Q-Day Is Coming: Why Every Company Must Migrate Its Encryption Now
How NIST's final roadmap is forcing enterprises and critical infrastructure to move away from RSA and elliptic-curve encryption before quantum computers can break them.
How NIST's final roadmap is forcing enterprises and critical infrastructure to move away from RSA and elliptic-curve encryption before quantum computers can break them.
Every time you open a banking app, sign a contract online, or send a message over a secure channel, you are trusting a single piece of mathematics: the fact that multiplying two huge prime numbers together is trivial for a computer, but reversing the process — factoring the result — would take a classical computer longer than the age of the universe. That assumption backs most of the world's encryption, including RSA and elliptic-curve cryptography (ECC), the two systems that protect the internet's private communications.
There is, however, a hypothetical machine that would make that assumption worthless. A large, error-corrected quantum computer could run Shor's algorithm and factor those numbers in hours. Security experts call the day such a machine arrives "Q-Day." Until recently, Q-Day felt like a distant science-fiction scenario. Today it sits at the center of one of the most expensive and urgent migrations in the history of information technology — a race against a clock that, unlike most clocks, cannot be paused.
Why this matters: This is not a hypothetical about the distant future. The data you encrypt today may already be recorded by adversaries who can decrypt it once a quantum computer exists. The migration to quantum-safe cryptography is one of the few cases in IT where the threat is physical, universal, and unavoidable — and where the fix takes years to complete.
For most of the last decade, post-quantum cryptography (PQC) was a research topic. That changed in 2022, when the U.S. National Institute of Standards and Technology (NIST) published its first set of standardised algorithms, and it is now accelerating into mandatory adoption. The milestones are easy to follow:
The final IR 8547 is the piece that has security teams sitting up. It does not merely recommend the new algorithms; it establishes hard deadlines. Under the schedule, algorithms offering only 112 bits of security (which includes common RSA-2048 and ECDSA-P-256 configurations) are to be deprecated after 2030 and disallowed entirely after 2035. The 192- and 256-bit security levels — the ones protecting the most sensitive data — must be in place well before that, because long-lived secrets such as state secrets, critical-infrastructure blueprints, and financial records require protection that outlives the next decade.
"The deadline is not the scary part," says one industry analyst familiar with NIST's transition working group. "The scary part is that most organisations have not yet inventored every cryptographic primitive they use. You cannot migrate what you do not know you have."
The urgency is compounded by a technique called "harvest now, decrypt later." Adversaries with limited quantum capability can record encrypted traffic today — traffic that looks useless to them right now — store it, and decrypt it the moment a powerful quantum computer appears. Long-lived secrets, medical records, industrial control systems, and classified data are especially vulnerable, because the value of their encryption can span decades. In effect, the damage from Q-Day may have already begun, silently, years ago.
To understand why the migration is so difficult, it helps to imagine three everyday scenarios.
Imagine you run a hospital. Patient records created today may need to remain confidential for 80 years. If you encrypt them with RSA-2048, and a quantum computer arrives in 2035, those records could be exposed long after the patients are gone. The fix is to encrypt them now with a quantum-safe algorithm — even though the quantum computer does not yet exist.
Imagine you work for a power grid. The sensors and control systems that keep the lights on often run on hardware that cannot be upgraded for 15 or 20 years. You cannot simply install a new software library on a turbine controller installed in 2014. This is the "crypto-agility" problem: the infrastructure must be designed to swap algorithms in and out as mathematics evolves, without replacing the underlying hardware.
Imagine you are building a mobile app. Every time your app connects to a server, it performs a "handshake" — a cryptographic negotiation that proves both sides are who they claim to be. If your app uses a classic handshake, it is vulnerable. Migrating means updating the underlying libraries that every developer on earth already relies on, a task comparable to replacing the engine of a car while it is still driving.
The core idea: Post-quantum cryptography is not a new kind of encryption. It is a new set of mathematical problems — based on lattices, codes, and multivariate equations — that are easy for a classical computer to solve but believed to be hard even for a quantum computer. The public can read the algorithms and attack them openly; their strength comes from mathematics, not from keeping a secret.
The migration touches nearly every sector, but a handful are especially critical:
NIST's chosen algorithms are based on lattices — geometric structures of points in multi-dimensional space. The security of lattice-based cryptography rests on problems like "Learning With Errors" (LWE), which are believed to be hard even for quantum algorithms. Here is a quick guide to the three standards and what they are used for:
| Algorithm | Former Name | Purpose | Replaces |
|---|---|---|---|
| ML-KEM (FIPS 203) | Kyber | Key encapsulation — securely exchanging keys used to encrypt data | Diffie-Hellman, RSA key transport |
| ML-DSA (FIPS 204) | Dilithium | Digital signatures — proving authenticity and integrity | ECDSA, Ed25519, DSS |
| SL-DSA (FIPS 205) | SPHINSS+ | Signature schemes with very small public keys / long-term keys | Hash-based signatures |
| ML-KDF (FIPS 206) | — | Key derivation — generating multiple keys from one secret | Classical key-derivation functions |
There is a practical catch worth understanding: PQC keys and signatures are larger than classical ones. An ECDSA signature is about 64 bytes; an ML-DSA signature can be several kilobytes. ML-KEM encryption keys can be a few hundred bytes compared with a few dozen for elliptic curves. For most modern networks this is fine, but for constrained environments — radio links, satellite links, or tiny IoT sensors — the extra bytes matter, and engineers must choose the right algorithm for the right job.
Short term (1–2 years): Inventory and planning dominate. Organisations will discover exactly how much cryptography is embedded in their software supply chain — often a surprising amount, buried inside libraries they never wrote. Hybrid deployments, which pair a classical and a post-quantum algorithm, will become the default during this transition period.
Mid term (3–5 years): Migration reaches critical infrastructure and regulated industries. The 2030 deprecation of 112-bit security will force action. Certificate authorities will begin issuing quantum-safe certificates, and TLS connections will increasingly negotiate post-quantum key exchange.
Long term (10+ years): Classical cryptography for sensitive data becomes the exception rather than the rule. New attacks and weaknesses will emerge — as they always do — and the algorithms will evolve again. The goal is not a permanent solution but a system flexible enough to adapt.
The bottom line: Q-Day is not a single event but a horizon. The organisations that are best prepared are not those waiting for a quantum computer to appear, but those building "crypto-agility" now — the ability to change algorithms quickly and safely as the threat landscape evolves.
The field is moving fast. Beyond the NIST standards, researchers are developing hybrid cryptographic schemes that combine classical and post-quantum algorithms, so that even if one is later found to be weak, the other still protects the data. There is also active work on quantum key distribution (QKD), which uses the laws of physics rather than mathematics to share keys — though it requires specialised hardware and is not a drop-in replacement for most systems.
Meanwhile, the quantum computers themselves are improving. Each announcement about larger qubit counts or better error correction reminds the industry that the timeline is uncertain. Some experts believe Q-Day is a decade away; others think it could arrive sooner. The one thing everyone agrees on is that waiting is not a strategy, because of harvest-now-decrypt-later.
Positives:
Risks and challenges:
The transition to post-quantum cryptography is one of the quietest yet most consequential shifts in modern technology. It will not make headlines until Q-Day arrives — and by then, it will be far too late to start. The final NIST roadmap has drawn a line in the sand: 2030 for deprecation, 2035 for a hard stop. The window to act is wide open, but it is closing.
For leaders, the message is clear. Begin the inventory now. Prioritise the data that must survive the longest. Build the agility that lets you adapt. The quantum computer may not exist yet, but the race to protect against it is already underway — and the winners will be those who started before the countdown became visible.
If this article resonated, share it with your security team and leave a comment below: has your organisation begun its PQC migration yet?