Advancing quantum computing capabilities pose an existential threat to the public-key cryptographic infrastructure—RSA, elliptic curve cryptography (ECC), and Diffie-Hellman key exchange—that secures national security systems, critical infrastructure, and classified communications. National Security Memorandum 10 (NSM-10) mandates that federal agencies complete migration to post-quantum cryptography (PQC) by 2035, yet the feasibility of achieving this deadline remains empirically unquantified. This quantitative study assessed four interrelated dimensions of the post-quantum migration challenge for U.S. national security systems through analysis of six curated datasets: quantum hardware metrics (N = 46), PQC algorithm benchmarks (N = 24), National Vulnerability Database cryptographic vulnerabilities (N = 856), cryptographic library vulnerabilities (N = 39), federal agency migration data (N = 22), and PQC TLS network performance data (N = 19). Analytical methods included polynomial and logistic regression, Kruskal-Wallis tests, chi-square analysis, logistic regression, and Monte Carlo simulation (10,000 iterations). Results revealed four convergent findings. First, a cubic polynomial model (R² = .906) projected that a cryptographically relevant quantum computer (CRQC) could compromise RSA-2048 by approximately 2042, while a logistic saturation model (R² = .991) suggested a potential qubit plateau at approximately 1,237 qubits. Second, statistically significant performance differences existed across PQC algorithm families (p < .01), with ML-KEM demonstrating the fastest key generation (12–31 µs) and effect sizes up to η² = .893. Third, implementation vulnerabilities constituted 82.1% of cryptographic CVEs, with no significant association with severity (χ² = 4.216, p = .239). Fourth, the probability of all federal agencies completing migration by 2035 was 0.03% (median completion: 2041.2). These findings reveal a significant urgency-readiness gap between quantum threat emergence and federal migration capacity. Algorithm migration alone addresses less than 20% of the cryptographic vulnerability surface. Risk-based prioritization, phased compliance frameworks, and concurrent investment in implementation security are recommended to bridge the gap between the quantum threat timeline and organizational readiness.
Advancing quantum computing capabilities pose an existential threat to the public-key cryptographic infrastructure—RSA, elliptic curve cryptography (ECC), and Diffie-Hellman key exchange—that secures national security systems, critical infrastructure, and classified communications. National Security Memorandum 10 (NSM-10) mandates that federal agencies complete migration to post-quantum cryptography (PQC) by 2035, yet the feasibility of achieving this deadline remains empirically unquantified. This quantitative study assessed four interrelated dimensions of the post-quantum migration challenge for U.S. national security systems through analysis of six curated datasets: quantum hardware metrics (N = 46), PQC algorithm benchmarks (N = 24), National Vulnerability Database cryptographic vulnerabilities (N = 856), cryptographic library vulnerabilities (N = 39), federal agency migration data (N = 22), and PQC TLS network performance data (N = 19). Analytical methods included polynomial and logistic regression, Kruskal-Wallis tests, chi-square analysis, logistic regression, and Monte Carlo simulation (10,000 iterations). Results revealed four convergent findings. First, a cubic polynomial model (R² = .906) projected that a cryptographically relevant quantum computer (CRQC) could compromise RSA-2048 by approximately 2042, while a logistic saturation model (R² = .991) suggested a potential qubit plateau at approximately 1,237 qubits. Second, statistically significant performance differences existed across PQC algorithm families (p < .01), with ML-KEM demonstrating the fastest key generation (12–31 µs) and effect sizes up to η² = .893. Third, implementation vulnerabilities constituted 82.1% of cryptographic CVEs, with no significant association with severity (χ² = 4.216, p = .239). Fourth, the probability of all federal agencies completing migration by 2035 was 0.03% (median completion: 2041.2). These findings reveal a significant urgency-readiness gap between quantum threat emergence and federal migration capacity. Algorithm migration alone addresses less than 20% of the cryptographic vulnerability surface. Risk-based prioritization, phased compliance frameworks, and concurrent investment in implementation security are recommended to bridge the gap between the quantum threat timeline and organizational readiness.
The arrival of cryptographically relevant quantum computers (CRQCs) represents an existential threat to the public-key cryptographic infrastructure underpinning global enterprise operations. Enterprise security today relies on RSA and elliptic-curve cryptography (ECC) for TLS, VPNs, PKI, code signing, and identity systems—all of which are fundamentally broken by Shor's algorithm on a sufficiently powerful quantum computer. The defining risk is time-shifted compromise: adversaries can harvest encrypted traffic today and decrypt it once CRQCs exist, a threat already underway according to U.S. intelligence assessments. NIST finalized three post-quantum cryptographic (PQC) standards in August 2024 (FIPS 203/204/205) and mandates deprecation of quantum-vulnerable algorithms by 2035. Yet only 5% of organizations have implemented quantum-safe encryption and 95% lack formal quantum transition plans. This paper provides a comprehensive, threat-driven analysis across seven dimensions: quantum algorithm impact, harvest-now-decrypt-later (HNDL) threat models, enterprise asset risks (PKI, TLS, VPNs, code signing, cloud, IoT, identity, blockchain, supply chain), sector-specific vulnerabilities (financial services, healthcare, critical infrastructure), cryptographic primitive analysis, migration standards and roadmaps, and enterprise readiness gaps. The convergence of HNDL attacks already underway, multi-decade data sensitivity windows, and 12–15 year enterprise migration timelines means the migration deadline has, for most sectors, already passed.
With the arrival of fault-tolerant quantum computers, an existential threat has come to the cryptographic underpinnings of the security infrastructure in place for modern information technologies. Virtually all secure digital communication protocols used today are based on classical public-key cryptographic systems – RSA, Elliptic Curve Cryptography (ECC) and Diffie-Hellman key exchange – that are susceptible to polynomial-time quantum attacks using Shor's algorithm. Symmetric cryptographic algorithms that are not broken are being effectively halved by Grover's algorithm, for example, AES. In this article, a complete and journal-standard systematic review of quantum computing and its implications in the field of information technology security is presented which includes 22 peer-reviewed publications from 2023-2025. The study covers the basics of quantum computing (qubits, superposition, entanglement and quantum gates), and how quantum computing specifically poses a threat to classical cryptography via algorithmic mechanisms. The three post-quantum cryptographic algorithms that were standardised by the National Institute of Standards and Technology (NIST) in August 2024 (ML-KEM, FIPS 203; ML-DSA, FIPS 204; and SLH-DSA, FIPS 205) are compared based on their security assumptions, performance, and readiness for deployment. The practical limitations and the use of Quantum Key Distribution, (QKD), as a physics based alternative to the computational security assumptions are discussed. Results show that although mature PQ solutions are now available for most cryptographic applications, the migration challenge, including legacy system transitions, migration architecture, and governance, is significant and pressing as the ‘harvest now, decrypt later’ threat model is relevant and adversaries might be collecting encrypted data for quantum decryption. The impact for financial services, health care, government, cloud infrastructure and critical national infrastructure is discussed. Lastly, the researchers list key research areas: standardisation of quantum-safe protocols, hybrid PQC-QKD designs, light-weight PQC for constrained devices, and quantum-safe blockchain.
The advent of quantum computing poses a significant threat to contemporary cryptographic systems underpinning national security infrastructures globally. Classical public-key cryptographic algorithms such as RSA and ECC, which secure communications, data storage, and critical infrastructure, are vulnerable to quantum attacks, particularly through Shor’s algorithm. Post-Quantum Cryptography (PQC) aims to develop quantum-resistant cryptographic primitives to ensure confidentiality, integrity, and authentication in the quantum era. This article explores the implications of PQC adoption for national security, including the challenges of transitioning legacy systems, potential vulnerabilities during migration, and the strategic importance of standardizing PQC protocols to safeguard military, governmental, and critical infrastructure communications. The article also discusses policy recommendations for governments to mitigate emerging quantum risks.
Abstract Classical computing architectures cannot reasonably solve computationally challenging problems, such as those of RSA public-key encryption, Diffie-Hellman key exchange, and elliptic curve cryptography, which form the cryptographic foundations of modern enterprise information security. Superposition and entanglement phenomena can be used to make quantum computers efficient in solving these problems, which are efficiently solved by Shor's algorithm and Grover's algorithm, and make existing cryptographic infrastructure entirely insecure. While quantum computing is fault-tolerant and still under development, the 'harvest now, decrypt later' threat model by which adversaries can harvest encrypted data now to be decrypted later when they can operate quantum systems signals that the cryptographic threat is present, not future. The objective of this study is to examine the current state of enterprise cryptographic readiness against threats in the quantum era and to create a model for organizational transition to the new cryptographic standards in the quantum era, which is called the Quantum-Resilient Security Architecture (QRSA) Framework. It uses a mixed-methods research methodology, consisting of a systematic literature review, an expert Delphi survey of 38 cybersecurity practitioners from 16 countries, and a qualitative analysis of five enterprise organizations, to examine the state of quantum-capable cryptographic protocols, the readiness of organizations in the technical, governance and capability aspects, and the most important enablers and blockers for the post-quantum migration. The key findings include that: 94 percent of enterprise systems assessed are today still using quantum-vulnerable cryptographic primitives; less than 12 percent of organizations surveyed have started formal planning efforts for quantum migration; and, in most of the cases analyzed, the National Institute of Standards and Technology (NIST) post-quantum cryptography standardization process has not made significant impacts on enterprise security roadmaps. The QRSA Framework offers a staged migration architecture based on the NIST standardized algorithms such as CRYSTALS-Kyber, CRYSTALS-Dilithium and SPHINCS+ that integrates with the enterprise security infrastructure. Contributions include cybersecurity governance scholarship, enterprise risk management theory, and information security policy.
Quantum computing poses an existential threat to public-key cryptography, with Shor's algorithm capable of breaking RSA and elliptic curve systems once cryptographically relevant quantum computers (CRQCs) emerge. While post-quantum cryptography (PQC) offers algorithmic solutions, organizational readiness extends beyond technical implementation to encompass governance, interoperability, and adaptive capacity. This review synthesizes the quantum threat landscape, evaluates NIST-standardized PQC algorithms through quantitative performance analysis, and examines global standardization dynamics. We introduce a novel Quantum Readiness Maturity Model (QRMM) that enables organizations to assess and advance their preparedness across five dimensions: cryptographic infrastructure, governance frameworks, sectoral adaptation, interoperability resilience, and strategic agility. Applying this model to finance, telecommunications, and defense sectors reveals systematic gaps in migration planning and crypto-agility. Our analysis demonstrates that quantum readiness requires treating cryptographic transformation as a strategic enterprise capability rather than a purely technical upgrade. The proposed framework provides actionable pathways for practitioners while identifying critical research directions in hybrid deployment strategies, post-quantum PKI architectures, and algorithmic diversity.
The maturation of quantum computing hardware and algorithms has transformed what was once a theoretical concern into an active planning priority for governments, enterprises, and standards bodies. This paper assesses the current and projected threat that quantum computation poses to classical public-key cryptographic standards, namely RSA, elliptic curve cryptography (ECC), and Diffie-Hellman key exchange, all of which derive their security from mathematical problems that Shor's algorithm renders tractable on a sufficiently large fault-tolerant quantum computer. We synthesize recent hardware progress, algorithmic refinements that have substantially reduced estimated qubit requirements, and the finalization of NIST's post-quantum cryptography (PQC) standards (FIPS 203, 204, and 205) to provide an evidence-based assessment of where the field stands as of mid-2026. Particular attention is given to the widening gap between optimistic resource estimates, including a contested March 2026 claim of a thousand-fold reduction in factoring resources, and the practical reality that no existing quantum computer approaches the logical qubit counts required to threaten deployed encryption. We further examine migration challenges, including performance overhead, cryptographic agility, constraints on embedded and IoT systems, and the harvest-now-decrypt-later threat model that makes migration urgency independent of exact timeline predictions. Drawing on NIST transition guidance and recent G7 coordination targets, we argue that organizations should treat cryptographic migration as a present-tense operational requirement rather than a future contingency, regardless of unresolved disagreement among experts about when a cryptographically relevant quantum computer will exist. The paper concludes with practical recommendations for risk-based migration prioritization and identifies open research questions in cryptographic agility and quantum-resistant system design.