Since August 2015, the U.S. government has been preparing for the potential emergence of a cryptographically relevant quantum computer (CRQC). Such a computer could compromise widely used public-key cryptographic algorithms, including RSA and elliptic-curve cryptography (ECC). Estimates of when this capability might emerge vary considerably, with some experts projecting its arrival around 2030 and others anticipating a longer timeline.
The National Security Agency (NSA) and Committee on National Security Systems (CNSS) began addressing this threat by advising against significant new investments in quantum-vulnerable cryptography and encouraging preparation for quantum-resistant alternatives. Subsequent government policies, standards, and strategies have established requirements and milestones for transitioning to post-quantum cryptography (PQC).
The timeline below traces these developments, from foundational research through current government migration efforts and future milestones.
Each point links to a supporting document or reference. Dashed diamonds indicate planned milestones rather than published documents.
In 1994, Peter Shor demonstrated that a sufficiently capable quantum computer could efficiently break widely used public-key cryptographic systems, including RSA, Diffie-Hellman, and ECC. Two years later, Lov Grover developed an algorithm that could accelerate certain cryptographic attacks, effectively reducing the security strength of symmetric keys against exhaustive search. Unlike the threat posed by Shor’s algorithm, Grover’s impact can largely be mitigated through appropriate symmetric key lengths.
These discoveries established the theoretical threat of quantum computing to modern cryptography, although practical implementation requires quantum computing capabilities that remain technically challenging to achieve. Research into quantum-resistant alternatives subsequently expanded, including Oded Regev’s 2005 work on learning with errors (LWE), which helped establish the mathematical foundations of modern lattice-based cryptography. The field became widely known as post-quantum cryptography during this period.
The emergence of a cryptographically relevant quantum computer is commonly referred to as Q-Day. A CRQC can be used for more than one attack. Authentication failures, forged signatures, and impersonation are a primary concern for the Department of War and its partners. Previously collected encrypted traffic may also become accessible if its confidentiality depended on vulnerable key-establishment mechanisms.
The references below highlight foundational developments in post-quantum cryptography.
| ID | Date | Document | Phase | Source |
|---|
Systems engineering research has long recognized that correcting requirements and integration problems can become increasingly expensive as systems mature. A cost-of-change model originating with the Defense Acquisition University in 1993, and retained in the 2023 INCOSE Systems Engineering Handbook, illustrates how early engineering decisions commit substantial lifecycle costs while later corrections can require extensive rework.
This principle is particularly relevant to PQC migration. Replacing vulnerable cryptography across existing Army systems may affect established architectures, network dependencies, operational requirements, and fielded equipment. Discovering these constraints early allows the Army to address them before implementation decisions and schedules become difficult to change.
The Army’s experience with complex network modernization demonstrates two ways that unresolved requirements can complicate implementation. WIN-T Increment 2 illustrates the importance of operational suitability, while the Joint Regional Security Stacks (JRSS) initiative highlights the challenges of enterprise integration. Both provide lessons for identifying PQC migration requirements before widespread deployment.
Warfighter Information Network-Tactical (WIN-T) Increment 2 introduced mobile tactical networking capabilities intended to improve communications across Army formations. Operational testing revealed challenges involving equipment complexity, usability, and the demands placed on Soldiers operating the system. These findings contributed to subsequent changes in the Army’s approach to tactical networking.
The lesson for PQC migration is that technical capability alone does not establish operational suitability. Cryptographic solutions must function within realistic tactical conditions, including constrained processing resources, network limitations, and operator workload. Identifying these requirements before fielding reduces the risk of discovering costly operational constraints after implementation.
The Joint Regional Security Stacks (JRSS) initiative sought to consolidate and modernize security capabilities across Department of Defense networks. Implementing these capabilities at enterprise scale introduced challenges involving legacy applications, network dependencies, interoperability, and performance. These difficulties illustrate how integrating new technologies into established infrastructure can reveal requirements that were not fully understood during planning.
PQC migration presents similar integration risks. Changes to cryptographic algorithms, protocols, key sizes, and processing requirements can affect interconnected applications, devices, and network services. Dependencies discovered after implementation begins may require additional engineering, testing, or modifications to deployed systems. Identifying these relationships early allows the Army to incorporate them into requirements and evaluate their operational consequences before widespread deployment.
PQC migration is already urgent. The federal government treats every contract and system as having only a couple of years to be updated. Unlike unforeseen technological challenges, the need to replace quantum-vulnerable cryptography is already established. Although the arrival of a cryptographically relevant quantum computer remains uncertain, the engineering work required to prepare for migration can begin now.
The lesson from WIN-T and JRSS is not simply that technology transitions are difficult. It is that operational requirements and system dependencies must be understood before they become expensive implementation problems. Cryptographic inventory, dependency mapping, performance testing, and operational validation can reduce that uncertainty while preserving time to address discovered limitations.
Prioritize requirements discovery and assessment early to reduce the risk of costly rework during PQC migration. Key activities include:
Incomplete discovery increases the risk of fielding systems that require costly modifications, potentially delaying migration and affecting operational readiness.
Acquisition, Testing, and Licensing Authorization for Security (ATLAS) provides a centralized process for submitting and tracking post-quantum cryptography solutions across the Department of War. The Department requires visibility into PQC products being evaluated, acquired, or deployed by its Components.
Government sponsors submit proposed solutions through ATLAS, which records their authorization for use as PQC. Only ATLAS-authorized solutions and systems may be accounted as PQC. Sharing this information can reduce redundant testing and support more informed acquisition decisions. Components remain responsible for ascertaining that a system meets functional requirements.
ATLAS provides a centralized intake and tracking process for proposed PQC solutions. Components remain responsible for ascertaining that a system meets functional requirements. They do not decide, outside ATLAS, whether a product is PQC or whether it is viable to acquire as PQC. ATLAS authorization is necessary for PQC. It is not NSA approval, and it is not sufficient for the other requirements a product must already meet before acquisition.
A government sponsor initiates the ATLAS submission using the designated intake questionnaire. The questionnaire collects standardized information about the proposed solution. Vendors provide the supporting documentation identified in the questionnaire. Submissions that remain incomplete seven days after initiation are closed.
ATLAS tracks submitted PQC solutions, their authorization status, and available testing results across Department Components. This includes information about national security system certification and product performance, where applicable. The shared record helps Components identify previously authorized solutions. ATLAS authorization is necessary for a solution to be accounted as PQC. It is not sufficient for the other requirements a product must already meet before acquisition.
Responses to the questionnaire must be provided on a network that supports such classification.
The following resources provide access to current government policies, technical guidance, implementation tools, and PQC-related initiatives. These resources are updated periodically as government migration efforts progress.
| Org | Resource | Source |
|---|
Special PQC-related documents sit on intelink.gov. CAC registration takes about 24 hours.
