G7 Urges Faster Migration to Post-Quantum Cryptography
Summary
A G7 cybersecurity working group urges governments and organizations to plan post-quantum cryptography migration, citing risks to encrypted data, authentication and secure communications despite uncertainty about when quantum computers will arrive.
Key points
- The G7 working group says organizations should not postpone migrating critical systems and data to post-quantum cryptography.
- Sensitive encrypted data can be harvested now and decrypted later if quantum computers become capable of breaking current public-key encryption.
- The report warns that quantum computers could also undermine authentication and assurance mechanisms, affecting secure communications and legal contracts.
- It recommends inventorying and prioritizing critical systems, coordinating across public and private sectors, and adopting crypto-agility to allow algorithms to be changed.
- The report acknowledges uncertainty about quantum-computer timelines and notes that some selected algorithms have already been broken using traditional computers or AI.
- The article says U.S. federal migration timelines were moved from 2035 to 2030, while Google and other companies have targeted 2029.
Article Details
- Event Type
- G7 cybersecurity working group report urging governments and organizations to accelerate migration to post-quantum cryptography.
- Impact
- The report warns that future quantum computers could undermine current public-key encryption and compromise authentication and assurance mechanisms. It identifies a present risk of sensitive encrypted data being harvested for later decryption and calls for organizations to inventory critical systems, prioritize migration, and adopt crypto-agility. The report notes that quantum-computing timelines are uncertain.
Countries
Canada(NCSC), The French Cybersecurity Agency (ANSSI), Germany’s Federal Office of Information Security (BSI), Canada’s Communications Security Establishment (CSE), Japan’s National Cybersecurity Office (NCO) and Italy’sFranceThe working group’s report, prepared in June at the G7 Summit in France, said organizations “can no longer afford to postpone” work transitioning critical systems and data to “post-quantum” forms of encryption.GermanyAgency (CISA), the UK’s National Cyber Security Centre (NCSC), The French Cybersecurity Agency (ANSSI), Germany’s Federal Office of Information Security (BSI), Canada’s Communications Security Establishment (CSE),ItalyCanada’s Communications Security Establishment (CSE), Japan’s National Cybersecurity Office (NCO) and Italy’s National Cybersecurity Agency (ACN).JapanFederal Office of Information Security (BSI), Canada’s Communications Security Establishment (CSE), Japan’s National Cybersecurity Office (NCO) and Italy’s National Cybersecurity Agency (ACN).