The G7 Cybersecurity Working Group has issued a joint advisory telling organizations to start moving to post-quantum cryptography (PQC) now, rather than waiting for quantum computers that can break today’s public-key encryption to arrive.
The report, prepared in June at the G7 Summit in France, says organizations “can no longer afford to postpone” moving critical systems and data to quantum-resistant encryption, CyberScoop reported. It was signed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the UK’s National Cyber Security Centre, France’s ANSSI, Germany’s BSI, Canada’s Communications Security Establishment, Japan’s National Cybersecurity Office and Italy’s National Cybersecurity Agency.
A business risk, not just a crypto problem
The working group says many companies still aren’t treating the issue seriously. “The quantum threat remains off the radar for many organizations and not properly resourced, with other security concerns taking precedence,” the report says. “Yet, a successful and collective transition to PQC can only be achieved if organizations understand that the quantum threat is an economic and business risk, and not merely a cryptographic risk.”
The timeline for a cryptographically relevant quantum computer is uncertain, the report acknowledges. But attackers can already collect encrypted data now and decrypt it later. The group also warns that quantum computers could undermine authentication, for example by forging trusted data.
There’s a commercial angle as well. “In addition to quantum-related risks, organizations that delay their PQC transition may lose competitive advantage or may be excluded from contracting opportunities, including public procurement,” the advisory says, according to TechRadar.
What the G7 recommends
The guidance follows what national agencies have recommended for years. Organizations should inventory their cryptographic assets, map dependencies, prioritize critical systems and follow a phased, risk-based transition plan, finishing within whatever deadlines their national cybersecurity authorities set.
The group also suggests folding the switch into normal upgrade cycles. “To limit transition-related costs, they should opt to purchase products that integrate PQC and replace their systems with quantum-safe ones as part of their standard renewal schedule,” the report says. “As such, starting the transition early could result in lower migration costs overall.”
Where companies stand
IT Pro pointed to a Juniper Research study from earlier this year that found only 27% of global businesses are set to be using PQC by 2030. That’s despite Google’s recent prediction that computers able to break current encryption could arrive within three years.
Some organizations are moving faster. A recent U.S. executive order moved federal agencies’ PQC migration deadline from 2035 to 2030, and Google and other companies have set their own migration targets for 2029, CyberScoop reported. Progress has been strongest in government and the heavily regulated financial sector.
The new algorithms aren’t a finished answer either. CyberScoop noted that some algorithms selected by the National Institute of Standards and Technology have already been broken with traditional computers or AI, which is why NIST backs several options and encourages “crypto-agility,” the ability to switch between algorithms quickly.
WebProNews is an iEntry Publication