Quantum-safe security: get your encryption ready before quantum computers are
A large enough quantum computer will break RSA and elliptic-curve cryptography, the maths behind most of today's secure connections and signatures. Data captured today can be decrypted later. NIST published replacement standards in August 2024.
Find where the old cryptography lives, then replace it in a sensible order
Readiness and migration, in the order it should happen
Inventory
Find keys, certificates, libraries, protocols and hardware security modules across applications and vendors, and record them as a cryptographic bill of materials.
Risk
Score each system by how long its data must stay secret, how exposed it is and how hard it will be to change.
Crypto-agility
Rework key management and certificate handling so algorithms can be swapped by configuration.
Migrate and test
Introduce ML-KEM, ML-DSA and hybrid TLS system group by system group, measuring latency and compatibility as we go.
The timeline is set by standards bodies and regulators
| Reference | What it says |
|---|---|
| NIST FIPS 203, 204, 205 | Published August 2024. ML-KEM for key exchange, ML-DSA and SLH-DSA for signatures. |
| NIST IR 8547 (draft) | Proposes deprecating today's quantum-vulnerable algorithms after 2030 and disallowing them after 2035. |
| Your regulator | Banking, telecom and government regulators in India and the Gulf are issuing their own guidance. We map the dates that apply to each of your systems. |
We also do quantum research, and we are careful how we describe it
Quantum computing in India is at an early stage. We treat it as research and engineering: studying algorithms, running them on simulators, and always comparing against the best classical method on the same problem.
Quantum-safe questions
What is post-quantum cryptography?
Post-quantum cryptography (PQC) is a set of new encryption and signature algorithms designed to resist attack by quantum computers. NIST published the first standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA).
Why act now if quantum computers are years away?
Because data can be recorded today and decrypted later, a risk known as harvest now, decrypt later. Data that must stay secret for ten or twenty years is already exposed, and large migrations take years to finish.
What is the first step?
A cryptographic inventory: a list of every key, certificate, library, protocol and hardware module in use, with the data lifetime of each system. Most teams start with one business-critical application.
Do you build quantum computers or sell quantum computing?
No. We do quantum research on simulators, always compared with classical methods, and we deliver post-quantum cryptography migration, which is the part that is ready for business today.
Not sure where to start?
Most teams start with an inventory of one business-critical application. It is a contained piece of work and it shows what the rest of the programme will involve.