\n\n
Key developments this week show a multi‑front push toward quantum‑resistant security. A new GAO report flags that U.S. agencies are lagging on post‑quantum encryption, warning that sensitive data remain exposed to future quantum decryption. Meanwhile, the National Institute of Standards and Technology’s finalized PQC algorithms give a concrete technical foundation, and leading firms are setting aggressive migration targets. Google announced a 2029 deadline for its post‑quantum transition, while the AI Lab released a public Trust Identity Protocol that uses ML‑DSA‑65 signatures and a decentralized ledger to prove content authenticity in a quantum‑safe way. Cloudflare plans to launch a free public Certificate Authority for quantum‑safe TLS certificates in early 2027, addressing the large payload challenges of post‑quantum signatures.
Why it matters: The Global Risk Institute estimates a cryptographically relevant quantum computer could appear within a decade, with a 28‑49 % likelihood, making “harvest‑now, decrypt‑later” attacks a pressing concern. Federal inaction compounds the risk, as highlighted by the GAO’s finding that only one of 24 major agencies completed a cryptographic inventory. At the same time, adoption is gaining traction on the internet—over half of the top‑million sites now support post‑quantum key exchange, though only a minority of CISOs report active PQC implementation, indicating a gap between edge‑level support and enterprise readiness.
What to watch next: Watch for the rollout of Cloudflare’s Merkle Tree Certificates and broader root‑store inclusion, which could normalize quantum‑safe TLS across browsers. Monitor further government milestones, especially the U.S. executive order deadlines for key establishment (2030) and digital signatures (2031) and the EU’s 2030 high‑risk migration roadmap. Finally, track corporate timelines—Google’s 2029 target and the AI Lab’s TIP adoption—to gauge when post‑quantum standards move from pilot projects to production at scale. [[1, 2, 3, 4, 5]]