Quantum computers will break RSA and ECC — and “Harvest now, decrypt later” already puts your data at risk today. We guide you safely through the EU and BSI deadlines of 2030/2035 with a readiness assessment, cryptographic inventory, and migration roadmap.
of human web traffic through Cloudflare already uses quantum-safe key establishment
noisy qubits are enough, according to Google research, to factor RSA-2048 in under a week — 20× fewer than estimated in 2019
EU deadline for high-risk use cases — identical to the BSI deadline for very high protection requirements
last date until which BSI recommends purely classical key establishment at all
The quantum computer that breaks RSA-2048 doesn't exist yet — but attackers don't need to wait for it. Today, they're already capturing encrypted traffic and copied data sets and stockpiling them. As soon as a cryptographically relevant quantum computer (CRQC) becomes available, everything gets decrypted retroactively.
That's why what matters isn't the date of Q-Day, but the confidentiality lifetime of your data: anything that will still need protection in 10 years and is transmitted or stored today using classical encryption is already exposed. NIST and CISA explicitly warn against this pattern.
TLS traffic, VPN tunnels, backups, and data exfiltration are intercepted — inconspicuously, because the content is (still) unreadable.
Storage is cheap. Intelligence agencies and organized crime deliberately archive ciphertext for the day it can be broken.
A CRQC breaks the key establishment used at the time — unlocking the entire archived data set retroactively.
Mosca's theorem makes the urgency measurable: if shelf life x plus migration time y is greater than the time z remaining until a cryptographically relevant quantum computer exists, your data is already lost — mathematically speaking, today. Set your own values:
Data captured today would be decryptable before its shelf life expires. HNDL-exposed transmission paths need to be prioritized immediately: a readiness assessment, cryptographic inventory, and a hybrid pilot this year.
After Michele Mosca (Institute for Quantum Computing, University of Waterloo). The test doesn't replace a risk analysis — it shows why your start date shouldn't depend on Q-Day.
Regulators have set the timeline — backed internationally by the NSA (CNSA 2.0: exclusive PQC use per system category by 2030–2033). Click through the milestones:
FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) are final — the reference algorithms that BSI and the EU roadmap also point to. Waiting for standards to arrive is no longer an excuse.
The Quantum Safe Financial Forum at Europol calls on banks, providers, and supervisory authorities to make PQC migration a strategic priority. In early 2026, a joint prioritization methodology for migration activities follows with FS-ISAC.
NIST selects HQC, a code-based scheme, as a reserve alongside ML-KEM; the final standard is expected in 2027. FN-DSA (Falcon, FIPS 206) is nearing finalization. Crypto-agility remains mandatory — algorithms can still change.
The NIS Cooperation Group (co-chaired by Germany, France, and the Netherlands) sets the EU-wide roadmap: transition starts immediately, national plans due by end of 2026, high-risk use cases by end of 2030, and completion as far as possible by end of 2035.
All member states are expected to have started the transition and submitted national implementation plans. In concrete terms for businesses: a cryptographic inventory, risk analysis, and an initial roadmap belong in 2026.
EU deadline for high-risk use cases — including critical financial and KRITIS infrastructure. BSI requires migration for very high protection requirements by the same date. NIST (draft IR 8547) classifies RSA-2048 and P-256 as deprecated starting in 2030.
TR-02102-1 (version 2026-01) recommends the sole use of classical key establishment only until end of 2031. After that: PQC or hybrid schemes — for example, ML-KEM combined with ECDH via CatKDF or KeyCombine (NIST SP 800-227).
The EU's target date for completing migration as fully as possible; classical signature schemes should also be phased out by end of 2035, per BSI recommendation. The NIST draft treats RSA and ECC as disallowed starting in 2035. Certificate chains and PKI need years of lead time to get there.
The replacement map for your architecture — from key establishment to PKI. All these algorithms run on classical hardware; only the attackers need quantum hardware.
| In Use Today | Quantum-Safe Successor | Standard / Status |
|---|---|---|
| RSA encryption / RSA-KEM | ML-KEM (Kyber) | FIPS 203 · final since 08/2024 |
| ECDH / X25519 | Hybrid: X25519MLKEM768 | IETF standardization · default in Chrome, Edge & Firefox |
| Static DH keys | KEM + ephemeral hybrid schemes | BSI: hybrid via CatKDF / KeyCombine (SP 800-227) |
| HQC (reserve) | code-based backup KEM | NIST selection 03/2025 · standard expected 2027 |
For the transition period, BSI recommends hybrid key establishment: classical + PQC combined, so that a break in one algorithm doesn't cost you confidentiality.
| In Use Today | Quantum-Safe Successor | Standard / Status |
|---|---|---|
| RSA-PSS / ECDSA | ML-DSA (Dilithium) | FIPS 204 · final since 08/2024 |
| Conservative alternative | SLH-DSA (SPHINCS+) | FIPS 205 · hash-based, larger signatures |
| Compact alternative | FN-DSA (Falcon) | FIPS 206 · nearing finalization, expected 2026 |
| Firmware & code signing | LMS / XMSS (stateful) | NIST SP 800-208 · production-ready today |
Signatures require a longer lead time: certificate chains, root CAs, and signed long-term documents must be fully migrated before end of 2035 (the BSI/EU horizon).
| In Use Today | Quantum-Safe Successor | Standard / Status |
|---|---|---|
| AES-128 | AES-256 | Recommended — Grover effectively halves the security level |
| SHA-256 | SHA-384 / SHA-3 for high protection requirements | Hash functions are considered quantum-resistant |
| 3DES, SHA-1, RSA-1024 | Retire immediately | Overdue regardless of PQC — a quick win for any audit |
Symmetric cryptography survives the quantum computer: sufficient key lengths are all it takes. Migration efforts focus on asymmetric algorithms.
| In Use Today | Quantum-Safe Successor | Standard / Status |
|---|---|---|
| TLS 1.2 | TLS 1.3 with hybrid groups | X25519MLKEM768 — already > 50% of Cloudflare traffic |
| IPsec / VPN | Hybrid IKEv2 extensions | RFC 8784 (PPK) & follow-on standards |
| Classical PKI | PQC & hybrid certificates, cryptographic inventory per CA | Pilot-ready — dual certificates for internal services |
| HSM / KMS estate | PQC-capable firmware or successor models | Demand vendor roadmaps contractually now |
Protocols and key infrastructure are the critical path: this is what determines whether your migration takes months or years.
Modular and bookable individually — as a compact baseline assessment or as a guided migration program spanning several years.
A baseline assessment in 2–4 weeks: where does your organization stand against the EU roadmap, BSI TR-02102-1, DORA, and NIS2 — and what are the three most important next steps?
You can only migrate what you know about. We survey your cryptographic landscape across network, code, and infrastructure — consolidated into a maintained Cryptography Bill of Materials.
Not everything needs to migrate immediately — but the right things need to migrate first. We assess systems by shelf life, HNDL exposure, and criticality, and prioritize your migration sequence.
The roadmap through 2030/2035: a target architecture with centralized key management, governance, and policies — with crypto-agility as a design principle, so the next algorithm change becomes routine.
From paper to production: we support hybrid pilots and the first migration waves — with testing that realistically models larger keys, handshake latency, and failover.
Turning deadlines into audit-ready evidence: we translate DORA, NIS2, PCI DSS, and CRA into your cryptographic policies and prepare you for audits and supervisory conversations.
A proven sequence drawn from financial-sector and KRITIS projects — each phase with clear deliverables, each phase can be commissioned individually.
Cryptographic inventory and CBOM setup, governance structure with crypto owners, vendor inquiries — and quick wins: SHA-1, 3DES, and RSA-1024 get retired immediately.
Shelf life per data class, HNDL exposure per transmission path, Mosca analysis, and criticality — together, these produce a migration sequence your management can stand behind.
A target architecture with centralized key management, crypto-agility principles, policy updates, and a phased plan with budget — aligned with EU/BSI deadlines and your own release cycles.
Hybrid TLS on live services, PQC certificates in the test PKI, HSM firmware and libraries in field trials — including performance measurement and SOC integration.
Migration waves by priority, CI/CD gates against shadow cryptography, an exception register for legacy systems — and monitoring that turns the next algorithm change into routine.
Timeframes reflect a typical mid-market profile. Enterprise landscapes and heavily regulated institutions should plan longer per wave — which is exactly what prioritization is for.
PQC isn't a distant technology question anymore — it has arrived in supervisory law and standards:
Since January 2025, DORA has required documented, state-of-the-art encryption and key management policies; PCI DSS 4.0.1 has required a maintained cryptographic inventory since March 2025. Europol (QSFF) and the G7 are pushing the sector to prioritize migration now.
DORA × ISO 27001NIS2 explicitly names cryptography and encryption as a mandatory, state-of-the-art measure — and the EU roadmap classifies critical infrastructure as a high-risk use case with a deadline of end of 2030. Your cryptography concept belongs in the ISMS, not in an appendix.
NIS2 AdvisoryProducts launched under the Cyber Resilience Act from 2027 onward, with 10–15-year field lifetimes, will experience Q-Day while still in service. Crypto-agility and updatable key schemes become a design requirement — from automotive to medical technology.
Product SecurityETSI is tightening minimum requirements (including RSA from 3000 bits for trust services), and EU member states will submit national PQC plans by end of 2026. If you work with government agencies or public tenders, expect to see quantum readiness show up in procurement requirements.
IT Security AuditsSix questions, two minutes — an honest baseline assessment along the same checkpoints we use in our own assessments.
Answer all six questions to see your results.
Without an inventory and shelf-life data, you can neither prioritize nor budget. The fastest lever: a PQC readiness assessment with a cryptographic inventory — afterward, you'll have both a roadmap foundation and a management narrative.
Discuss Your Results — Book a ConsultationThe basics are covered, but risk and sequencing aren't yet solid enough to act on. A quantum risk analysis and a roadmap with a supplier and HSM plan turn isolated measures into a program.
Discuss Your Results — Book a ConsultationYou're further along than most. What counts now is hardening your pilot, operationalizing crypto-agility, and building audit-ready evidence — turning readiness into compliance that meets its deadlines.
Discuss Your Results — Book a ConsultationPost-quantum cryptography (PQC) refers to cryptographic algorithms that remain secure even against attacks using quantum computers — for example, ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) for signatures. PQC runs on today's classical hardware: you don't need a quantum computer to protect yourself. PQC should be distinguished from Quantum Key Distribution (QKD), which requires specialized hardware and, according to BSI, does not replace classical algorithms.
There's no reliable date — estimates for a cryptographically relevant quantum computer (CRQC) range from the early 2030s to 2040. Resource estimates, however, are dropping fast: Google researchers showed in 2025 that under a million noisy qubits could be enough to break RSA-2048 — 20 times fewer than assumed in 2019. Because of Harvest now, decrypt later, the exact date is secondary anyway: long-lived data is already exposed today.
Attackers record and store today's encrypted communications and data sets so they can decrypt them retroactively once a quantum computer becomes available. NIST and CISA explicitly warn against this pattern. This affects anything whose shelf life extends beyond the expected Q-Day — financial and health data, contracts, design data, identities.
The EU roadmap (NIS Cooperation Group, June 2025) requires: transition start and national plans by end of 2026, migration of high-risk use cases by end of 2030, and completion as far as possible by end of 2035. BSI recommends, in TR-02102-1 (2026-01): very high protection requirements migrated by end of 2030, purely classical key establishment only until end of 2031, and classical signature schemes phased out by end of 2035. NIST (draft IR 8547) plans to classify RSA/ECC as deprecated from 2030 and disallowed from 2035.
Via the Delegated Regulation (EU) 2024/1774 (Art. 6–7), DORA requires documented policies for encryption and cryptographic key management across the full lifecycle — including a certificate inventory and an obligation to follow leading practices. NIS2, in Art. 21(2)(h), names cryptography and encryption as a mandatory, state-of-the-art measure. In effect, both frameworks presuppose a cryptographic inventory and crypto-agility.
Crypto-agility is the ability to swap out cryptographic algorithms without a redesign — through central libraries, configuration instead of hardcoding, and centralized key management. It's a core requirement of both the EU roadmap and supervisory practice, because algorithms will keep changing: NIST has already selected HQC as a backup KEM, and FN-DSA is nearing finalization. Migrate with agility today, and the next switch becomes routine instead of a project.
A CBOM catalogs, in machine-readable form, which cryptographic algorithms, keys, certificates, and libraries are embedded in your systems and products — analogous to an SBOM for software components, for example in CycloneDX format. It's the working tool of migration: without a CBOM, there's no solid prioritization, no supplier management, and no evidence for auditors and supervisory authorities.
Symmetric algorithms and hash functions are considered quantum-resistant: the Grover algorithm effectively halves the security level, which is why AES-256 is recommended over AES-128 — a configuration change, not an architectural overhaul. Migration efforts focus on asymmetric algorithms. Getting started is predictable: our PQC readiness assessment takes two to four weeks and delivers a maturity score, gap analysis, and prioritized roadmap as a basis for decision-making.
All deadlines and figures on this page are drawn from the following documents (as of September 2026):
30 minutes, a concrete initial assessment: where do you stand against the 2030/2035 deadlines — and what's the most sensible first step for you? No obligation, vendor-neutral, with an NDA on request.
