Post-quantum readiness stopped being a research question on 22 June 2026, when Executive Order 14412 was signed. Two days later OMB Memorandum M-26-15 turned it into an instruction: US agencies have 120 days to file a cryptographic inventory and plan, with key establishment by December 2030 and signatures by end-2031. Australia runs on the same clock: a plan by end-2026, ASD-approved algorithms by 2030.
Nothing about quantum hardware changed. Compliance now has dates, and dates move budgets. Visibility and agility are the binding constraints: the algorithms shipped in 2024, yet DigiCert finds 7% deployed and IBM scores the average organisation at 25 out of 100.
In This Series
- Which post-quantum deadlines actually bind Australian organisations: what’s due first.
- What quantum computers will actually break, and when: what falls and survives.
- Harvest now, decrypt later and why archived data is already exposed: why recorded traffic is exposed.
- Cryptographic inventory and agility are the real post-quantum bottlenecks: why inventory comes first.
- ML-KEM, ML-DSA and the hybrid key exchange already carrying web traffic: which algorithms come first.
- Making a post-quantum migration plan executable, fundable and defensible: infrastructure, suppliers, boardroom.
Why has post-quantum readiness moved from a roadmap to a deadline?
The shift is regulatory, not physical. Executive Order 14412 and OMB Memorandum M-26-15 set US agencies a 120-day inventory-and-plan filing, key establishment by December 2030 and signatures by end-2031, while the ASD’s Information Security Manual expects an Australian transition plan by end-2026. Nothing about quantum hardware changed that week — what changed is that budgets and compliance now have dates. Your first decision is which instrument binds you, directly or through customers.
Executive Order 14412 is a political trigger; OMB Memorandum M-26-15 is binding direction to US agencies, hedged with “as feasible by December 31, 2030.” Australia adds critical systems from 2028 under the ASD’s Information Security Manual; 2030 carries roughly 15 compliance deadlines across jurisdictions.
For most mid-sized Australian companies the obligation arrives through customers and contracts; the ISM’s force depends on the regime, whether SOCI Act or APRA CPS 234. Which deadlines bind Australian organisations walks through each.
What will quantum computers actually break — and when?
Shor’s algorithm breaks RSA, finite-field Diffie-Hellman, ECDH, ECDSA and DSA, the primitives your certificates, TLS handshakes, VPNs and code signing rely on. AES-256 and SHA-2/SHA-3 survive, because Grover’s algorithm offers only a modest speed-up that a longer key defeats. Expert estimates run from roughly 2030 to 2050. That spread is real, and does not on its own settle your exposure.
Post-quantum cryptography is classical software that Shor’s algorithm does not break; a cryptographically relevant quantum computer is the machine that would. Shor’s exploits the period-finding structure those groups share, and Filippo Valsorda’s analysis shows breaking AES-128 is orders of magnitude harder than breaking 256-bit elliptic curves.
Timing is harder. A Caltech, UC Berkeley and Oratomic paper cut the qubit requirement to as few as 10,000 under stated assumptions, while NEC walked away from quantum hardware after nearly three decades. What quantum computers will actually break unpacks both, and the spread cannot justify deferral while the dates stay fixed.
Is your data already exposed today?
Yes, for long-lived data. Harvest now, decrypt later means traffic recorded today can be decrypted once a quantum computer exists, and the weak point is your TLS handshake’s ephemeral key exchange, not your AES traffic. Mosca’s inequality — data shelf life plus migration time against time to a quantum computer — shows Australian retention rules push shelf life beyond any plausible migration window. The question is which data stays confidential longest.
Perfect forward secrecy limits the damage a later compromise of the server’s long-term key can do; it does not defeat an adversary who can break the ephemeral exchange.
My Health Record keeps records for 30 years after death, and the Archives Act 1983 and Privacy Act 1988 extend the same logic.
Long-lived confidentiality migrates first: health records, identity documents, financial histories, source code, backups and archives. Session-scoped data waits. Ordering by system criticality puts the wrong systems first, and finding the data comes next.
Why are inventory and agility the real bottleneck, not the algorithms?
The algorithms are not the constraint. They shipped in 2024, and hybrid X25519MLKEM768 already carries much web traffic. The constraint is visibility and agility: DigiCert finds deployment near 7% against 87% planning, and IBM scores the average organisation at 25 out of 100. You cannot migrate what you cannot enumerate, and you cannot swap primitives quickly without agility. Where those gaps sit determines whether 2030 is reachable.
The inventory comes first; M-26-15 makes it a filed deliverable. An SBOM lists components; a CBOM maps the cryptography in use and where it sits.
Cryptographic inventory and agility defines agility operationally as time-to-swap: the time to change a primitive or provider without re-architecting, measured in practice. Build versus buy stays open.
ML-KEM (FIPS 203) and hybrid X25519MLKEM768 already run in production, where Cloudflare reports most traffic is post-quantum and Google enables it by default. ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) lag because signatures touch X.509, PKI and hardware. ML-KEM, ML-DSA and hybrid key exchange covers which comes first.
What makes a migration plan executable, fundable and defensible?
The plan survives or fails in the infrastructure layers: HSMs and key managers, load balancers and middleboxes that terminate TLS, and certificate authorities that must issue and validate larger keys and signatures. Supplier assurance separates a real capability from marketing, and in the boardroom the argument that lands is retention-period and supply-chain. Your decision is what must be true in infrastructure, contracts and governance before the spend is defensible.
Each layer has its own firmware and refresh cycle, and the slowest one sets the critical path. FIPS 140-3 and CMVP validation is the procurement constraint; a vendor roadmap item is not shipping support.
The supplier questions are which component and version, what validation status it holds, what remains on your side, and whether you can test it. Making the plan executable and fundable covers the boardroom side, and the five-phase programme to 2035 is the funding frame.
Resource Hub: Post-quantum readiness deep dives
The clock, the threat and the exposure
- Which post-quantum deadlines actually bind Australian organisations: what’s due first.
- What quantum computers will actually break, and when: what falls and survives.
- Harvest now, decrypt later and why archived data is already exposed: why recorded traffic is exposed.
Visibility and the algorithms
- Cryptographic inventory and agility are the real post-quantum bottlenecks: why inventory comes first.
- ML-KEM, ML-DSA and the hybrid key exchange already carrying web traffic: which algorithms come first.
Execution and the board case
- Making a post-quantum migration plan executable, fundable and defensible: infrastructure, suppliers, boardroom.
Where to start
The dates are set; most lack the inventory and agility to act.
- If you need what is due first, start with the deadlines that actually bind you.
- If your archived data is already exposed, start with why recorded traffic is exposed.
- If you want the mechanism, start with the algorithm deployment order.
- If you need the board case, start with funding and defending the plan.
Frequently Asked Questions
Is post-quantum cryptography the same thing as quantum cryptography?
No. Post-quantum cryptography is classical software that runs on the hardware you already own, chosen because Shor’s algorithm does not break it. Quantum cryptography means using quantum physics itself, such as quantum key distribution, which needs dedicated optical hardware and has narrow use cases. The standards that matter here, ML-KEM and ML-DSA, are ordinary algorithms your existing libraries can implement.
Is my HTTPS traffic already post-quantum protected?
Partly, and only if both ends support it. Hybrid X25519MLKEM768 is enabled by default at Cloudflare’s edge and in Google’s Chrome, so a modern browser reaching a supporting site already negotiates post-quantum key establishment. That protects the session key, not the certificate signature, which remains classical. Anything terminating on an older load balancer, appliance or internal service is still negotiating classically.
Will post-quantum encryption slow down my website or network?
Rarely in a way users notice. ML-KEM key establishment is fast and produces slightly larger keys and ciphertexts, which adds a few hundred bytes to a TLS handshake rather than milliseconds. The measurable cost usually appears in certificate chains and signature verification, and in middleboxes that choke on larger records. Test with real traffic rather than trusting a vendor benchmark.
Does hybrid key exchange weaken security by mixing in a new algorithm?
No. A hybrid handshake combines a classical exchange such as X25519 with ML-KEM and derives the session key from both, so an attacker must break both to recover it. That design protects you if ML-KEM is later found weak, and equally if elliptic curves fall first. It is a hedge against implementation surprises, not a compromise.
We are not a target, so why would anyone harvest our traffic?
Harvesting is indiscriminate because storage is cheap. An adversary records bulk encrypted traffic and sorts it later, so targeting happens after decryption, not before. Your exposure depends on how long the data must stay confidential, not on how interesting you think you are. Contracts, health records, legal files and intellectual property routinely carry retention periods measured in decades.
Won’t we get warning before a quantum computer arrives?
Probably less warning than you expect, and it would not help. A cryptographically relevant machine could be announced or used quietly, and estimates already range from roughly 2030 to 2050 with no consensus narrowing. Migration runs through HSMs, certificate authorities and supplier firmware cycles that take years. A warning window shorter than your migration is not a warning.
How long does a post-quantum migration actually take?
M-26-15’s own phasing runs from discovery and planning in 2026 and 2027 through pilots, prioritised migration, signature work in 2031 and full migration by 2035. That is nine years for agencies with existing programmes. Organisations starting without an inventory should assume the early phases take longer, because discovery is where most of the surprises sit.
What happens if my organisation misses the 2030 deadline?
For US federal agencies, M-26-15 creates a reporting obligation and a plan the agency must defend, and the ‘as feasible’ wording is a hedge, not an exit. For most Australian organisations the consequence is contractual rather than statutory: customer assurance questionnaires, procurement conditions and prudential obligations such as APRA’s CPS 234. Missing the date mostly costs you eligibility and trust.
What is a CBOM, and how is it different from an SBOM?
A software bill of materials lists the components in your build; a cryptographic bill of materials lists the algorithms, key lengths, protocols and certificates those components use. The CBOM is the artifact that answers ‘where is RSA still running?’ and it is what M-26-15’s inventory deliverable expects. Most organisations can generate an SBOM long before they can generate a trustworthy CBOM.
Do we have to replace our certificates and PKI?
Eventually, yes, because ML-DSA signatures are larger and X.509, trust stores, OCSP and hardware tokens all have to carry them. That is why signatures trail key establishment in every credible sequence: the cryptography is ready, the ecosystem is not. Start by inventorying certificate authorities, issuance automation and embedded trust stores now, before you choose an algorithm.
What should we do first if we have no cryptographic inventory at all?
Start with what you can see and label the gaps honestly. Pull TLS endpoints, certificate expiry data, VPN and code-signing configurations, then reconcile that against supplier attestations, because most estates hide cryptography inside appliances and SaaS. A partial CBOM with named unknowns is more useful than a complete-looking spreadsheet, and it is defensible as a first filing.
Is post-quantum migration mandatory for private Australian companies?
Not directly. The ASD’s Information Security Manual binds Commonwealth entities and the providers they contract, and M-26-15 binds US agencies. Private Australian companies inherit the obligation through contracts, procurement and prudential standards, which is why the dates still land on their roadmap. Assume your largest customer will ask, and that the answer will need evidence.
