Major News Story!! US Government Just Pushed PQC Deadline from 2035 to ASAP! Hmm.

The Biden administration today released a sweeping Executive Order (https://www.whitehouse.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/) that strongly promotes over a dozen major technologies (e.g., secure development, end-to-end encryption, encrypted DNS, PHISHING-RESISTANT MFA, threat hunting, and more).

But what caught my quantum eye were the following passages, which were submerged so deep in the document that I still can’t figure out which subsections they officially belong to. But if you read them, you will see a major quantum news story buried in the order. There they are:

(iii) ?Agencies shall implement PQC key establishment or hybrid key establishment including a PQC algorithm as soon as practicable upon support being provided by network security products and services already deployed in their network architectures.

(iv) ??Within 90 days of the date of this order, the Secretary of State and the Secretary of Commerce, acting through the Director of NIST and the Under Secretary for International Trade, shall identify and engage foreign governments and industry groups in key countries to encourage their transition to PQC algorithms standardized by NIST.

(g) ?The Federal Government should take advantage of commercial security technologies and architectures, such as hardware security modules, trusted execution environments, and other isolation technologies, to protect and audit access to cryptographic keys with extended lifecycles.

To quickly summarize, the US government is saying US government agencies and their allies need to be moving to post-quantum cryptography (PQC) as soon as possible.

To put this in perspective, the last official PQC deadline guidance by the US government was the US National Security Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems (https://www.whitehouse.gov/briefing-room/statements-releases/2022/05/04/national-security-memorandum-on-promoting-united-states-leadership-in-quantum-computing-while-mitigating-risks-to-vulnerable-cryptographic-systems/).

It said this:

Sec. 3.? Mitigating the Risks to Encryption.? (a)? Any digital system that uses existing public standards for public?key cryptography, or that is planning to transition to such cryptography, could be vulnerable to an attack by a CRQC.? To mitigate this risk, the United States must prioritize the timely and equitable transition of cryptographic systems to quantum-resistant cryptography, with the goal of mitigating as much of the quantum risk as is feasible by 2035.

This officially set the PQC deadline for 2035 (at the time over 10 years away). I was pretty incensed by this deadline (https://www.dhirubhai.net/pulse/i-think-2035-post-quantum-preparation-date-insane-roger-grimes-yotee/) because I think it’s both far too risky to wait that late and because a 10-year deadline means most organizations will not be doing anything PQC-related anytime soon.

The new order says, “…as soon as practicable..”

The US government has been telling organizations to start preparing for PQC since at least 2015. The US government has been telling organizations to prepare, report, and start working on PQC projects ever since.

This is the first time the language says…clearly…ASAP!!

That’s a lot different than 2035.

The new executive order also promotes isolation technologies, such as trusted execution environments, to protect cryptographic keys with extended lifecycles. This means that critical data needs to be isolated and prevented from being eavesdropped on by adversaries. The US government has long warned that our adversaries are already eavesdropping on our data streams and saving them for future decryption once sufficiently-capable quantum computers are available.

This is huge!!!

It’s not saying to wait. It’s not saying to study. It’s not saying to prepare some inventory list and reported it to some agency. It’s saying, government agencies need to isolate existing critical data NOW!! It’s saying that government agencies need to be moving to PQC (and hybrid protection) NOW!!

Unless I’ve missed something unintentionally, this is a change in tone and timing. I wonder if there is a particular new fact behind the more aggressive timing?

I apologize if I’ve missed the prior government orders telling all agencies that they need to be PQC ASAP! and done a little too much hyperbole in this post. I could have missed something. But I follow this sort of stuff fairly close and this seems like a distinct new tone.

And if the US govt saying they need PQC and data isolation ASAP is everyone else supposed to be cool to wait to 2035??

Hmm. Hmm.

?

?

?

?