Nexus Observatory Sign in

StoriesHorizon 2030: Post-quantum cryptography

Cryptography that outlasts the quantum computer

Data signed today may need to be trusted in 2040. Post-quantum standards were first published in August 2024123, and governments have set dates for leaving the old algorithms behind45.

Systems
Key encapsulation, Digital signatures, Crypto-agility
Toward 2030
Deprecation of RSA and elliptic curves
Figures
3, timeline to 2030, data story, simulator

Go to the references

01Timeline to 2030

The dates are set.

NIST proposes to deprecate 112-bit RSA and elliptic-curve security after 2030 and disallow it after 20354. The NSA’s suite for national security systems sets 2030 for some equipment and 2035 overall6. Canada and the European Union have published migration roadmaps with similar horizons57.

Figure as text: Post-quantum migration dates

A four-lane timeline from 2022 to 2035 with the standards and the migration deadlines in the United States, Canada and the European Union.

  1. 2022-09 CNSA 2.0 announced. Quantum-resistant algorithms for national security systems.6
  2. 2024-08 First post-quantum standards (FIPS 203, 204, 205). ML-KEM, ML-DSA and SLH-DSA.1
  3. 2024-11 Transition draft (NIST IR 8547). Deprecation after 2030 and disallowance after 2035 proposed.4
  4. 2025-03 A second key encapsulation selected. HQC chosen as a backup to ML-KEM.8
  5. 2025-06 Federal migration roadmap. Plans first, then high-priority systems, then the rest.5
  6. 2025-06 Coordinated roadmap. First steps by 2026, high-risk uses by 2030.7
  7. 2030 Quantum-vulnerable algorithms deprecated. As proposed for 112-bit security.4
  8. 2030 High-risk uses migrated. Target in the coordinated roadmap.7
  9. 2031 High-priority systems migrated. Target in the federal roadmap.5
  10. 2035 Migration complete. Remaining federal systems.5
  11. 2035 Quantum-vulnerable algorithms disallowed. As proposed.4

02Data story

Bigger keys on the wire.

A classical key exchange moves 64 bytes9; a post-quantum one at the middle security level moves over two kilobytes1. For a sensor network that counts bytes, the handshake is now a budget line.

Figure as text: Key exchange bytes: public key plus ciphertext

A bar chart: X25519 at 64 bytes and ML-KEM-512, 768 and 1024 at 1,568, 2,272 and 3,136 bytes.

Key exchange bytes: public key plus ciphertext (bytes)
SchemeBytes
X2551964
ML-KEM-5121,568
ML-KEM-7682,272
ML-KEM-10243,136

03Simulator

Price a handshake.

Choose a key exchange, a signature and the length of the certificate chain, and compare the bytes with the classical baseline. Signature sizes come from the standards231011; the count includes each certificate’s key and signature and one handshake signature.

Figure as text: Handshake bytes by algorithm choice

Two stacked bars comparing the bytes of the chosen handshake, in red, with the classical baseline.

Handshake bytes by algorithm choice, at the starting values
Key exchangeML-KEM-768
SignatureML-DSA-65
Certificates in the chain2
Key exchange2,272 bytes
Authentication13,831 bytes
Total16,103 bytes
Against X25519 with ECDSA× 41.9

2022

2024

2026

2028

2030

2032

2035

Today

Standards

United States

Canada

European Union

Aug 2024 · Standards

First post-quantum standards

ML-KEM, ML-DSA and SLH-DSA.1FIPS 203, 204, 205

Figure 1

Timeline to 2030

Figure 1. Post-quantum migration dates. A four-lane timeline from 2022 to 2035 with the standards and the migration deadlines in the United States, Canada and the European Union.

References

  1. FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard. National Institute of Standards and Technology, 2024.
  2. FIPS 204: Module-Lattice-Based Digital Signature Standard. National Institute of Standards and Technology, 2024.
  3. FIPS 205: Stateless Hash-Based Digital Signature Standard. National Institute of Standards and Technology, 2024.
  4. NIST IR 8547 (initial public draft): Transition to post-quantum cryptography standards. National Institute of Standards and Technology, 2024.
  5. ITSM.40.001: Roadmap for the migration to post-quantum cryptography for the Government of Canada. Canadian Centre for Cyber Security, 2025.
  6. Announcing the Commercial National Security Algorithm Suite 2.0. United States National Security Agency, 2022.
  7. A coordinated implementation roadmap for the transition to post-quantum cryptography. European Commission and NIS Cooperation Group, 2025.
  8. NIST IR 8545: Status report on the fourth round of the NIST post-quantum cryptography standardization process (selection of HQC). National Institute of Standards and Technology, 2025.
  9. RFC 7748: Elliptic curves for security (X25519). Internet Engineering Task Force, 2016.
  10. FIPS 186-5: Digital Signature Standard. National Institute of Standards and Technology, 2023.
  11. RFC 8032: Edwards-curve digital signature algorithm (EdDSA). Internet Engineering Task Force, 2017.

Related stories

System: Data provenance chain From sensor to recordA published observation should carry its own history: which instrument made it, when, under which calibration, and every step since. The web already has a…System: Federation across agencies Many agencies, one pictureNo single agency observes everything it needs. Federation lets each keep its own systems and still share: common interfaces, common catalogues and common…Horizon 2030: Overview What changes by 2030Six shifts will reshape how the Earth is observed before the decade ends: networks that sense, models that forecast, foundation models that read imagery,…

Where this applies

Security and trustObservatory ProtocolSoftwareHardware & powerGovernmentEnergyTelecomInsurance and finance