With Shor’s and Grover’s algorithms compromising the mathematical core of legacy RSA and ECC, the active threat of ‘Harvest Now, Decrypt Later’ (HNDL) campaigns is already accelerating the rollout of Post-Quantum Cryptography (PQC). This paper examines the gap between EU compliance mandates, specifically NIS2 Directive and the Cyber Resilience Act, and the actual engineering of quantum-safe systems. We push 'hybrid cryptography’ as the immediate standard, layering NIST primitives like ML-KEM and ML-DSA over classical protocols to enforce redundancy in constrained environments. We use the NIST IR 8547 framework to organise migration into discovery, prioritisation, and modernisation. Using Portugal as a national case study, this paper examines how EU-level PQC governance is translated into national implementation through the CNCS, QNRC, and PTQCI frameworks. Ultimately, success depends on building PQC expertise in Portugal while rebuilding cryptographic foundations for the quantum era.
With Shor’s and Grover’s algorithms compromising the mathematical core of legacy RSA and ECC, the active threat of ‘Harvest Now, Decrypt Later’ (HNDL) campaigns is already accelerating the rollout of Post-Quantum Cryptography (PQC). This paper examines the gap between EU compliance mandates, specifically NIS2 Directive and the Cyber Resilience Act, and the actual engineering of quantum-safe systems. We push 'hybrid cryptography’ as the immediate standard, layering NIST primitives like ML-KEM and ML-DSA over classical protocols to enforce redundancy in constrained environments. We use the NIST IR 8547 framework to organise migration into discovery, prioritisation, and modernisation. Using Portugal as a national case study, this paper examines how EU-level PQC governance is translated into national implementation through the CNCS, QNRC, and PTQCI frameworks. Ultimately, success depends on building PQC expertise in Portugal while rebuilding cryptographic foundations for the quantum era.
This paper provides a comprehensive review of quantum readiness as a critical, multidimensional framework for navigating the upcoming quantum computing era. It addresses the imminent threat posed by cryptographically relevant quantum computers (CRQCs), which will be capable of breaking the public-key cryptographic systems (like RSA and ECC) that currently secure digital communications and e-commerce. The concept of ”harvest now, decrypt later” (HNDL), where adversaries collect encrypted data today to decrypt it once quantum computers are available, highlights the urgency of this transition. The review is structured around three key dimensions: the theoretical foundations of post-quantum cryptography (PQC), global standardization efforts, and real-world sectoral implementations. It discusses how quantum algorithms, specifically Shor’s and Grover’s algorithms, can render classical cryptography obsolete, and it analyzes the NIST Post-Quantum Cryptography Standardization Project, which has selected the first-generation PQC standards. The paper also examines strategies from the European Union and other nations, noting the geopolitical implications of standards fragmentation. Furthermore, the review explores the practical adoption of PQC in critical sectors like finance, telecommunications, and defense, emphasizing the importance of crypto-agility—the ability to rapidly switch cryptographic algorithms—for future-proofing systems. It also highlights open challenges, including performance overheads, legacy system migration, and the shortage of skilled professionals. The paper concludes by outlining future directions for a secure transition, advocating for continuous research, global collaboration, and sustained investment to build a quantum-resilient digital ecosystem.
India's digital governance infrastructure, spanning Aadhaar, UPI, DigiLocker, and critical sectors such as defence, finance, and telecommunications, is built upon classical publickey cryptography (RSA, ECC). The emergence of fault-tolerant quantum computers threatens to dismantle these foundations through Shor's algorithm, which solves integer factorisation and discrete logarithm problems in polynomial time, while Grover's algorithm reduces symmetric key security. The "harvest now, decrypt later" strategy magnifies the urgency, as adversaries can store encrypted data today for future decryption. This paper provides a comprehensive analysis of the post-quantum cryptography (PQC) migration imperative for India. We examine the quantum threat landscape, review candidate PQC families (lattice-, code-, multivariate-, hash-, and isogeny-based) and the newly standardised NIST algorithms, and detail the technical, regulatory, and economic challenges of large-scale PQC adoption in India's heterogeneous e-governance ecosystem. A phased implementation roadmap aligned with the National Quantum Mission (2026 to 2035) is presented, prioritising critical sectors (defence, banking, telecom, Aadhaar/UPI). The paper further highlights strategic opportunities for indigenous capability building, global certification leadership, and the reinforcement of digital sovereignty. By synthesising official reports, international standards, and sector-specific requirements, this work offers actionable guidance for transitioning India's governance to a quantum-resilient future. The paper further proposes the Quantum Governance Readiness and Infrastructure Decision Framework (Q-GRID), an India-specific, measurable decision framework that integrates quantum exposure, data longevity, systemic criticality, dependency, migration complexity, and regulatory urgency into a composite Quantum Risk Index to prioritise migration actions.
As the era of quantum computing approaches, the fundamental cryptographic primitives securing global communications face a paradigm shift. With the National Institute of Standards and Technology (NIST) finalizing new standards, the industry must urgently address the vulnerabilities of legacy systems. The imminent advent of CRQCs (Cryptographically Relevant Quantum Computers) poses an existential threat to the Public Key Infrastructure (PKI) underpinning the global digital economy. Classical algorithms such as RSA and ECC (Elliptic Curve Cryptography) are vulnerable to polynomial-time cryptanalysis via Shor’s algorithm. This study investigates the HNDL (Harvest Now, Decrypt Later) threat model and evaluates the resilience of NIST-standardized PQC (Post-Quantum Cryptography) algorithms: ML-KEM and ML-DSA. Utilizing a high-performance Fortinet networking environment, we experimentally validate that "Hybrid Mode" IPsec VPNs can achieve quantum resistance with negligible performance degradation, offering a viable migration path for enterprise infrastructure. Specifically, we benchmark the trade-offs between PQC’s larger key sizes and network latency, demonstrating that the overhead remains within acceptable operational thresholds. Implementing hybrid protocols provides a critical transition mechanism, allowing organizations to secure long-term data confidentiality against retrospective decryption while preserving interoperability with legacy systems.
The accelerating development of quantum computing represents one of the most significant paradigm shifts in the history of information security. Cryptographic systems that currently underpin global digital infrastructure—including RSA, Diffie–Hellman, and Elliptic Curve Cryptography—rely on mathematical assumptions that collapse under quantum algorithms such as Shor’s and Grover’s. Post-Quantum Cryptography (PQC) emerges as the most viable and immediate solution to secure communications in the quantum era, offering cryptographic primitives that can be deployed on today’s classical hardware while resisting both classical and quantum attacks. This review provides a comprehensive, detailed examination of PQC, analyzing its mathematical foundations, algorithmic families, standardization progress, and deployment challenges. Special emphasis is placed on the NIST PQC standardization process, the risk posed by “harvest-now-decrypt-later” adversaries, the complexities of global cryptographic migration, and the implications for critical digital infrastructures such as cloud computing, blockchain systems, long-lifespan data archives, IoT ecosystems, and national cybersecurity. Through standalone equations, tables, and figures—including a conceptual visual provided by the user—this paper offers a complete, cohesive, and rigorous synthesis. The findings underscore that the transition to PQC is not optional but imperative, requiring coordinated scientific, governmental, and industrial effort to safeguard the digital future.
The impressively fast development of quantum computing is a serious threat to classical public-key cryptography, and algorithms such as Shor's and Grover's will render RSA and elliptic curve systems essentially useless as soon as a cryptanalytically relevant quantum computer becomes available. Although it is still some way off before such machines are available, the harvest-now-encrypt-later threat highlights the need for proactive defense. In response, the National Institute of Standards and Technology (NIST) published the first post-quantum cryptography standards in 2024, including ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) for digital signatures and SLH-DSA (SPHINCS+) as a stateless hash-based alternative. This paper is a summary of the evolving post-quantum landscape, starting with the standards and their underlying security and then moving on to migration policies such as CNSA 2.0 and CISA, NSA and NIST guidance. It also looks at integration patterns for important protocols such as TLS, IPsec, SSH, and code signing. A performance, interoperability and overhead evaluation methodology is presented with results showing that hybrid deployment and crypto-agile architectures make PQC adoption a viable option. The paper concludes by providing a governance-oriented roadmap, where inventory, prioritization and pilot deployments are identified as near-term actions, with open questions remaining on performance optimization, implementation security and algorithm resilience over time.
Quantum computing poses an existential threat to classical public-key cryptography, particularly RSA and elliptic-curve systems, which form the backbone of secure communication, authentication, and digital trust. Once scalable quantum computers emerge, algorithms such as Shor’s will be capable of breaking these schemes, jeopardizing confidentiality and integrity across the internet and enterprise systems. Post-quantum cryptography (PQC) offers a viable defense, providing quantum-resistant algorithms that can be implemented on today’s hardware and protocols. Recent standardization milestones—including NIST’s approval of ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) for signatures, and the selection of HQC as a complementary KEM—mark a turning point for practical adoption. This paper surveys the quantum threat model, algorithm families, performance trade-offs, and integration patterns such as hybrid modes and crypto-agile architectures. It further outlines a phased migration roadmap for enterprises, emphasizing harvest-now-decrypt-later risks and compliance imperatives. By bridging technical, operational, and policy perspectives, the study provides actionable guidance to prepare organizations for a secure and quantum-resilient future.