Why Post-Quantum Cryptography Matters Now, Not Later
Godfrey Maiwun · February 2025 · Cryptography · 5 min read
The quantum threat to encryption is not speculative fiction. It is an engineering timeline — and the organisations that begin transitioning now will be the ones that aren't scrambling when that timeline closes.
The problem with "later"
One of the most common refrains in security is that quantum computing capable of breaking RSA or elliptic-curve cryptography is "decades away." This framing is technically defensible but strategically dangerous. The threat is not just when a quantum computer breaks encryption. It is today, through a class of attacks known as "harvest now, decrypt later."
Adversaries are collecting encrypted data now — financial records, state communications, intellectual property — with the intention of decrypting it once the capability exists. For data with a long sensitivity horizon, the clock is already running.
What NIST has signalled
The National Institute of Standards and Technology finalised its first set of post-quantum cryptographic standards in 2024. This is not a theoretical exercise. It is an institutional acknowledgement that migration needs to begin, and that the window for orderly transition is finite.
The selected algorithms — CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures, among others — represent years of global cryptographic competition and peer review. They are not perfect, but they are ready.
Cryptographic agility
For most organisations, the immediate priority is not replacing all cryptographic infrastructure overnight. It is cryptographic agility — designing systems that can swap out algorithms without requiring wholesale re-architecture.
Cryptographic agility is not a luxury. It is the difference between a planned migration and an emergency response.
This means auditing what you protect and with what, identifying the highest-risk systems, and building a transition roadmap that is realistic about timelines and budget — without using uncertainty as a reason to delay.
Where to start
The organisations best positioned for the post-quantum era are not those with the biggest budgets. They are those who started the conversation early. That means inventorying cryptographic assets, identifying data with long-term sensitivity, understanding which vendors in your supply chain are already moving, and building internal literacy so that decisions are made by people who understand what they are deciding.
The time for that conversation is not later. It is now.
Filed under: Cryptography