The public-key cryptography that protects government websites, digital signatures, identity services and data exchange would be broken by a large fault-tolerant quantum computer. Although such a machine does not yet exist, sensitive data captured today can be stored and decrypted later, and large government systems take many years to change. Standards bodies have now published the first post-quantum cryptographic algorithms, and security agencies advise organisations to start preparing. This paper proposes a practical, six-stage migration framework for Indian e-government systems: (1) governance and ownership; (2) cryptographic discovery and inventory; (3) risk-based prioritisation using data shelf-life; (4) crypto-agile architecture and procurement; (5) phased migration with hybrid deployment and testing; and (6) assurance and continuous monitoring. It offers a simple prioritisation matrix, a checklist of procurement clauses and a set of readiness indicators that state IT departments and ministries can adopt. The framework is written for public-sector programme managers rather than cryptographers, and focuses on the organisational work that determines whether technical migration succeeds. It is a practitioner framework based on published standards and guidance; it does not evaluate specific products.
The public-key cryptography that protects government websites, digital signatures, identity services and data exchange would be broken by a large fault-tolerant quantum computer. Although such a machine does not yet exist, sensitive data captured today can be stored and decrypted later, and large government systems take many years to change. Standards bodies have now published the first post-quantum cryptographic algorithms, and security agencies advise organisations to start preparing. This paper proposes a practical, six-stage migration framework for Indian e-government systems: (1) governance and ownership; (2) cryptographic discovery and inventory; (3) risk-based prioritisation using data shelf-life; (4) crypto-agile architecture and procurement; (5) phased migration with hybrid deployment and testing; and (6) assurance and continuous monitoring. It offers a simple prioritisation matrix, a checklist of procurement clauses and a set of readiness indicators that state IT departments and ministries can adopt. The framework is written for public-sector programme managers rather than cryptographers, and focuses on the organisational work that determines whether technical migration succeeds. It is a practitioner framework based on published standards and guidance; it does not evaluate specific products.
Quantum computing is no longer a distant concern for cybersecurity planning. Its progress has raised serious questions about the long-term reliability of widely used public-key cryptographic systems, especially RSA, elliptic curve cryptography, and related key exchange mechanisms that currently protect digital communication, cloud services, financial transactions, government systems, and enterprise information assets. The main concern is that powerful quantum algorithms could weaken the mathematical assumptions on which these systems depend, creating future risks for encrypted data, digital signatures, identity systems, and secure network protocols (Shor, 1994; Mosca, 2018). Post-quantum cryptography has therefore become a major cybersecurity readiness priority, not only as a technical replacement for vulnerable algorithms, but as a broader organizational migration challenge. Effective preparation requires cryptographic asset inventory, risk classification, crypto-agility, vendor coordination, interoperability testing, and phased deployment across complex information systems (Kumar, 2022; Campbell, 2025). This article examines the cybersecurity implications of quantum computing and reviews the major post-quantum cryptographic algorithm families, current standardization efforts, enterprise migration barriers, and strategic readiness measures needed for the quantum computing era. It also discusses the importance of aligning post-quantum migration with existing cybersecurity governance, information systems management, and long-term digital resilience planning. By emphasizing early preparation, structured migration, and continuous cryptographic governance, the article argues that organizations can reduce future quantum-related exposure and strengthen the security of critical digital infrastructure before large-scale quantum attacks become practical (NIST, 2024; NCCoE, 2025).
India's digital governance infrastructure, spanning Aadhaar, UPI, DigiLocker, and critical sectors such as defence, finance, and telecommunications, is built upon classical publickey cryptography (RSA, ECC). The emergence of fault-tolerant quantum computers threatens to dismantle these foundations through Shor's algorithm, which solves integer factorisation and discrete logarithm problems in polynomial time, while Grover's algorithm reduces symmetric key security. The "harvest now, decrypt later" strategy magnifies the urgency, as adversaries can store encrypted data today for future decryption. This paper provides a comprehensive analysis of the post-quantum cryptography (PQC) migration imperative for India. We examine the quantum threat landscape, review candidate PQC families (lattice-, code-, multivariate-, hash-, and isogeny-based) and the newly standardised NIST algorithms, and detail the technical, regulatory, and economic challenges of large-scale PQC adoption in India's heterogeneous e-governance ecosystem. A phased implementation roadmap aligned with the National Quantum Mission (2026 to 2035) is presented, prioritising critical sectors (defence, banking, telecom, Aadhaar/UPI). The paper further highlights strategic opportunities for indigenous capability building, global certification leadership, and the reinforcement of digital sovereignty. By synthesising official reports, international standards, and sector-specific requirements, this work offers actionable guidance for transitioning India's governance to a quantum-resilient future. The paper further proposes the Quantum Governance Readiness and Infrastructure Decision Framework (Q-GRID), an India-specific, measurable decision framework that integrates quantum exposure, data longevity, systemic criticality, dependency, migration complexity, and regulatory urgency into a composite Quantum Risk Index to prioritise migration actions.
Abstract Quantum computing threatens the public-key cryptography on which contemporary digital infrastructure depends, and the practical question has shifted from whether that threat will materialise to how quickly organisations are obliged to respond. Two developments drove this shift: the United States National Institute of Standards and Technology published its first post-quantum cryptographic standards in August 2024, and in June 2026 an executive order attached binding dates to their adoption across federal systems and federal contractors. This review examines those developments through targeted retrieval of primary standards and policy documents, together with peer-reviewed cryptanalytic and resource-estimation literature, with bibliographic details verified against publisher records. Three principal findings emerge. First, the standardised portfolio is smaller than commonly reported: three Federal Information Processing Standards are published, a fourth remains in development, and a fifth algorithm has been selected but not yet standardised, a distinction that matters because procurement obligations attach only to published standards. Second, two candidates that reached advanced evaluation were defeated by classical rather than quantum cryptanalysis, one within a weekend on consumer hardware. Third, published estimates of the quantum resources required to break widely deployed key sizes have moved by more than an order of magnitude in a single dimension within six years, exchanging machine size for running time. The review concludes that cryptographic agility, not the selection of any particular algorithm, is the durable objective, and that migration should be prioritised by the confidentiality lifetime of data rather than by forecasts of adversary capability. Keywords: Standardization; Keywords: post-quantum cryptography; cryptographic migration; cryptographic agility; critical infrastructure
The emergence of cryptographically relevant quantum computing presents a strategic governance challenge for national security because contemporary digital infrastructures depend extensively on public-key cryptographic mechanisms whose long-term security may be threatened by sufficiently capable quantum computers. This research examines post-quantum cryptographic governance as a policy, risk-management, interoperability, and implementation problem rather than solely as a cryptographic algorithm-selection exercise. The study adopts a conceptual research-and-review methodology based exclusively on the supplied literature, using insights from security and privacy, interoperability, digital transformation, standards-based architectures, and emerging technology governance to construct an integrated post-quantum governance framework. Particular attention is given to cryptographic inventory, risk prioritization, migration governance, interoperability, institutional accountability, lifecycle management, and national-security continuity. The analysis indicates that post-quantum readiness requires coordinated governance across technical and organizational layers, with migration decisions guided by asset criticality, data longevity, dependency relationships, and operational constraints. The study further argues that interoperability principles are central to post-quantum migration because cryptographic transitions must coexist with heterogeneous legacy systems and distributed information environments. The proposed framework therefore combines risk assessment, policy development, technical migration, validation, monitoring, and institutional oversight. The research contributes a governance-oriented perspective in which cryptographic agility and standards-based interoperability become strategic national-security capabilities rather than isolated technical controls.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.
Large-scale quantum computers threaten the public-key cryptography that protects enterprise data, communications, and digital identity. Shor's algorithm solves integer factorization and discrete logarithms in polynomial time, which would break RSA, Diffie-Hellman, and elliptic-curve schemes once a cryptographically relevant quantum computer exists. The danger is not only future. Adversaries can record encrypted traffic today and decrypt it later, a tactic known as harvest-now-decrypt-later. In August 2024 the U.S. National Institute of Standards and Technology published its first post-quantum standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, from CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, from SPHINCS+). This paper presents a practical migration framework for enterprises. It reviews the quantum threat and Mosca's inequality for timing the transition, summarizes the new standards with their key and signature sizes, and proposes a five-phase roadmap built on crypto-agility: discovery and inventory, risk prioritization, agility engineering, hybrid deployment, and validation. Performance trade-offs are analyzed using documented parameter sizes and illustrative TLS handshake figures. ML-KEM-768 carries a 1,184-byte public key against 64 bytes for an elliptic-curve key, while SPHINCS+ signatures can exceed 17 kilobytes. The work does not report a real deployment. It consolidates published parameters and field guidance into an actionable plan, and it highlights open challenges in certificate sizing, hardware support, and long-lived embedded systems.