Two Clocks: Why Post-Quantum Cryptography Stopped Waiting for the Quantum Computer

Ask a security team when they will finish their post-quantum cryptography migration and you will usually get an answer about qubits. That is the wrong instrument to read. Two clocks are running, and they are no longer synchronised. One measures quantum hardware progress. The other measures regulation and the shelf life of your own data. The second one has already gone off.

What post-quantum cryptography actually replaces

Almost every secure connection you make today rests on public-key cryptography: RSA, Diffie-Hellman, and elliptic-curve variants. Their security comes from arithmetic that is punishing for classical computers, such as factoring very large numbers. Peter Shor showed in 1994 that a sufficiently large quantum computer turns that punishment into a routine calculation.

Symmetric encryption is in far better shape. Grover’s algorithm gives an attacker only a square-root speedup, which in practice means doubling key length. AES-256 survives. Your TLS handshake, your code-signing chain, and your VPN key exchange do not.

So the remedy is not “quantum encryption.” It is different mathematics, running on ordinary hardware. NIST finalised the first three standards in August 2024: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for signatures. HQC was selected as a code-based backup resting on different mathematical assumptions, and FN-DSA is queued as FIPS 206 for bandwidth-constrained cases. I have covered the obligations each one creates in a separate breakdown of the NIST post-quantum standards.

Clock one: the quantum ecosystem is compounding

Error correction stopped being a research promise somewhere around 2024. Google demonstrated surface-code memories operating below the critical threshold, meaning logical error rates fall exponentially as you add physical qubits rather than rising. That single result reframed quantum computing from a physics question into an engineering one.

The counts followed. Quantinuum reported 94 logical qubits on H-series trapped-ion hardware in March 2026. QuEra demonstrated 96 logical qubits from 448 physical ones on neutral atoms. IBM’s published roadmap targets Starling by 2029: roughly 200 logical qubits from about 10,000 physical, running hundred-million-gate circuits, with 100,000 qubits pencilled in for 2033.

Read those numbers carefully, because vendors are not measuring the same thing. Code family, code distance, and whether decoding happens in real time all change what a “logical qubit” actually buys you. Breaking RSA-2048 needs thousands of them sustaining billions of sequential operations, which is a different order of machine entirely. Google nonetheless warned in March 2026 that a cryptographically relevant quantum computer could plausibly appear as early as 2029, and set that same year as its own internal migration deadline. Cloudflare landed on 2029 too.

Clock two: the deadline that already passed

Here is the part that gets skipped. An adversary does not need a quantum computer today to hurt you today. They need a hard drive. Capture encrypted traffic now, store it, decrypt it when the hardware exists. If a document must stay secret for fifteen years and the machine arrives in twelve, that document is already lost. This is the harvest now, decrypt later problem, and it converts a future capability into a present-tense breach.

The compliance calendar reflects that logic rather than any hardware forecast. On 21 September 2026, NIST moves all remaining FIPS 140-2 module certificates to the Historical list, so only FIPS 140-3 validated implementations qualify for new US federal procurement. From 1 January 2027, new National Security System acquisitions must support CNSA 2.0. NIST IR 8547 deprecates RSA-2048 and P-256 in 2030 and prohibits quantum-vulnerable algorithms outright by 2035.

Against that, roughly 13 percent of organisations have post-quantum cryptography running in production and about 60 percent have not meaningfully begun. Large enterprises are looking at transitions of eight to fifteen years. NIST’s own Migration to Post-Quantum Cryptography project exists precisely because the discovery phase alone defeats most teams.

Why the two clocks came apart

Do the subtraction. If prohibition lands in 2035 and your migration takes a decade, your start date was 2025. The length of your transition, not the arrival date of the threat, determines when you should have begun. Waiting for clearer signals from the hardware side is a category error, because the hardware side is not your constraint. Your certificate sprawl is.

This is why crypto-agility keeps appearing in guidance, and why it is routinely misread as a patching exercise. It is an architectural property: cryptographic primitives sit behind an abstraction your applications do not hardcode, so an algorithm can be swapped without touching business logic. Organisations that built that separation a decade ago for unrelated reasons are having a much better 2026 than everyone else.

The quantum ecosystem is not only a threat

It is worth noticing that the money funding the risk also funds the defence. Germany has committed over three billion euros to quantum technologies. The UK announced a further two billion pounds in March 2026. France is running an 1.8 billion euro national strategy. Canada launched the first phase of its Quantum Champions Program in December 2025. Romania has deployed a quantum key distribution network spanning more than 1,500 kilometres across six cities. Cumulative global investment has passed fifty billion dollars across more than 1,100 companies in over fifty countries, and the investor base now includes sovereign wealth funds and strategic corporates rather than deeptech specialists alone. Cisco Investments backed Aliro Quantum in February 2026; Infineon has moved into quantum networking through Nu Quantum.

Some of that capital goes to quantum key distribution, which secures a channel using physics rather than mathematics. QKD is genuinely interesting and genuinely limited: it needs dedicated fibre or optical links, it does not authenticate endpoints on its own, and it does nothing for code signing or data at rest. Most national guidance treats post-quantum cryptography as the primary answer and QKD as a specialised complement, not a substitute.

The signature side deserves separate attention, because signatures are where migration gets genuinely hard. Anything that verifies identity over long horizons, from firmware images to blockchain consensus mechanisms, inherits assumptions that are difficult to renegotiate after deployment.

Post-quantum cryptography: what to do in the next twelve months

1. Build a cryptographic inventory. You cannot migrate what you cannot find. Certificates, TLS terminators, VPN concentrators, HSMs, code-signing pipelines, embedded firmware, and every vendor SDK that quietly ships its own crypto.
2. Classify by secrecy lifetime, not by system importance. Data that must stay confidential past 2035 is the priority queue, regardless of which server it lives on.
3. Take the free wins. Hybrid post-quantum key exchange is already live across major browsers and CDNs. In many stacks it is a configuration flag, not a project.
4. Start the slow items now. Hardware roots of trust, firmware signing keys, and any device with a ten-year field life cannot be fixed in a sprint.
5. Put agility in your contracts. Vendor timelines become your timelines. Ask for them in writing.

The quantum ecosystem’s clock is the interesting one to watch. Your migration clock is the one with consequences. Only one of them is waiting for you.