Post-quantum cryptography (PQC) is becoming an increasingly important field of study as the advance of quantum computers are expected to one day threaten the public-key cryptographic schemes used today. Although technical standards for PQC are emerging, successful implementation for organisations depends on more than just replacing the cryptographic algorithms. This study aims to find the main organisational barriers that hinder the successful implementation of PQC. This was done by conducting a systematic literature review and analysing the data to create a thematic analysis set on identifying recurring organisational barriers. The results showcase that implementation is primarily hindered by legacy systems and integration challenges, followed by insufficient strategic governance and migration readiness, external dependencies, regulatory and standards uncertainty, lack of expertise and resource constraints. The findings indicate that PQC isn’t only a technical problem but a wider socio-technical problem. The study concludes that organisations require better migration planning, improved internal expertise, clearer regulatory guidance and stronger coordination with external actors for organisations to successfully implement PQC.
Post-quantum cryptography (PQC) is becoming an increasingly important field of study as the advance of quantum computers are expected to one day threaten the public-key cryptographic schemes used today. Although technical standards for PQC are emerging, successful implementation for organisations depends on more than just replacing the cryptographic algorithms. This study aims to find the main organisational barriers that hinder the successful implementation of PQC. This was done by conducting a systematic literature review and analysing the data to create a thematic analysis set on identifying recurring organisational barriers. The results showcase that implementation is primarily hindered by legacy systems and integration challenges, followed by insufficient strategic governance and migration readiness, external dependencies, regulatory and standards uncertainty, lack of expertise and resource constraints. The findings indicate that PQC isn’t only a technical problem but a wider socio-technical problem. The study concludes that organisations require better migration planning, improved internal expertise, clearer regulatory guidance and stronger coordination with external actors for organisations to successfully implement PQC.
Quantum computing has emerged as a potential long-term challenge to the cryptographic algorithms that currently secure digital financial systems. As financial institutions rely extensively on cryptography to protect communications, transactions, authentication processes, and sensitive information, the prospect of quantum computing has raised concerns about the future security of existing cryptographic infrastructures. This has created a need to better understand how organisations perceive and approach the transition toward post-quantum cryptography (PQC). This study explores how financial organizations in the United Arab Emirates perceive and approach the transition toward PQC. Guided by the Technology–Organization–Environment (TOE) framework,the study examines how technological, organizational, and environmental factors influence organizational perspectives and approaches toward future cryptographic transition. A qualitative research design was adopted using semi-structured interviews with nine participants in cybersecurity, technology, governance, and compliance roles across banks, financial service providers, payment organizations, and a regulatory authority within the UAE financial sector. The findings show that awareness of quantum-related risks is increasing across the sector; however, most organisations remain in the early stages of assessment and monitoring. Organisational approaches were shaped by technological, organisational, and environmental factors, including cryptographic visibility, governance, resource constraints, regulatory expectations, international standards, and ecosystem coordination. The study concludes that financial organisations in the UAE recognise PQC as an important future cybersecurity challenge but currently approach the transition through awareness-building, assessment, and monitoring rather than active implementation.Organizational responses were shaped by technological, organisational, and environmental factors, indicating that PQC transition extends beyond a purely technical challenge.
Cryptographic algorithms are an essential measure to ensure confidentiality and integrity of internet communication. The development of quantum computers (QCs) and their potential to utilize Shor’s Law, is increasingly recognized as a threat to asymmetric cryptography. In response, post-quantum cryptography (PQC) is gaining prominence as a notable field of research aiming to standardize quantum resistant algorithms before the operational usage of QCs. This paper is addressed to people with preliminary knowledge in the field of cryptography and QC. Based on a literature review, the authors provide an overview of challenges faced by the research community and elaborate the advancements in addressing post-quantum threats. A migration strategy from classical cryptosystems to PQC systems is in development, but obstacles such as time constraints and improper implementation complicate the process. Full implementation could take a decade or more. Until then, our paper aims to create awareness for potential challenges when transitioning towards PQC. As categorization scheme for these potential obstacles, we refer to a well- established model in cybersecurity – the McCumber Cube. Conclusions embrace preparing for risks of improper implementation and deriving a multi-step migration. Special attention is expected to be needed for data migration of existing data sets. As a request for future research in PQC, the authors identified the process of implementing post-cryptography standards, e.g., from the National Institute of Standards and Technology (NIST), and an assessment of the perceived readiness of industry to adapt.
Quantum computers threaten to break asymmetric cryptography protocols almost immediately. To address this, researchers are developing post-quantum cryptography (PQC), which offers greater security but comes with higher costs and greater implementation complexity. The objective of this article is to identify the NEW cryptographic schemes, methods, and algorithms designed to resist quantum attacks. To do so, we first conducted a literature review that included mapped studies, systematic reviews, and surveys published in 2025 and mid-2026. This would help identify gaps and knowledge vacuums. Second, we conducted a systematic review using the PRISMA methodological guidelines for the period between 2020 and mid-2026 to compare the performance of PQC schemes, characterize the main challenges of their implementation, and identify trends. The results show that lattice-based schemes, followed by code-based and hash-based schemes, are the most extensively researched because they balance security, computational efficiency, and readiness for standardization. Furthermore, the most commonly reported performance metrics are key and signature sizes, as well as execution times. Meanwhile, scalability, power consumption, and performance on resource-constrained devices have been explored very little. Our study concludes with the key priorities that are likely to shape the future development of PQC.
The traditional cryptographic methods used to protect healthcare data, especially for the long-term storage of medical imaging records, are becoming increasingly threatened by the quick development of quantum computing. The purpose of this study is to assess the challenges, efficacy, and preparedness of integrating Post-Quantum Cryptography (PQC) into healthcare information systems. Twenty peer-reviewed studies published between 2020 and 2025 were analysed following the Preferred Reporting Items for Systematic Reviews and Meta Analyses (PRISMA) protocol. The review was conducted using a systematic research design that included qualitative thematic synthesis, predetermined eligibility criteria, and database searching. According to the results, lattice-based PQC schemes, specifically, CRYSTALS-Kyber for encryption and CRYSTALS-Dilithium for authentication, show great promise because of their effectiveness, resilience, and suitability for decentralized architectures like blockchain and Internet-of-Medical-Things environments. Nonetheless, the review points out a notable deficiency of empirical assessment in actual healthcare settings, particularly with regard to cloud-based platforms and Picture Archiving and Communication Systems utilized in medical imaging processes. Scalability limitations, intricate key-management specifications, system interoperability restrictions, and the requirement for conformity with regulatory and compliance frameworks are some of the major issues noted. The results indicate that lattice-based PQC schemes have great promise, deployment readiness remains largely at the conceptual and experimental stage, particularly for cloud-based PACS environments. Real-world implementation validation in a healthcare setting has not been achieved.
Post-quantum cryptography (PQC) is driven by the threat posed by quantum computers, particularly the harvest-now-decrypt-later attack. PQC aims to prepare classical systems and hardware to become resilient against quantum attacks. This research discusses the system vulnerabilities, the need to migrate to PQC, and how to integrate this migration. PQC has become one of the solutions for addressing today’s vulnerabilities and threats while increasing security. The paper concludes that harvest-now-decrypt-later, Q-Day attacks, and new quantum attacks are today’s most critical threats, which can be addressed by deploying PQC solutions and, thus, increasing security. This research proposes a conceptual multi-phased model framework for the migration. The framework first addresses system objectives, goals and assets, then ranks assets based on the highest sensitivity. Crypto-Agility is achieved via the automation of PQC migration, such as the automation of re-keying endpoints, followed by the automation of auditing and testing of each migration stage. Human judgment is required to review the migration process. Once one asset is successfully transitioned, the framework goes to the next highest asset; otherwise, testing is repeated. This is expected to help systems migrate at the lowest cost and with the fewest consequences. However, the limitation of PQC migration is its high resource cost, time, requirement of human professionals, burden on existing systems, and financial expenses. Lastly, the paper recommends creating an ML model to help rank a system’s data and vulnerabilities. Moreover, the paper recommends conducting experiments to evaluate the effectiveness of the proposed framework. In addition, the paper recommends performing migration in relation to a real-world company.
Quantum computing represents a significant threat to the asymmetric cryptographic algorithms currently used to protect the traditional data security infrastructure today’s enterprises depend upon. With Gartner predicting that by 2029 advances in quantum computing will render applications, data and networks protected by asymmetric cryptography unsafe, organisations must begin preparations to transition to post-quantum cryptography (PQC). Organisations that fail to prepare for quantum today risk potentially exposing their sensitive data on a massive scale, as threat actors are already collecting encrypted enterprise data in anticipation of future quantum decryption capabilities. The migration to PQC involves updating risk registers and enabling the crypto agility that supports the rapid implementation of new algorithms and ensures organisations can adapt fast to new regulatory standards.