Quantum threat timeline assessment
Progress in qubit counts, error rates and error correction is tracked against the resources estimated to break current cryptography, with uncertainty stated.
GCRI · Cybersecurity and Digital Resilience
Quantum technology and cryptography
Quantum computing, sensing and communication matter to digital resilience mainly through cryptography. In this field the concern is the timeline and effect of quantum computers on public-key cryptography, and the role of quantum key distribution alongside post-quantum algorithms.
01Contents
Quantum technology and cryptography in five parts.
02Application
What quantum computing, sensing and communication does here.
Quantum computing, sensing and communication exploit quantum mechanical effects to process information and make measurements. They promise new capabilities and pose a long-term threat to current public-key cryptography. In cyber and digital resilience and critical infrastructure, quantum technology assessment informs when to migrate critical systems to quantum-resistant cryptography. Quantum sensing may improve navigation and subsurface monitoring for infrastructure. The canonical description is on the STEM Commons.
Comparing PQC and QKD
Post-quantum cryptography and quantum key distribution are compared on security assumptions, infrastructure needs and agency positions.
Data lifetime analysis
How long data must stay confidential is compared with migration time and threat timelines to decide which systems must migrate first.
03Monitor
Quantum experiment.
The screen a team would use to follow this method: its measures, states and decisions. Names are examples and values are illustrative.
Quantum experiment
Cybersecurity · Quantum technology · Run R-4981
Calibration runGCRI · Cybersecurity and Digital Resilience
Qubit calibration
| Q0 | 72 | 135 | 0.007 | In spec |
| Q1 | 95 | 76 | 0.001 | In spec |
| Q2 | 131 | 107 | 0.005 | In spec |
| Q3 | 155 | 113 | 0.009 | In spec |
Method card
- Method
- Quantum computing, sensing and communication
- Device
- example testbed
- Shots
- 19,192
- Label
- MODELLED
Randomised benchmarking
04Data
What the method consumes.
Datasets and records used by quantum computing, sensing and communication on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.
| Data | Role | Label |
|---|---|---|
| Published quantum hardware results | Progress tracking | REPORTED |
| Resource estimates for cryptanalysis | Threat thresholds | ESTIMATED |
| Agency position papers | Policy | Published statistics |
05Methods and evidence
How quantum technology and cryptography is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
System model
The couplings between the systems in quantum technology and cryptography: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
FAIR guiding principles · GO FAIR and FORCE11W3C PROV · World Wide Web ConsortiumGuidance on consistent treatment of uncertainties · IPCCCEOS Analysis Ready Data · Committee on Earth Observation Satellites
06Validation
How results are checked.
Hardware is characterised through standard benchmarking protocols and cross-platform comparison. Claims of advantage are tested against classical methods.
| Check | How it is done |
|---|---|
| Peer-reviewed sources | Hardware progress is taken from peer-reviewed or reproducible results |
| Range reporting | Timelines are presented as ranges |
| Agency alignment | Recommendations are compared with national agency guidance |
Noise, decoherence and engineering constraints limit current devices. Timelines for practical capability are uncertain.
07Process
How the process runs.
Process explorer · Process
Quantum technology and cryptography: Post-quantum cryptography migration
8 steps·4 stages
Process
Quantum technology and cryptography: Post-quantum cryptography migration
NIST published FIPS 203, 204 and 205 on 13 August 2024; the migration steps are common practice, and the IR 8547 timeline is a draft.
01 Discover
- 01Cryptographic inventoryDatasetOrganisations must find where vulnerable algorithms are used and plan to replace or update them. The inventory lists algorithms and keys.
- 02Prioritise by data lifetime and exposureStepIR 8547 names the harvest now, decrypt later threat. Systems holding long-lived sensitive data come first.
02 Plan
- 03Select standardised algorithmsStepFIPS 203, 204 and 205 specify ML-KEM, ML-DSA and SLH-DSA. Falcon and HQC were selected for ongoing standardisation.
- 04Vendor roadmapsDataset · CISOHardware security modules and libraries need vendor support for the selected algorithms. Roadmaps come from each vendor.
03 Deploy
- 05Hybrid deploymentModelIR 8547 says migration may start with hybrids of quantum-resistant and quantum-vulnerable algorithms, secure if one component is secure.
- 06TestExerciseInteroperability, performance and fallback are tested before cut-over.
- 07Cut over and retireDecision · CISOIn draft IR 8547, 112-bit public-key algorithms are deprecated after 2030 and quantum-vulnerable ones disallowed after 2035.
04 Sustain
- 08Crypto agilityStepCrypto agility is the ability to replace and adapt cryptographic algorithms while preserving security and ongoing operations.
Neutral outline of a published external standard or method, from its issuing body. Not a record of operation. Nexus does not perform, certify or approve any step shown. A gate or decision belongs to the party the source names.
08Connections
Topics that rely on this method.
09Stewardship
Who maintains the method.
Quantum Technologies stewards quantum computing, sensing and communication for the Consortium and reviews how it is applied across platforms.
10Connected
Where this page leads across the Consortium.
11Questions
Questions and answers.
What are the limits of quantum computing, sensing and communication in this field?
Noise, decoherence and engineering constraints limit current devices. Timelines for practical capability are uncertain.
How are results checked?
Hardware is characterised through standard benchmarking protocols and cross-platform comparison. Claims of advantage are tested against classical methods.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method's use, not a run; no result is reported here.
Where else is this method applied?
The canonical method page lists every platform that applies it.
ReportsContribute
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
GCRICybersecurity and Digital ResilienceStrategic SystemsScenario and Stress-Test
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Cybersecurity and Digital Resilience
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.