For several years now, artificial intelligence (AI) has been consuming everything: budgets, recruitment, and the attention of executive committees. Meanwhile, another revolution is advancing silently, without making a sound. Quantum computing will not replace your servers. It will render the cryptography that currently protects all of your digital communications obsolete.
You must start asking yourself about the timeline for upgrading your company's entire cryptographic infrastructure now, because time is measured in just a few years. This is precisely why post-quantum cryptography is not a 2035 problem, but a project that needs to be addressed starting in 2026.
Key takeaways: The quantum risk is not the date the quantum computer arrives, but the duration of your migration. If your data must remain confidential beyond 2030, you need to tackle this issue head-on and start looking into it. This article aims to provide you with food for thought that can be applied to your own environment.
A classic computer uses bits. Each bit is either 0 or 1, never 2. All the power of your servers relies on billions of these switches flipping rapidly between 0 and 1. A quantum computer, however, plays by different rules.
The qubit is the basic unit of quantum computing. Thanks to a phenomenon called superposition, it can represent 0 and 1 at the same time, in a combination of probabilities, until the moment it is measured. The number of states explored in parallel grows exponentially: ten qubits equal 1,024 simultaneous combinations; fifty qubits exceed a quadrillion.
The second property is entanglement: two entangled qubits remain correlated even when separated, like two rigged dice that always land on linked faces. This is what allows a quantum computer to make its qubits work together rather than treating them in isolation.
Beware of the illusion, however. A quantum computer does not try "all the answers at once" to pick the right one. It uses interference to amplify the correct solutions and cancel out the wrong ones. It is a probability machine.
Rest assured, a quantum computer will never replace your laptop.
It is slow, fragile, cooled to near absolute zero, and terrible at sending emails.
Its value lies elsewhere: in a handful of very specific problems, such as factoring large numbers, certain chemical simulations, and optimization. One of these problems, as it happens, is the mathematical foundation of our cryptography.
Quantum is not AI. People often confuse the two because they are arriving at the same time. AI learns patterns from data. Quantum computing solves a restricted class of mathematical problems. AI helps you write a report; quantum could, one day, break the key that encrypts that report.
Almost everything that protects you online relies on a mathematical gamble: certain operations are easy to perform in one direction but nearly impossible to reverse. Multiplying two large prime numbers is trivial; finding those factors from the product takes a classic computer thousands of years. This imbalance is what keeps RSA, ECC (elliptic curve cryptography), and Diffie-Hellman algorithms secure.
These three families form asymmetric cryptography, which negotiates keys and signs exchanges. It is found everywhere: in the TLS padlock on your websites, in your VPN tunnels, in the SSH that protects access to your servers, in the digital signatures of your software and emails, and in the entire PKI (public key infrastructure) that distributes trust via certificates.
In 1994, mathematician Peter Shor demonstrated that a sufficiently large quantum computer could factor large numbers and solve discrete logarithms in polynomial time. In plain English: RSA, ECC, and Diffie-Hellman would no longer be hard to crack—they would be easy. The gamble that underpins all of asymmetric cryptography would collapse.
The machine capable of doing this does not yet exist at the necessary scale. It would require thousands of stable logical qubits, whereas today we count in hundreds of noisy physical qubits. But the trajectory is clear, and the announcement of the Google Willow chip in late 2024, which crossed a key error-correction threshold, served as a reminder that the timeline could accelerate.
Symmetric cryptography (which actually encrypts data, like AES) faces a different threat. Grover's algorithm provides quantum computing with a quadratic speedup for exhaustive key searches. In practical terms, it halves the effective strength of a key: an AES-128 key would drop to the level of a 64-bit key, which is becoming a bit of a problem.
The solution is simple and well-known: double the key size. AES-256 is still considered quantum-resistant. That is the good news in this article! Your data-at-rest encryption holds up, provided you use sufficiently long keys. The problem isn't AES; it's everything used to negotiate and distribute the keys around it.
Key takeaways. Quantum computing breaks asymmetric cryptography (RSA, ECC, Diffie-Hellman) via Shor's algorithm. It weakens symmetric cryptography (AES) via Grover's, but AES-256 holds firm. The migration priority is key exchange and signatures, not disk encryption.
Here is the point that many executives miss: you don't need to wait for a quantum computer to become a victim. An attacker can capture encrypted traffic today—VPN streams, backups, banking transactions, medical records—and store it patiently.
The day a quantum machine becomes available, they will decrypt everything retroactively. This is the principle of "Harvest Now, Decrypt Later."
The question then becomes: how long does your data need to remain secret? Cryptographer Michele Mosca formulated this as an inequality: if the shelf life of your data plus the time required to migrate your cryptography exceeds the time until a quantum computer arrives, then it is already too late. For a secret that must remain secure for ten years, the 2030–2035 quantum horizon is already within your risk window.
Not all sectors are exposed in the same way. What makes the difference is the lifespan of the sensitive data.
If this were a distant issue, the cloud giants wouldn't be dealing with it yet. But they have all started, and not timidly.
Cloudflare has been the most visible: the company has enabled hybrid post-quantum cryptography on its network and reports that a significant portion of human HTTPS traffic is already flowing through post-quantum handshakes. Google Chrome followed the same path by enabling the X25519MLKEM768 hybrid key exchange by default starting with Chrome 131 (late 2024). In other words, some of your web connections are already protected against quantum threats without anyone even noticing.
As for cloud providers, AWS has integrated ML-KEM into its open-source AWS-LC library and is deploying post-quantum cryptography across its security services (KMS, ACM, s2n-tls). Microsoft has introduced the new algorithms into its SymCrypt library and is preparing Windows and Azure. In terms of pure research, everyone is advancing their own hardware: Google Quantum AI with Willow, Azure Quantum with its topological qubit approach, Amazon Braket providing on-demand access to multiple quantum processors, and OVHcloud, which already offers access to quantum computers via its sovereign cloud.
The implicit message is clear. The players with the most to lose—those who encrypt half the web—are not betting on a "wait and see" approach. They are already migrating to Quantum-Safe technology and environments.
Replacing an algorithm takes one line of configuration on paper. In the real life of an information system, cryptography is buried everywhere—often invisible, sometimes forgotten. This is why the key term to remember is not "quantum" but crypto-agility: the ability to change algorithms without rebuilding everything from scratch.
Take a mental inventory of where cryptography hides within an organization: internal PKI and its certificate authorities, Active Directory and its certificate services, HSM hardware modules, the versions of OpenSSL scattered across your servers, the Java and .NET runtimes of your applications, Kubernetes clusters and their internal TLS mesh, network appliances (firewalls, load balancers), VPN tunnels, and IoT devices or industrial equipment whose firmware hasn't been updated in a decade.
Field report (representative case). When we launch a cryptographic inventory for a client, we almost always find the same surprises: TLS 1.0 or 1.1 endpoints we thought were long gone, self-signed certificates installed "temporarily" five years ago, an internal certificate authority whose password no one knows anymore, appliances with certificates valid for ten years, and industrial hardware that will never support a new algorithm. Quantum computing isn't even here yet, and already, no one knows exactly where their cryptography is. That is the real starting point.
This discovery is actually a blessing in disguise. A cryptographic inventory has immediate value, quantum or not: it eliminates security debt, streamlines PKI, and prepares for automation. You reap the benefits before even discussing post-quantum algorithms.
There is a major underlying trend that the post-quantum migration will only amplify: the lifespan of certificates is plummeting. The CA/Browser Forum has approved a gradual reduction in the maximum validity of TLS certificates to 47 days by 2029. Let's Encrypt has already launched six-day certificates. We are moving away at high speed from the one-year certificate that is manually renewed in a panic.
Manually renewing a certificate every 47 days is unmanageable. The only viable answer is automation via the ACME protocol—the one that made Let's Encrypt possible—and true lifecycle management: issuance, rotation, revocation, and monitoring.
The link to post-quantum is direct. An organization that has automated its certificate rotation will be able to switch to post-quantum certificates almost painlessly: it will just be a matter of changing the source. An organization that still manages its certificates in a spreadsheet will hit a wall at the worst possible moment.
The good news is that we aren't starting from scratch. In August 2024, NIST published the first post-quantum cryptography standards after an eight-year international competition:
To avoid putting all its eggs in one mathematical basket, NIST selected a backup algorithm in early 2025, HQC, based on error-correcting codes, with standardization expected by 2026-2027. This diversity of mathematical foundations is intentional: if one family fails, the other will hold.
In practice, the migration won't happen all at once. The dominant strategy is hybrid: combining a proven classical algorithm (X25519) with a post-quantum algorithm (ML-KEM-768). As long as one of the two holds, the connection remains secure, which is exactly what Chrome and Cloudflare are deploying today.
In concrete terms, compared to RSA-2048: ML-KEM-768 relies on lattices rather than factorization; it resists Shor's algorithm where RSA fails; it is used for key exchange; its keys are larger; and it is now a NIST standard (FIPS 203), while RSA is slated for replacement.
The reference timeline is that of NIST: deprecation of classical algorithms around 2030, with a target ban around 2035. European regulators are following suit. In France, theANSSI has announced that it will stop certifying security products lacking quantum-resistant mechanisms starting in 2027. Regulatory pressure is arriving ahead of the quantum computer.
No one migrates their entire cryptography stack in a single quarter. But everyone can start at the right end. Here is the trajectory we recommend, from the most urgent to the most mature:
Identify where cryptography is used: certificates, algorithms, TLS versions, libraries, VPNs, HSMs, and hardware. You cannot migrate what you cannot see. This is the most tedious step and, consequently, often the most neglected.
Classify assets by data lifespan and exposure. A public, long-term confidential stream takes priority over an ephemeral internal service. Apply Mosca’s inequality here, asset by asset.
Enable hybrid PQC on non-critical public TLS endpoints, measure the impact (handshake size, latency, compatibility), and document the results.
Extend hybrid solutions to high-risk systems, modernize PKI, automate certificates via ACME, and replace components that cannot be upgraded. This is the bulk of the work, spread over several years.
Make crypto-agility a permanent discipline: algorithm oversight, automatic rotation, monitoring of standards, and the ability to change algorithms without a massive project. Post-quantum migration has no end date; it becomes a routine.
Our recommendations at Logexia. Start with levels 1 and 2 this year. They are inexpensive, do not break anything, and provide immediate value by reducing your cryptographic debt. Automate your certificates now, even before talking about quantum: it is the best investment to absorb the transition painlessly.
The algorithms exist. The standards are published. The hyperscalers have paved the way. What is missing is not technology—it is time, visibility, and coordination. Post-quantum migration is a lot like the Y2K bug or the deployment of IPv6: a foundational project, invisible to the general public, with no spectacular effect on D-Day, but catastrophic for those who ignored it.
The difference compared to Y2K is that here the date is unknown, and data theft has already begun. The best time to launch your cryptographic inventory was last year. The second best time is now.
In summary. Quantum computing breaks asymmetric cryptography (RSA, ECC, Diffie-Hellman) via Shor's algorithm, but AES-256 remains resistant. The "Harvest Now, Decrypt Later" threat makes waiting dangerous for any long-lived data. Standards are already here (ML-KEM, ML-DSA, SLH-DSA) and are being deployed in hybrid modes. The real challenge is crypto-agility: inventory, PKI, and certificate automation. Plus, regulatory requirements are arriving even sooner than quantum computers.
Post-quantum cryptography refers to a new generation of algorithms designed to withstand attacks from quantum computers, while still running on today's classical computers. The NIST standardized the first of these in 2024: ML-KEM, ML-DSA, and SLH-DSA.
No machine is capable of this today; it would require thousands of stable logical qubits. Estimates place this milestone between 2030 and 2035, though it remains uncertain. The "Harvest Now, Decrypt Later" risk makes this date secondary, as sensitive data is already being exposed.
No, you just need to use sufficiently long keys. AES-256 is considered quantum-resistant. The migration priority is for key exchange and signatures (RSA, ECC, Diffie-Hellman), not for symmetric encryption of data at rest.
Start with a cryptographic inventory: identify all certificates, algorithms, TLS versions, and libraries currently in use. It is low-cost, risk-free, and provides immediate value. Next, map out risks based on the data's lifespan.
It is an organization's ability to switch cryptographic algorithms without rebuilding its systems. It relies on a solid inventory, a modern PKI, and certificate automation via ACME. This is the true goal of the post-quantum transition.
Yes, the CA/Browser Forum has approved a gradual reduction in the maximum lifespan of certificates, aiming for 47 days by 2029. This trend makes ACME automation essential and paves the way for the post-quantum shift.
