Germany’s national guidelines set 2030 targets for quantum resilience. But guidelines on paper don’t upgrade legacy servers…
A recent joint announcement from the Federal Office for Information Security (BSI), alongside the Ministry of the Interior (BMI), and the Ministry for Digital Affairs and State Modernization (BMDS) has established Germany’s national guidelines for post-quantum cryptography.
The guidelines provide a crucial framework for action – for federal, state, and municipal administrations, focusing on critical infrastructure and the importance of cryptographic agility. It’s another key reminder to ‘start before the clock runs out’ primarily by:
- Conducting cryptographic inventories
- Embedding PQC requirements into procurement cycles
- Considering crypto-agility as a core architectural goal rather than a future update
With RSA and ECC asymmetric encryption at risk from quantum computers, the quantum horizon has been in sight for a long time. The urgency has led to a target of 2030 for high-risk systems and a complete rollout of quantum-resilience by 2035, particularly as a result of the Harvest-Now-Decrypt-Later threat. However, in recent months, AI has also provided a huge acceleration to the problem. It is not waiting for fault-tolerant hardware. The Roadmap issues specific warnings:
Because AI speeds up both defense and attack, standardizing on a single static algorithm is dangerous. Crypto-agility, the ability to switch out an algorithm or lengthen keys dynamically without rebuilding system infrastructure, has become the core architectural requirement.
AI-driven discovery is lowering the barrier for exploitation by accelerating cryptanalysis. Quantum computing provides the computational power to break asymmetric keys, but AI speeds up the search for weak implementations, side-channel leaks, and mathematical shortcuts.
There’s little doubt that a 4-9 year window for architectural upgrade is tight, especially when considering fragmented municipal networks and Germany’s legacy public databases.
For these reasons, the Roadmap outlines four operational pillars:
- Clear Governance – assign clear organizational responsibility, establish milestones for PQC migration
- Systematic Risk Audits – embed quantum risk directly into corporate and government risk management matrices
- Supply Chain & Vendor Alignment – ensure hardware manufacturers, cloud and software providers support PQC out of the box
- State-of-the-Art Cryptography – transition to NIST-approved and BSI-recommended lattice-based algorithms (ML-KEM, ML-DSA)
While the Roadmap provides clarity, it’s important to note that the onus is on the decision-makers and organization leaders. Most public agencies and enterprises are unlikely to know completely where encryption is embedded, and public legacy systems often rely on rigid codebases that won’t support modern key sizes or signature formats without rewrites. It’s clear that a bold strategy is required, and a focus on crypto-agility, based on guidelines such as those provided by the BSI. While the BSI, BMI, and BMDS explicitly target “municipal administrations” and demand “early integration of supply chains,” publishing a framework is, of course, only the starting line. Guidelines on paper do not upgrade physical servers or force external vendors into compliance. And 2030 is right around the corner.