Agentic AI systems depend on classical public-key cryptography for agent identity, tool invocation, inter-agent communication, model integrity, and persistent state, exposing them to a cryptographically relevant quantum computer (CRQC) along two axes: confidentiality (harvest-now-decrypt-later) and integrity (harvest-now-forge-later). Existing post-quantum migration guidance addresses static, operator-controlled enterprise estates, while emerging agent-identity work omits post-quantum cryptography entirely; neither treats non-human-identity-dense, runtime-negotiated agentic systems as a distinct migration class. This paper develops a conceptual framework that does. It organizes agentic cryptography into seven migration surfaces and separates each identity into a credential layer (symmetric, operator-held, low-risk) and a trust-anchor layer (the asymmetric roots that underwrite the fleet). These layers scale inversely: a small set of trust anchors carries a forge-later blast radius equal to the population beneath it, so migration effort and forge-later risk rank the work in opposite orders. A migration matrix and a parametric effort-and-risk model formalize this, yielding the core sequencing rule: migrate anchors first. Because agentic adoption is ongoing, it also reframes migration from a finite inventory into a continuously regenerating problem, distinguishing remediation of the installed base from prevention of new classical-cryptographic debt in future deployments. It closes with oversight and procurement implications for federal post-quantum readiness.
Agentic AI systems depend on classical public-key cryptography for agent identity, tool invocation, inter-agent communication, model integrity, and persistent state, exposing them to a cryptographically relevant quantum computer (CRQC) along two axes: confidentiality (harvest-now-decrypt-later) and integrity (harvest-now-forge-later). Existing post-quantum migration guidance addresses static, operator-controlled enterprise estates, while emerging agent-identity work omits post-quantum cryptography entirely; neither treats non-human-identity-dense, runtime-negotiated agentic systems as a distinct migration class. This paper develops a conceptual framework that does. It organizes agentic cryptography into seven migration surfaces and separates each identity into a credential layer (symmetric, operator-held, low-risk) and a trust-anchor layer (the asymmetric roots that underwrite the fleet). These layers scale inversely: a small set of trust anchors carries a forge-later blast radius equal to the population beneath it, so migration effort and forge-later risk rank the work in opposite orders. A migration matrix and a parametric effort-and-risk model formalize this, yielding the core sequencing rule: migrate anchors first. Because agentic adoption is ongoing, it also reframes migration from a finite inventory into a continuously regenerating problem, distinguishing remediation of the installed base from prevention of new classical-cryptographic debt in future deployments. It closes with oversight and procurement implications for federal post-quantum readiness.
K SC Governments are adopting artificial intelligence at the same moment that the cryptographic assumptions under their long-lived secrets are being placed on a clock. This paper treats four developments as a single problem of digital trust rather than as separate technical topics. First, AI systems are moving from content generation to agentic action, and are already exposed to impersonation, poisoning and unauthorised use. Second, persistent memory across sessions creates a new class of institutional record, whose integrity cannot be reduced to a signature. Third, cryptographic security depends on unpredictable keys, not on non-determinism, and better randomness does not answer a quantum attack on public-key mathematics. Fourth, harvest-now-decrypt-later means that the threat to data which must remain confidential for decades exists before a cryptographically relevant quantum computer does. Drawing on published resource estimates, the NIST post-quantum standards, and the positions of major security agencies on quantum key distribution, the paper argues that preparation should begin with an inventory of vulnerable cryptography, hybrid migration of high-value key exchange, and an explicit regime for the ownership and correction of AI memory. The implications for diplomatic communications and for states with constrained compute and language resources are developed throughout. Also available on Academia.edu: https://www.academia.edu/attachments/134650176/download_file?s=portfolio
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.
Governments are adopting artificial intelligence at the same moment that the cryptographic assumptions under their long-lived secrets are being placed on a clock. This paper treats four developments as a single problem of digital trust rather than as separate technical topics. First, AI systems are moving from content generation to agentic action, and are already exposed to impersonation, poisoning and unauthorised use. Second, persistent memory across sessions creates a new class of institutional record, whose integrity cannot be reduced to a signature. Third, cryptographic security depends on unpredictable keys, not on non-determinism, and better randomness does not answer a quantum attack on public-key mathematics. Fourth, harvest-now-decrypt-later means that the threat to data which must remain confidential for decades exists before a cryptographically relevant quantum computer does. Drawing on published resource estimates, the NIST post-quantum standards, and the positions of major security agencies on quantum key distribution, the paper argues that preparation should begin with an inventory of vulnerable cryptography, hybrid migration of high-value key exchange, and an explicit regime for the ownership and correction of AI memory. The implications for diplomatic communications and for states with constrained compute and language resources are developed throughout. KSCCN discussion paper prepared for the SQLL session on AI and quantum computing, Baridhara DOHS, 3 October 2026. Dr. Syed Muntasir Mamun, ORCID 0000-0001-6845-2853. The views expressed are those of the author.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.
The simultaneous maturation of quantum computing and artificial intelligence represents a defining inflection point for the security of digital civilization. This chapter examines the convergence of these two transformative forces through a bidirectional analytical lens: how artificial intelligence can accelerate and improve the organizational transition to post-quantum cryptography and how post-quantum cryptographic standards must be applied to secure AI infrastructure itself. Building on the NIST finalization of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024 and the subsequent selection of HQC in March 2025, the chapter develops a practitioner-oriented treatment of the algorithmic foundations, performance characteristics, and deployment realities of each standardized scheme. A dedicated section develops the “Harvest Now, Decrypt Later” (HNDL) threat as a present-tense security emergency rather than a future concern and introduces a novel detection architecture that integrates HNDL behavioral indicators into the streaming telemetry pipeline of Chapter 2 and the AI-SOC framework of Chapter 4 . The chapter examines AI-assisted cryptographic discovery, inventory automation, side-channel vulnerability detection, and migration workflow orchestration as tools for managing the organizational complexity of the PQC transition. It addresses the reciprocal challenge of applying PQC to AI infrastructure itself – securing large language model inference pipelines, federated learning gradient exchanges, agentic communication channels, and model provenance attestation against quantum-capable adversaries. A practical deployment section documents the installation and operation of the Open Quantum Safe liboqs library and OQS-OpenSSL provider on Ubuntu 24.04 LTS, with original step-by-step guidance derived from direct implementation experience. The chapter closes by synthesizing the governance requirements, policy timelines, and organizational frameworks that responsible PQC transition demands – and by tying together the 11-chapter arc of this book into a single coherent argument about what secure looks like in the age of autonomous defense.
Financial institutions depend on RSA, elliptic-curve cryptography, and Diffie-Hellman key exchange for authentication, transaction integrity, and confidentiality: algorithms a sufficiently large quantum computer would break outright rather than merely weaken. No cryptographically relevant quantum computer exists yet, but the harvest-now-decrypt-later threat means data intercepted today remains at risk once one does, and financial data's long retention obligations make this a present-day planning problem rather than a distant one. This paper assesses the readiness of financial institutions in Africa to adopt post-quantum cryptography (PQC) and develops a framework for transitioning to quantum-resistant cryptographic systems. Five specific objectives drive that work: examining PQC awareness among African financial institutions, assessing current cryptographic exposure, identifying technical, financial, organizational, regulatory, and skills-related adoption barriers, evaluating the suitability of finalized PQC algorithms for financial applications, and developing a readiness and migration framework fitted to African constraints. The study's design is literature-based and conceptual: it synthesizes verified secondary evidence rather than reporting original fieldwork, and no institution was surveyed or interviewed. Its contributions include an integrated Technology-Organization-Environment/Diffusion-of-Innovation model with crypto-agility as a mediating capability, a six-dimension readiness instrument, and an algorithm-evaluation framework. The central contribution, a six-phase migration framework addressing three gaps found in every existing precedent, is paired with an adapted risk-based prioritization matrix. Headline recommendations call on institutions to name a single accountable owner and begin scoped discovery now, on regulators to extend draft cybersecurity guidance to address cryptographic agility explicitly, and on future research to empirically test the proposed model against real institutions.