With the recent publication of the new NIST standards, PQC migration is certainly picking up pace in this year of acceleration. Regulation is certain to follow, and as the quantum shift pushes towards standardization, in parallel so does the focus on funding and legislation, particularly from the United States.
Recently, the US Federal Government submitted an extensive report on Post-Quantum Cryptography, that estimates a spend of around $7.1bn on PQC over the next ten years.
Under the Quantum Computing Preparedness Act (H.R.7535) passed in 2022, the Office of Management and Budget’s report outlines the status and scale of migrating the Federal government to PQC, as well as the strategic plan and objectives required to do so.
The strategy includes:
- The ongoing cryptographic inventory of all systems
- Migration to defend against ‘harvest-now-decrypt-later’
- Prioritized systems and data
- Identification of systems unable to support PQC
Following the initial submissions of inventories from relevant Federal agencies, the OMB’s estimate of $7.1bn is a figure that underscores a significant financial commitment, and shows the seriousness with which the US government is tackling the issue.
In addition, the report outlines the co-ordination efforts led by NIST (including the PQC standardization project) and details the scale of its capacity. Interestingly, the NIST National Cybersecurity Center of Excellence (NCCOE) has also initiated a project titled ‘Migration to Post Quantum Cryptography’ with the aim of exploring and publishing best-practice, in collaboration with the private sector. This follows on from initiatives such as the PQC interagency migration working group in January 2024, to which we at PQShield were privileged to attend and contribute.
There’s little doubt that securing the Federal Government against the quantum threat is an effort that will require sustained effort over many years. Yet, for the US, it’s clear that it is a cybersecurity priority, and one that they’re prepared to invest in. With the arrival of further regulatory standards, guidance, and legislation, it’s inevitable that the rest of the world will follow.