Charting a secure course to a post-quantum world

By exploiting the properties of quantum mechanics, high-performance, fault-tolerant quantum computers offer the tantalizing prospect of solving certain classes of problems that remain intractable even for today’s most advanced computers. 

In particular, they are expected to excel at combinatorial optimization, enabling the creation of ultra-efficient supply chains and optimal investment portfolios. The benchmark example of this is the “traveling salesperson problem,” where the challenge is to find the shortest possible route for sales calls across a set of geographically dispersed cities. With five cities to visit, the number of possible routes is just 24. But the complexity grows exponentially as more city stops are added, and by 20 the calculation needs to consider more than 6 quadrillion possible routes: impossible for a classical computer but (theoretically) quick and easy for a quantum computer.¹

Aside from combinatorial optimization, quantum computers are also expected to dramatically speed up the solving of differential equations, thereby enhancing the modeling of complex systems ranging from chemical reactions to climate dynamics. And they promise to revolutionize linear algebra and so accelerate tasks such as the training of AI models and the detection of intricate fraud patterns.

But this disruptive technology also carries a big downside. Quantum computers are particularly adept at factorization – the decomposition of numbers into their factors. The issue with that: the public-key cryptography that underpins the security of much of today’s digital landscape (RSA) relies on the fact that conventional computers find factorization – especially of large primes – difficult, if not impossible. 

Moreover, another widely used approach to public-key cryptography, known as elliptic-curve cryptography (ECC), relies on the difficulty of computing the so-called elliptic curve discrete logarithm problem. That is also at risk from the potential capabilities of quantum technology.

In short, quantum computers will effectively be able to break the encryption methods that protect current digital assets and communication systems across business, government, and personal domains. 

Two threats stand out as the most pressing. One is the “harvest now, decrypt later” scenario: sensitive data that is secret now can be captured by malicious actors to be deciphered and exploited when quantum machines become operational.

Estimates of when that moment – often referred to as “Q-Day” – will arrive vary widely. Many experts expect the emergence of a cryptographically relevant quantum computer capable of breaking widely used public-key encryption in the timeframe of 2030 to 2040. In response, regulators and government agencies worldwide are urging organizations to undertake a complete migration of systems to implement post-quantum cryptography (PQC) by 2035.

The second major threat involves the long life cycle required by many security systems. An ID card, a driver’s license, or a passport, for example, must remain trustworthy for 10 years or more. So, building in quantum resistance before the emergence of powerful quantum computers is vital.

Stepping up to the PQC challenge

The good news is that concerted efforts are well underway to create and apply standard encryption methods that can protect data and systems, both today and in a quantum future. 

It’s a complex, shifting landscape that Harald Vater, head of the Cryptography Department at G+D, puts into context. “The vast majority of today’s IT security depends on public-key cryptographical algorithms to perform encryption and authentication – the most important being RSA and ECC. Both base their security on mathematical problems that none of today’s computers could ever realistically resolve,” he outlines.

RSA is based on the computational difficulty of factoring the product of two large prime numbers, the “integer factorization problem.” ECC is based on the algebraic structure of elliptic curves over finite fields. 

“Every time we prove our identity, make a financial transaction, or send an email, we rely on these cryptographic algorithms to ensure the sensitive information we are sharing stays secure and unmanipulated. And, as long as the problem that these cryptographic algorithms pose to classic computers is too difficult to solve, the algorithm is secure,” says Vater.

For now, fully fault-tolerant quantum machines remain out of reach. “The current generation of noisy intermediate scale quantum computers are not able to threaten public-key cryptography,” he says.

“However, if quantum computers continue to develop in fault-tolerance and scalability and get increasingly better at factorizing large numbers, then we have a big problem. At that point, all the systems that are protected by IT security will be unsecure – everything from a smart card and company databases to internet communications.

“If – and many people argue ‘when’ – there is a breakthrough and a powerful quantum computer comes into existence, then that point will be too late to begin to ask questions about how we react. We have to be prepared. And for industry and government agencies that haven’t already started to embrace post-quantum cryptography, the time to act is now,” he urges.

Several structural elements underscore the urgency:

• A multi-year, multi-system, multi-phased migration: Cryptography is deeply embedded across digital architectures. Transitioning to quantum-resistant algorithms will require comprehensive audits, prioritization of critical systems, and phased deployment – a process likely to span years.
• Long-lived infrastructure: Many deployed devices and systems – from industrial hardware to passports – remain operational for a decade or longer. So, while not under threat today, systems installed today must be resilient against future quantum attacks.
• Harvest now, decrypt later: Malicious actors can already capture encrypted data with the intention of exploiting it later. Organizations must therefore not only put in place new cryptosystems but also consider re-encrypting historically stored sensitive data using post-quantum algorithms.

A growing number of governments and security agencies around the world are pushing for a large-scale migration to quantum-safe cryptography. The EU’s PQC roadmap, for example, is encouraging a migration for high-risk use cases by 2030 and a full migration (where feasible) by 2035. A recent Executive Order from the US sets migration timelines for high-value assets: 2030 for key establishment and 2031 for digital signatures. Other countries promote similar deadlines.

Path to a post-quantum security

The path toward creating and implementing PQC is already paved.

The US National Institute of Standards and Technology (NIST) began soliciting proposals for quantum-resistant cryptographic algorithms back in 2016 and finalized its first three standards in mid-2024, with a fourth expected soon. Together, these standards are intended to form the backbone of most PQC deployments. These PQC standards are now integrated into interoperable protocols for global use cases – such as telecommunications and international travel – by leading international standardization bodies such as GSMA, 3GPP, and ICAO.

The acceptance and application of these universal standards is critical, argues Vater. “In a global world, we need global standards. To ensure communication between all parties and devices, all have to use the agreed set of algorithms,” he says.

The NIST PQC standards comprise ML-KEM for key encapsulation; ML-DSA for digital signatures; SLH-DSA as a hash-based backup signature method; and FN-DSA (still in development), offering smaller signatures and faster runtimes but facing some challenges when it comes to secure implementation.²

Multiple algorithms are necessary to meet the diversity of assets that must be protected, Vater explains. “ML-KEM is an algorithm we need for encryption, for example; ML-DSA we need for signature generation and verification. And each algorithm has its advantages and disadvantages. There are algorithms that need a lot of memory to run, others require only a small computational footprint on the target semiconductor. Some can generate only a few signatures. Other can generate lots.”

Implementing PQC for smart cards

G+D has been investigating where standards fit best across many areas of security. Vater points to smart cards as a mature example of a real-world deployment.

“As a leader in smart cards, we are defining which post-quantum algorithms can be used and under what conditions – the computational runtime, the memory consumption, necessary adaptions to the target semiconductor, and so on,” he says. “Because of the device size, smart cards need algorithms that require only a small amount of memory and runtime capacity. So, ML-KEM and ML-DSA are a good fit,” says Vater.

However, migration is not a simple substitution. “Quantum-resistant algorithms have different interfaces; they have different memory consumption; different key lengths and parts of keys. Everything is different. So, you can’t simply replace the classical algorithm with a post-quantum one. You have to change the complete system to accommodate those new algorithms. With a smart card, that applies to the background system, the semiconductor, the smart card reader, the whole protocol for communications, and more.”

In most ecosystems, PQC adoption will be first undertaken in a hybrid mode: combining both classical and PQC algorithms. On the one hand, this allows for backwards compatibility with legacy systems; on the other, it brings additional security as the PQC algorithms are still relatively new and have yet to fully prove their reliability in the field.

New standards for secure ID in the age of quantum

The development of a hybrid protocol was a central challenge that G+D undertook with the German federal technology company Bundesdruckerei when creating a PQC-ready demonstrator for the next generation of the German national ID cards.

The proof of concept – created for the German Federal Office for Information Security (BSI), which oversees German ID cards – demonstrated, in Vater’s words, “that we are prepared for the quantum era.”

Since its introduction in 2010, Germany’s national ID card – with its integrated online identification feature – has been recognized as one of the world’s most secure government-issued documents. To ensure that it remains secure in the future, the next generation of ID cards must be protected against potential quantum-computer attacks. This applies to both the hardware and software of all cards issued in the coming years, as each card is valid for 10 years.

In recent months, Bundesdruckerei and G+D have established a unique technical foundation for this transformation. They jointly initiated the development of a demonstrator, together with the German Federal Office for Information Security, implemented on specialized chips produced by semiconductor manufacturer Infineon.

Germany’s transition to quantum-secure ID cards will occur in two stages. First, personal data will be protected from forgery using a quantum-resistant digital signature plan. The second phase will involve a full transition to quantum-secure technology.

The proof of concept represents one of the world’s first functional implementations of a national ID card that combines classical and post-quantum cryptography, following the latest recommendations for quantum-secure algorithms. Bundesdruckerei and G+D are the first in Germany to demonstrate that highly secure, quantum-resistant cryptography, covering both encryption and authentication, can be implemented on ID chips.

This proof of concept also provides Veridos, the joint venture of G+D and Bundesdruckerei, with a basis for applying the gained insights to the further development of international travel documents and for meeting standardization requirements for global interoperability.

Embracing a quantum-resistant future

Quantum computers will be very good at certain types of problem, but not all. “It is important to have hybrid implementations – both classic and post-quantum algorithms – so you can rely on either principle of security,” says Vater. A hybrid approach also ensures security while maintaining compatibility with systems not yet updated to PQC.

The call to action on PQC has firmly landed at many businesses, tech providers, and government agencies. “Nobody knows when a powerful quantum computer will be viable, but we are working on the assumption that point it will come. So, the whole world is changing now to quantum-resistant algorithms,” says Vater. 

The quantum threat is certainly on the minds of G+D customers, says Vater, especially those that deploy long-life-cycle technologies – automotive semiconductors, ePassports, and ID documents, for example – that might be in situ for over a decade. “All those must be secure, not only today, but in 10 years or longer,” he says. “The core challenge, therefore, is creating long-lasting trust anchors in immutable security chips. Customers want to be assured that the assets we help create for them now are going to be protected from a post-quantum break-in in the future.”

Demonstrating post-quantum readiness

Evidence of PQC migration is already visible. At the end of 2025, Cloudflare – which routes roughly a quarter of global internet traffic – reported that (for the first time) more than half of human-initiated traffic across its network was secured using post-quantum encryption. Adoption has been accelerated by the integration of PQC into major browsers and operating systems.³

Cloudflare targets 2029 for full post-quantum security.⁴ And G+D has been building up the kind of PQC expertise that is needed now and in coming years.

With its participation in the two key projects, Aquorypt and Quoryptan (funded by German’s Federal Ministry of Education and Research), G+D has acquired extensive experience in implementing resource-demanding PQC algorithms on small, embedded devices. That involves reducing the computational footprint of cryptographic algorithms while maintaining the highest security against side-channel and fault inject attacks.

Elsewhere, through its cybersecurity company secunet, it has already helped the German authorities integrate post-quantum cryptography (PQC) into digital infrastructure, ensuring that highly classified data is protected against store-now, decrypt-later attacks. Devices used by German Armed Forces to handle highly classified information are already equipped with elements of PQC as part of secunet’s SINA architecture that forms the basis for Germany’s secure IT networks. Such devices have also been delivered in other EU and NATO countries.⁵

As Vater emphasizes: “Everybody, everywhere is now considering this problem or has embarked on remaking their systems with quantum-safe algorithms. But with so much at stake, many organizations will need to go further and faster to make sure that their digital assets are protected.”

Published: 31/07/2026