Post-quantum: understanding the threat and preparing the migration

The essentials

• The threat is known; its date is not. A sufficiently powerful quantum computer would break RSA and elliptic-curve cryptography. No one knows when such a machine will exist. However, data intercepted today can be stored and decrypted later.
• The standards are ready. In August 2024, NIST (the U.S. National Institute of Standards and Technology) published the ML-KEM, ML-DSA and SLH-DSA standards. Two additions, FN-DSA and HQC, are still being prepared. There is no need to wait for them to get started.
• ANSSI sets a course. France's national cybersecurity agency strongly recommends hybridization. It aims to introduce post-quantum requirements for product qualification starting in 2027, and considers it will “not be reasonable” to buy products without post-quantum cryptography after 2030.
• The European Union has a timeline. Member states must have started the transition by the end of 2026 and protected high-risk uses by the end of 2030 at the latest. The overall horizon is 2035.
• Deployment has begun. Hybrid key exchange is enabled by default in major browsers and in OpenSSH. Signatures and certificates are the work that remains, with first milestones expected in 2027.
• For an SME, organization comes first. That means taking inventory, identifying long-lived data, updating TLS and SSH, and building the requirement into procurement.

What are we talking about?

Almost all digital exchanges rely on public-key cryptography. It is used to establish a secret key between two parties (key exchange) and to prove the origin of a message or a piece of software (signature). The algorithms used today, RSA and elliptic curves (ECDH, ECDSA), would be broken by a so-called “cryptographically relevant” quantum computer. Symmetric cryptography (AES) and hash functions are far less exposed.

Post-quantum cryptography (PQC) refers to new algorithms designed to withstand these attacks. They run on today's computers: this is not quantum cryptography.

“Harvest now, decrypt later”

An attacker can record encrypted communications today and wait until they have the means to decrypt them. Any data that must remain confidential for many years is therefore already at risk: health data, trade secrets, sensitive personal data, defense information. In a report published on October 7, 2026, Europol stresses that uncertainty about when quantum computers will arrive “should not be the main concern,” because adapting systems takes time. The agency also notes that there is no clear evidence of systematic, large-scale use of this technique. We covered this report and the one from the GAO, the U.S. Congress's audit body, in Post-quantum: the U.S. GAO and Europol call for faster migration.

Signatures are less urgent. A forged signature is only dangerous once the quantum computer exists. Still, organizations need to plan ahead for long-lived objects and systems (roots of trust, firmware, cards), which will be hard to update later.

NIST standards

NIST ran a multi-year international competition. Its results serve as a global reference, including for ANSSI.

Standard	Use	Origin	Status as of October 12, 2026
FIPS 203 — ML-KEM	Key establishment (primary algorithm)	CRYSTALS-Kyber	Published on August 13, 2024
FIPS 204 — ML-DSA	Signature (primary algorithm)	CRYSTALS-Dilithium	Published on August 13, 2024
FIPS 205 — SLH-DSA	Hash-based signature (backup solution)	SPHINCS+	Published on August 13, 2024
FIPS 206 — FN-DSA	Compact signature	Falcon	Being standardized, final version not yet published
HQC	Key establishment (backup for ML-KEM)	Error-correcting codes	Selected on March 11, 2025. NIST planned a draft standard about a year later and a final standard in 2027.

HQC relies on a different mathematical family than ML-KEM. It would serve as a fallback if a weakness were found in the latter. NIST reminds organizations that they should keep migrating to the standards published in 2024. Ultimately, the institute plans to deprecate and then remove vulnerable algorithms from its standards by 2035, while asking high-risk systems to switch much earlier. For technical details, see Post-quantum cryptography: where do things stand in October 2026?

Hybridization

Post-quantum algorithms are new and have less track record than RSA or elliptic curves. Hybridization combines a proven classical algorithm with a post-quantum one: protection holds as long as either of the two withstands attack. This is ANSSI's doctrine and the most widely deployed mode today, for example X25519MLKEM768 for TLS.

Who is affected?

Ultimately, every organization is, since public-key cryptography is everywhere: websites, VPNs, email, remote access, document signing, smart cards, connected devices, encrypted backups. The level of urgency, however, depends on each organization's situation:

• High urgency: organizations that handle data that must remain confidential beyond 2030 (health, defense, research, intellectual property, state data) or that operate very long-lived systems (industry, energy, transport).
• Regulated scope in France: classified or “Diffusion Restreinte” (restricted distribution) data, systems of vital importance (SIIV) and products certified or qualified by ANSSI. Hybridization is mandatory there as soon as a post-quantum mechanism is deployed.
• Security product vendors: they will have to build in PQC to enter ANSSI qualification starting in 2027, and their customers will demand it in tenders.
• SMEs and local authorities: most of the migration will come to them through their software vendors and suppliers. Their role is mainly to know where their cryptography is, keep their software up to date and ask the right questions when buying.

What the authorities say

ANSSI

The French national cybersecurity agency (ANSSI) published an FAQ on October 8, 2025 clarifying its doctrine. Its main points:

• include the quantum threat in risk analysis;
• launch an inventory of cryptographic uses and of data that must remain protected after 2030, handling critical cases first;
• ask suppliers for their roadmap and build PQC in when renewing equipment;
• use hybridization, “strongly” recommended everywhere and mandatory within the regulated scope. For hash-based signatures (SLH-DSA, XMSS, LMS), hybridization is not systematically recommended.

Outside the regulated scope, these recommendations are not mandatory. Contrary to what has often been written, the FAQ announces neither a ban on RSA in 2027 nor the withdrawal of products already qualified. We looked at this in Post-quantum: what ANSSI really recommends, and what it did not say.

ANSSI also published an opinion on crypto-agility (January 19, 2026). On February 2, 2026, it published three technical recommendation sheets for the post-quantum transition of TLS 1.3, IPsec and SSHv2. The first French certifications of products incorporating PQC were issued in early October 2025.

The European Union

Commission Recommendation (EU) 2024/1101 of April 11, 2024 asked member states for a coordinated strategy. On June 23, 2025, the NIS Cooperation Group published a coordinated roadmap, to which ANSSI contributed. Its milestones:

• end of 2026: all member states have started the transition (national roadmaps, inventories, first projects for high- and medium-risk cases);
• end of 2030 at the latest: transition completed for high-risk uses, including critical infrastructure;
• end of 2035: transition completed for medium-risk uses, and as far as possible for low-risk uses.

This roadmap is aimed first at states and critical infrastructure operators. It imposes no direct legal obligation on an SME, but it will shape the requirements of public buyers and large contracting firms.

Where does deployment stand?

Key exchange: well under way

• Browsers: according to Cloudflare's documentation, hybrid X25519MLKEM768 exchange has been enabled by default in Chrome and Edge since version 131 and in Firefox since version 132 (desktop). Apple enabled it in iOS 26, macOS Tahoe 26 and the other operating systems of the same generation.
• TLS standard: RFC 10024, published in August 2026 by the IETF on the standards track, defines three hybrid key exchanges for TLS 1.3. X25519MLKEM768 is the recommended option.
• Libraries and servers: OpenSSL enables this exchange by default from version 3.5.0, and NGINX benefits when compiled with that version. Go (1.24), Caddy and Traefik do the same in their recent versions.
• OpenSSH: mlkem768x25519-sha256 has been the default key exchange since version 10.0 (April 2025). Since version 10.1 (October 2025), the client displays a warning when a connection negotiates a non-post-quantum exchange.

According to Cloudflare, more than 60% of human-originated TLS traffic to its network was protected by hybrid ML-KEM as early as February 2026. In practice, the weak link is often the server, load balancer, firewall or inspection proxy, which does not yet negotiate these exchanges.

Signatures and certificates: the hard part

Post-quantum signatures are much larger than current ones. A TLS connection carries several: certificate, certificate chain, transparency proofs. Replacing them as is would weigh down every connection. On February 27, 2026, Google announced that Chrome would not add post-quantum X.509 certificates to its root store in the short term. It is instead betting on Merkle Tree Certificates (MTC), a compact format being standardized at the IETF. The announced timeline: a feasibility study with Cloudflare (under way), bootstrapping of public MTCs in the first quarter of 2027, then the launch of a quantum-resistant root store in the third quarter of 2027. Post-quantum X.509 certificates are due to be supported in Chrome for private PKIs only, later in 2026.

On September 29, 2026, Cloudflare announced its application to become a public certificate authority, with first MTCs expected in the first quarter of 2027. See Post-quantum certificates: Cloudflare wants to become a certificate authority. For most organizations, there is nothing to do at this stage on public web certificates. However, you should follow this topic for internal PKIs.

Timeline

Date	Event
April 11, 2024	Recommendation (EU) 2024/1101 on a coordinated roadmap
August 13, 2024	NIST publishes FIPS 203, 204 and 205
March 11, 2025	HQC selected by NIST as a backup for ML-KEM
April 9, 2025	OpenSSH 10.0: hybrid ML-KEM by default
June 23, 2025	Coordinated European roadmap
October 8, 2025	ANSSI FAQ on post-quantum cryptography
February 2, 2026	ANSSI sheets on TLS 1.3, IPsec and SSHv2
August 2026	RFC 10024: hybrid key exchanges for TLS 1.3
October 6 and 7, 2026	GAO and Europol reports
End of 2026	EU: transition under way in all member states. ANSSI: revision of the IPsec DR reference framework planned during 2026.
2027	ANSSI: PQC requirements for product qualification. NIST: final HQC standard expected. Chrome: first public MTCs (Q1) and quantum-resistant root store (Q3).
End of 2030	EU: high-risk uses migrated. ANSSI: buying products without PQC considered unreasonable.
2035	EU: migration completed for medium-risk uses. NIST: removal of vulnerable algorithms from its standards.

Where to start

Migration is not just a matter of changing algorithms. It affects applications, network equipment, PKIs, HSMs (hardware security modules), cards and badges, connected devices and contracts. The method below draws on our six-step guide, inspired by ANSSI's recommendations.

1. Appoint an owner and add the topic to risk analysis. One person leads the effort, and the quantum threat appears in the risk map like any other.
2. Take a cryptographic inventory. List where cryptography is used (protocols, applications, equipment, libraries), with which algorithms and key sizes. Discovery tools help, but you will often need to ask suppliers. Start with exposed flows: website, VPN, remote access, email, outsourced backups.
3. Classify by data lifetime. Ask one question for each flow: how long must this data remain confidential? Flows that carry sensitive data beyond 2030 are the priority.
4. Take the quick wins on TLS and SSH. Update servers, load balancers and proxies so they negotiate X25519MLKEM768. For administration, move to OpenSSH 10 or later. Check the result, for example with nscurl --tls-diagnostics on macOS Tahoe or with the OpenSSH client warning. Rely on ANSSI's February 2026 sheets.
5. Question suppliers and build PQC into procurement. Ask your software vendors, hosting providers and manufacturers (VPN, firewall, PKI, HSM) for their post-quantum roadmap. Add a hybridization and crypto-agility requirement to your specifications. Equipment bought today will still be in service after 2030.
6. Build crypto-agility. This means being able to change algorithms without overhauling your systems. To do so, avoid hard-coded algorithms, centralize key and certificate management and document dependencies. Internal PKIs and long-lived signatures (firmware, archiving) should be prepared now, even if their switchover will come later.

For an SME, steps 2, 4 and 5 deliver most of the short-term benefit, without heavy investment. Our free PDF guide to post-quantum migration covers this approach with checklists.

Going further

• ANSSI: “Cryptographie post-quantique” page on cyber.gouv.fr (FAQ, opinions, TLS, IPsec and SSH sheets, market studies, opinion on crypto-agility).
• European Commission: coordinated roadmap for the post-quantum transition and its FAQ, on the Digital Strategy site.
• NIST: “Post-Quantum Cryptography” project on csrc.nist.gov (FIPS 203, 204 and 205 standards, progress on FN-DSA and HQC, draft IR 8547 report on the transition).
• IETF: RFC 10024 for hybrid exchanges in TLS 1.3.
• Cyberiack: the October 2026 status update, ANSSI's doctrine, the six-step method and the PDF guide.