CISA and G7 Urge Global Transition to Post-Quantum Cryptography
CISA and the G7 Cyber Security Working Group have issued a joint call to action, urging governments and organizations worldwide to accelerate the transition to post-quantum cryptography (PQC) to defend against future quantum computing threats.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Group of Seven (G7) Cyber Security Working Group, has released a critical alert emphasizing the urgent need to prepare for the post-quantum era. The document, titled "Preparing for the Post-Quantum Era: A Call to Action," highlights the significant future threat posed by the development of quantum computers, which could render current cryptographic standards obsolete and compromise sensitive data, authentication systems, and critical infrastructure.
The alert underscores that the transition to quantum-resistant cryptography is not a distant concern but a present necessity. Organizations and governments must begin the complex process of migrating to Post-Quantum Cryptography (PQC) to ensure the long-term security and integrity of digital assets. The potential for future adversaries to retroactively decrypt vast amounts of currently protected data necessitates proactive planning and implementation.
To guide this crucial transition, the G7 Cyber Security Working Group has outlined five key priorities. Firstly, there is a pressing need to raise awareness among stakeholders about the risks associated with quantum computing and the importance of adopting PQC. This includes educating leadership, technical teams, and the public about the impending cryptographic shift.
Secondly, the call to action stresses the development of comprehensive national strategies that will support and facilitate the adoption and integration of PQC across various sectors. These strategies should provide clear roadmaps, regulatory frameworks, and incentives for organizations to undertake the migration.
Thirdly, continued advancement in research and development for quantum-safe technologies is paramount. While standards are emerging, ongoing innovation is required to ensure robust, efficient, and secure PQC solutions are available and continuously improved.
Fourthly, fostering strong public-private partnerships is identified as essential. Collaboration between government agencies, industry leaders, researchers, and technology providers will enable the sharing of expertise, resources, and best practices, accelerating the development and deployment of PQC.
Finally, the alert calls for the integration of PQC into cybersecurity requirements and procurement processes. By embedding quantum-resistance into the specifications for new systems, software, and services, organizations can ensure that future investments are secure against emerging quantum threats. This proactive approach aims to build a more resilient digital ecosystem capable of withstanding the challenges of the post-quantum future.
The G7 Cybersecurity Working Group has issued its own guidance, emphasizing that migrating to post-quantum cryptography (PQC) should be treated as a standard evolution of existing cryptographic practices. They advise that early adoption is more cost-effective than delaying, aiming to mitigate future risks from quantum-enabled decryption and authentication attacks.
This G7 working group report, prepared in June at the G7 Summit in France, specifically urges governments and industry to accelerate the transition to post-quantum cryptography (PQC) by reframing the quantum threat as a near-term economic and business risk. It highlights that data harvested today could be decrypted in the future by quantum computers, and calls for coordinated planning across public and private sectors to achieve a collective transition.
Cloudflare's Automatic Key Exchange directly addresses the call to action from CISA and the G7 by automatically enabling post-quantum cryptography for origin connections. This initiative proactively transitions hundreds of thousands of domains to quantum-secure encryption without requiring manual configuration from website operators, significantly accelerating the adoption of PQC and mitigating the 'harvest-now, decrypt-later' threat.