, operational, and policy perspectives, the study provides actionable guidance to prepare organizations for a secure and quantum-resilient future.