Quantum computers that can break the public-key encryption protecting most of the internet do not exist yet, according to the US cybersecurity agency CISA. Governments are nonetheless asking organizations to start replacing that encryption now, with 2035 as the end point in both US and UK guidance. This article sets out what the standards bodies have finished, what remains in draft, and how much of the internet has already moved.
Why does quantum computing threaten today’s encryption?
Public-key cryptography does two jobs online. It lets two parties agree on a secret key over an open network, and it lets a server prove its identity with a digital signature. The algorithms in common use rely on mathematical problems that are hard for today’s computers. The UK’s National Cyber Security Centre (NCSC) says the threat to cryptography from future large-scale, fault-tolerant quantum computers “is now well understood”: quantum algorithms could solve those underlying problems efficiently on a machine that large.
The urgency comes from timing. An attacker can record encrypted traffic today and decrypt it years later once a capable quantum computer exists. CISA refers to this as “harvest now, decrypt later,” and Cloudflare, which runs a large share of web infrastructure, calls it store-now/decrypt-later. That is why key agreement, which protects the confidentiality of recorded traffic, has moved first. Forging a signature needs a capable machine at the time of the attack, so the pressure on signatures is lower.
Which post-quantum standards has NIST finalized?
The US National Institute of Standards and Technology (NIST) released its principal post-quantum standards on August 13, 2024. NIST’s post-quantum project page says it expects them to “provide the foundation for most deployments.”
| Standard | Algorithm | Purpose |
|---|---|---|
| FIPS 203 | ML-KEM | Key establishment |
| FIPS 204 | ML-DSA | Digital signatures |
| FIPS 205 | SLH-DSA | Hash-based digital signatures |
Work continues around them. NIST says the Falcon signature algorithm and the HQC key-encapsulation mechanism have been selected for ongoing standardization. Its publications list shows further guidance since the original release: recommendations for key-encapsulation mechanisms (SP 800-227) were finalized on September 18, 2025, a draft adding SLH-DSA parameter sets (SP 800-230) appeared on April 13, 2026, a status report on the additional signature round (IR 8610) was finalized on May 14, 2026, and an updated white paper on cryptographic agility (CSWP 39) followed on June 29, 2026.
What are the migration deadlines?
Two government bodies give dates, and they point the same way. NIST’s project page says that under its transition timeline, NIST “will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems transitioning much earlier.” That timeline lives in NIST IR 8547, which NIST’s publications page still lists as a draft first published on November 12, 2024. Public comments closed on January 10, 2025.
The NCSC is more granular. Its guidance, aimed at technical decision-makers and risk owners in large organizations, sets three milestones:
| Deadline | What should be done |
|---|---|
| By 2028 | Define migration goals, complete discovery and assessment, and build an initial plan |
| By 2031 | Complete the highest-priority migration activities and refine the plan |
| By 2035 | Complete migration of all systems, services and products |
The NCSC expects the early phases to take large organizations two to three years each. It explains the 2035 target by saying 10 years is “a sufficient period for a rich set of PQC standards to appear,” and adds that “Migration will happen, globally.”
How far has the internet already moved?
Further than the deadlines suggest, at least for key agreement. The NCSC notes that browsers already agree keys using a hybrid of traditional key exchange and ML-KEM, which hedges against one of the two methods later proving weak.
Cloudflare puts numbers on it, with the caveat that these are the company’s own figures about its own network and are now a year old. In a post dated October 28, 2025, Cloudflare said over half of human traffic it handles was protected against store-now/decrypt-later attacks, measured in the last week of that month, using a hybrid of X25519 and ML-KEM-768. It reported that 3.7% of origin servers supported that hybrid in 2025, up from 0.5% in 2023, and cited a third-party scan from September 2025 finding 39% of the top 100,000 domains supporting post-quantum key agreement.
Those percentages should be read as indicators from one provider, not as an industry census. The NCSC’s independent statement that browsers use hybrid ML-KEM supports the direction of travel, but the third-party scan reached this article only through Cloudflare’s post, and no independent measurement of the shares was reviewed directly.
Why is authentication the harder part?
Replacing signatures turns out to be more awkward than replacing key agreement. Cloudflare said in the same post that the path for post-quantum authentication was “much less clear,” that no public post-quantum certificate was in use as of October 2025, and that it expected the first to appear in 2026 but not to be trusted by all browsers before 2027. It also said the IETF had not finalized formats for hybrid certificates and that ML-DSA-44 would add about 15 kilobytes to a TLS handshake, which matters for performance at scale.
Those are claims by a company with an interest in how the transition unfolds, so they are best read as a description of engineering friction rather than a measured industry benchmark. They are consistent with the NCSC’s own note that no exact hybrid mechanism has yet been standardized across the industry and that the details may change.
What should organizations do first?
The agencies’ advice converges on discovery before replacement:
- Find the vulnerable cryptography. NIST says organizations need to identify where vulnerable algorithms are used and plan to replace or update them.
- Keep an inventory. CISA says federal agencies must maintain a current inventory of IT vulnerable to quantum decryption, citing 6 U.S.C. § 1526, and says it is working with NIST’s National Cybersecurity Center of Excellence on automated discovery tools.
- Check what vendors support. CISA maintains a list of product categories that support or plan to support the standardized post-quantum algorithms.
- Build in cryptographic agility. The NCSC expects traditional and post-quantum systems to coexist during migration, which makes the ability to swap algorithms a core requirement.
Smaller organizations that depend on commodity IT, the NCSC says, should expect migration to arrive mostly through vendor updates.
What remains unsettled?
Several pieces are still open. IR 8547, the document that carries NIST’s timeline, was still a draft on NIST’s publications page as of the version reviewed, so its wording could change. Falcon and HQC are selected but not yet finalized as standards in the material reviewed. The NCSC says the hybrid mechanism is not standardized across the industry, and certificate formats were unfinished as of Cloudflare’s October 2025 post.
The sources also differ in what they cover. NIST’s pages set out standards and a 2035 end point, the NCSC sets interim milestones, and CISA focuses on inventory and product lists. Standards bodies and regulators elsewhere face a similar dependency on technical readiness: the EU delayed parts of its AI rules partly because standards and support tools were not ready, as this look at the EU’s AI Act deadlines explains.
A long runway with an early start
Nothing in the agencies’ guidance suggests that encrypted traffic is being broken today. What they describe is a long transition with a fixed end date, interim milestones for the largest organizations, and finished standards for the part of the problem that matters most urgently. For most organizations the first practical step is not a technology purchase but an inventory of where public-key cryptography is used.
This is general information, not a substitute for professional security advice.
Sources: National Institute of Standards and Technology; UK National Cyber Security Centre; Cybersecurity and Infrastructure Security Agency; Cloudflare
