Post-quantum readiness for KSA and UAE
Your encryption has an expiry date.
The risk starts before the quantum computer does
Harvest now, decrypt later
Attackers can copy encrypted traffic and backups today and read them later. Anything that must stay confidential for years is already exposed.
Migration takes years
Cryptography sits inside applications, devices, PKI, payment systems and vendor products. Finding it all is usually the slowest part.
The deadlines are set
NIST deprecates RSA-2048 and ECC after 2030 and disallows them after 2035. Most regulators take their lead from NIST.
Check your exposure
Three numbers decide whether your data outlives your encryption.
Exposed by 6 years. Data you still encrypt with RSA or ECC at the end of your migration needs protecting until 2041, six years past your quantum horizon of 2035.
Based on Mosca's inequality: if shelf life plus migration time is longer than the time until a quantum threat, you are exposed.
Post Quantom Migration timeline
-
Standards are final
FIPS 203, 204 & 205 published: ML-KEM, ML-DSA and SLH-DSA
-
You are here
Assess, discover, testInventory every key and certificate, test crypto-agility, start migrating long-lived data
-
Transition
RSA-2048 and ECC deprecated for federal use — most regulators follow NIST
-
Quantum-safe only
Quantum-vulnerable algorithms disallowed
Harvest now, decrypt later. Data encrypted with RSA-2048 and stolen today can be decrypted the day a cryptographically relevant quantum computer exists. That is why the deadline is now, not 2035.
From inventory to crypto-agility
Assess
PQC risk assessment
Crypto inventory through discovery
Test and transition
Set up a test environment
Encryption and key hygiene
Test priority applications
Switch to PQC
Operate crypto-agile
Remain flexible
The risk starts before the quantum computer does
Cryptographic inventory
Cryptographic inventory
Migration roadmap
Quick wins
Three rules we migrate by
Hybrid only where it helps
Plan for the whole ecosystem
Move with the standards
Common questions
What is post-quantum cryptography?
Post-quantum cryptography (PQC) is a set of public-key algorithms designed to resist attacks from both classical and quantum computers. NIST published the first three standards in 2024: ML-KEM (FIPS 203) for key establishment, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures.
Can a quantum computer break our encryption today?
Not yet. The risk today is “harvest now, decrypt later”: encrypted data copied now can be read once a cryptographically relevant quantum computer exists. Anything that must stay confidential for years is already in scope.
Do we need to replace all of our cryptography?
No. The main concern is public-key cryptography such as RSA, ECC and Diffie-Hellman. Symmetric encryption such as AES-256 is not the main concern. The work is finding where vulnerable algorithms are used and replacing them in priority order.
What is crypto-agility?
The ability to change algorithms, keys and certificates without rewriting applications. It comes from central key management, well-run PKI and certificate lifecycle management, and it means the next standards change is a configuration change rather than a project.
Where should we start?
With an inventory. You cannot prioritise what you cannot see. A PQC readiness assessment gives you the inventory, a risk ranking and a roadmap in one engagement.