Governments are adopting artificial intelligence at the same moment that the cryptographic assumptions under their long-lived secrets are being placed on a clock. This paper treats four developments as a single problem of digital trust rather than as separate technical topics. First, AI systems are moving from content generation to agentic action, and are already exposed to impersonation, poisoning and unauthorised use. Second, persistent memory across sessions creates a new class of institutional record, whose integrity cannot be reduced to a signature. Third, cryptographic security depends on unpredictable keys, not on non-determinism, and better randomness does not answer a quantum attack on public-key mathematics. Fourth, harvest-now-decrypt-later means that the threat to data which must remain confidential for decades exists before a cryptographically relevant quantum computer does. Drawing on published resource estimates, the NIST post-quantum standards, and the positions of major security agencies on quantum key distribution, the paper argues that preparation should begin with an inventory of vulnerable cryptography, hybrid migration of high-value key exchange, and an explicit regime for the ownership and correction of AI memory. The implications for diplomatic communications and for states with constrained compute and language resources are developed throughout. KSCCN discussion paper prepared for the SQLL session on AI and quantum computing, Baridhara DOHS, 3 October 2026. Dr. Syed Muntasir Mamun, ORCID 0000-0001-6845-2853. The views expressed are those of the author.
Governments are adopting artificial intelligence at the same moment that the cryptographic assumptions under their long-lived secrets are being placed on a clock. This paper treats four developments as a single problem of digital trust rather than as separate technical topics. First, AI systems are moving from content generation to agentic action, and are already exposed to impersonation, poisoning and unauthorised use. Second, persistent memory across sessions creates a new class of institutional record, whose integrity cannot be reduced to a signature. Third, cryptographic security depends on unpredictable keys, not on non-determinism, and better randomness does not answer a quantum attack on public-key mathematics. Fourth, harvest-now-decrypt-later means that the threat to data which must remain confidential for decades exists before a cryptographically relevant quantum computer does. Drawing on published resource estimates, the NIST post-quantum standards, and the positions of major security agencies on quantum key distribution, the paper argues that preparation should begin with an inventory of vulnerable cryptography, hybrid migration of high-value key exchange, and an explicit regime for the ownership and correction of AI memory. The implications for diplomatic communications and for states with constrained compute and language resources are developed throughout. KSCCN discussion paper prepared for the SQLL session on AI and quantum computing, Baridhara DOHS, 3 October 2026. Dr. Syed Muntasir Mamun, ORCID 0000-0001-6845-2853. The views expressed are those of the author.
K SC Governments are adopting artificial intelligence at the same moment that the cryptographic assumptions under their long-lived secrets are being placed on a clock. This paper treats four developments as a single problem of digital trust rather than as separate technical topics. First, AI systems are moving from content generation to agentic action, and are already exposed to impersonation, poisoning and unauthorised use. Second, persistent memory across sessions creates a new class of institutional record, whose integrity cannot be reduced to a signature. Third, cryptographic security depends on unpredictable keys, not on non-determinism, and better randomness does not answer a quantum attack on public-key mathematics. Fourth, harvest-now-decrypt-later means that the threat to data which must remain confidential for decades exists before a cryptographically relevant quantum computer does. Drawing on published resource estimates, the NIST post-quantum standards, and the positions of major security agencies on quantum key distribution, the paper argues that preparation should begin with an inventory of vulnerable cryptography, hybrid migration of high-value key exchange, and an explicit regime for the ownership and correction of AI memory. The implications for diplomatic communications and for states with constrained compute and language resources are developed throughout. Also available on Academia.edu: https://www.academia.edu/attachments/134650176/download_file?s=portfolio
Agentic AI systems depend on classical public-key cryptography for agent identity, tool invocation, inter-agent communication, model integrity, and persistent state, exposing them to a cryptographically relevant quantum computer (CRQC) along two axes: confidentiality (harvest-now-decrypt-later) and integrity (harvest-now-forge-later). Existing post-quantum migration guidance addresses static, operator-controlled enterprise estates, while emerging agent-identity work omits post-quantum cryptography entirely; neither treats non-human-identity-dense, runtime-negotiated agentic systems as a distinct migration class. This paper develops a conceptual framework that does. It organizes agentic cryptography into seven migration surfaces and separates each identity into a credential layer (symmetric, operator-held, low-risk) and a trust-anchor layer (the asymmetric roots that underwrite the fleet). These layers scale inversely: a small set of trust anchors carries a forge-later blast radius equal to the population beneath it, so migration effort and forge-later risk rank the work in opposite orders. A migration matrix and a parametric effort-and-risk model formalize this, yielding the core sequencing rule: migrate anchors first. Because agentic adoption is ongoing, it also reframes migration from a finite inventory into a continuously regenerating problem, distinguishing remediation of the installed base from prevention of new classical-cryptographic debt in future deployments. It closes with oversight and procurement implications for federal post-quantum readiness.
Purpose: The purpose of this paper is to examine the emerging threat that large-scale quantum computing poses to classical public-key cryptographic systems, particularly RSA and Elliptic Curve Cryptography (ECC), which form the backbone of contemporary digital security infrastructures. In response to this threat, the study aims to analyze post-quantum cryptography (PQC) as a viable long-term solution capable of resisting both classical and quantum adversaries. The paper further seeks to assess the urgency of PQC adoption in light of the “harvest now, decrypt later” threat model and to evaluate the practical readiness of quantum-safe cryptographic algorithms currently under consideration by the National Institute of Standards and Technology (NIST). Materials and Methods: This study employs a qualitative and analytical research methodology grounded in an extensive review of authoritative sources, including NIST’s post-quantum cryptography standardization documents, recent academic literature, industry white papers, and policy reports from organizations such as RAND Corporation and Cloudflare. The analysis systematically surveys major families of post-quantum cryptographic algorithms namely lattice-based, code-based, and hash-based schemes and evaluates them based on security assumptions, computational efficiency, implementation complexity, and standardization maturity. Findings: The analysis indicates that Lattice-based cryptographic schemes demonstrate the highest maturity and practical readiness, evidenced by their selection in NIST’s PQC process. Code- and hash-based methods provide strong security but face key size and performance challenges. The lack of scalable quantum computers does not reduce urgency, as data harvesting persists. Artificial intelligence emerges as a key enabler for accelerating PQC adoption. Unique Contribution to Theory, Practice and Policy: The paper recommends a proactive, phased post-quantum migration using hybrid cryptographic architectures. Organizations should conduct inventories, benchmarking, and pilot deployments aligned with NIST standards. AI-driven tools are advised to improve key management and reduce complexity. Continued interdisciplinary research and policy support are encouraged to ensure a secure, scalable transition to quantum-resistant security systems.
The simultaneous maturation of quantum computing and artificial intelligence represents a defining inflection point for the security of digital civilization. This chapter examines the convergence of these two transformative forces through a bidirectional analytical lens: how artificial intelligence can accelerate and improve the organizational transition to post-quantum cryptography and how post-quantum cryptographic standards must be applied to secure AI infrastructure itself. Building on the NIST finalization of FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024 and the subsequent selection of HQC in March 2025, the chapter develops a practitioner-oriented treatment of the algorithmic foundations, performance characteristics, and deployment realities of each standardized scheme. A dedicated section develops the “Harvest Now, Decrypt Later” (HNDL) threat as a present-tense security emergency rather than a future concern and introduces a novel detection architecture that integrates HNDL behavioral indicators into the streaming telemetry pipeline of Chapter 2 and the AI-SOC framework of Chapter 4 . The chapter examines AI-assisted cryptographic discovery, inventory automation, side-channel vulnerability detection, and migration workflow orchestration as tools for managing the organizational complexity of the PQC transition. It addresses the reciprocal challenge of applying PQC to AI infrastructure itself – securing large language model inference pipelines, federated learning gradient exchanges, agentic communication channels, and model provenance attestation against quantum-capable adversaries. A practical deployment section documents the installation and operation of the Open Quantum Safe liboqs library and OQS-OpenSSL provider on Ubuntu 24.04 LTS, with original step-by-step guidance derived from direct implementation experience. The chapter closes by synthesizing the governance requirements, policy timelines, and organizational frameworks that responsible PQC transition demands – and by tying together the 11-chapter arc of this book into a single coherent argument about what secure looks like in the age of autonomous defense.
The growing concern around AI-driven cyber threats has often overshadowed a deeper structural weakness within enterprise security systems, namely the fragile state of cryptographic foundations that were never built for long-term resilience. While artificial intelligence amplifies the speed and scale of attacks, quantum computing introduces a more disruptive possibility, the obsolescence of widely used public-key encryption. The release of post-quantum algorithms by the National Institute of Standards and Technology marks an important milestone; however, the broader challenge extends beyond algorithm selection to issues of data sovereignty, interoperability, and delayed preparedness. Sensitive assets such as financial systems, healthcare records, national security data, and intellectual property remain exposed under a harvest now, decrypt later strategy already adopted by adversaries. This situation calls for a shift from reactive cybersecurity measures toward crypto-agility, where enterprises actively assess cryptographic inventories, align with emerging standards, embed quantum-resistant mechanisms, and integrate intelligent threat detection with durable encryption strategies. Leading cloud and technology providers including IBM, AWS, Microsoft Azure, and Google Cloud Platform have begun operationalizing quantum-safe initiatives through structured discovery, migration roadmaps, hybrid cryptographic models, and enterprise-wide inventory assessments. The transition toward quantum-safe security is not a temporary fix but a long-term architectural transformation aimed at ensuring governance, compliance, and institutional survival in an evolving threat landscape.
The impressively fast development of quantum computing is a serious threat to classical public-key cryptography, and algorithms such as Shor's and Grover's will render RSA and elliptic curve systems essentially useless as soon as a cryptanalytically relevant quantum computer becomes available. Although it is still some way off before such machines are available, the harvest-now-encrypt-later threat highlights the need for proactive defense. In response, the National Institute of Standards and Technology (NIST) published the first post-quantum cryptography standards in 2024, including ML-KEM (Kyber) for key establishment, ML-DSA (Dilithium) for digital signatures and SLH-DSA (SPHINCS+) as a stateless hash-based alternative. This paper is a summary of the evolving post-quantum landscape, starting with the standards and their underlying security and then moving on to migration policies such as CNSA 2.0 and CISA, NSA and NIST guidance. It also looks at integration patterns for important protocols such as TLS, IPsec, SSH, and code signing. A performance, interoperability and overhead evaluation methodology is presented with results showing that hybrid deployment and crypto-agile architectures make PQC adoption a viable option. The paper concludes by providing a governance-oriented roadmap, where inventory, prioritization and pilot deployments are identified as near-term actions, with open questions remaining on performance optimization, implementation security and algorithm resilience over time.