This is the only direction in the domain where the deadline is published, the standards exist, and the machine that creates the threat does not.
Why this is not a future problem
The reasoning is simple and it is the reason serious institutions are already moving.
An adversary can capture encrypted traffic today and store it. Storage is cheap and the capture requires no cooperation from either endpoint. If a cryptographically relevant quantum computer becomes available at some later point, that stored traffic can be decrypted then.
This is usually called harvest now, decrypt later, and it inverts the usual logic of security timelines. The question is not when the machine arrives. The question is how long your data needs to stay confidential.
Medical records, government and diplomatic communications, intellectual property, financial and legal records, personal identity data and the long lived keys embedded in infrastructure all have confidentiality requirements measured in decades. For those, the exposure is present tense.
If your data must remain secret for twenty years, it is already at risk, whatever the timeline turns out to be.
There is a second and more mundane reason for urgency, which is that migrations of this size take many years in organisations of any complexity. The transition away from previous cryptographic algorithms took well over a decade and is arguably still incomplete in places.
What the direction covers
The scope: quantum cryptography, post-quantum cryptography, quantum key distribution, quantum sensing and quantum metrology.
Four areas.
The threat model. Which cryptography is affected and which is not, and by how much.
Post-quantum cryptography. The standardised algorithms, their properties, and the practical consequences of adopting them.
Migration. Inventory, prioritisation, agility and the operational reality of changing cryptography in a live estate.
Quantum communication and sensing. Key distribution, and the sensing and metrology applications that are already commercial.
The dates that already exist
Two things are worth separating clearly, because they are often conflated.
Public key cryptography is the problem. RSA, elliptic curve signatures and key exchange, and Diffie-Hellman all rest on mathematical problems that a sufficiently capable quantum computer would solve efficiently. These are the algorithms that secure web traffic, code signing, certificates, virtual private networks and device identity.
Symmetric cryptography is largely fine. Block ciphers and hash functions face a more modest reduction in effective security, and the practical response is to use larger key and output sizes. This is a parameter change rather than a replacement.
On the replacement side, the United States National Institute of Standards and Technology completed a multi-year international competition and published standards for post-quantum key encapsulation and digital signatures in 2024, with further algorithms following. These are published, implementable standards rather than research proposals.
NIST has also published a transition roadmap giving dates. Public key algorithms at the 112-bit security level, which includes RSA-2048 and the commonly used elliptic curves, are to be deprecated around 2030, meaning unsuitable for new deployment, and disallowed around 2035. The window between the two dates is the intended migration runway, and it is not generous for large estates.
National authorities elsewhere have published their own guidance with broadly similar shape. The precise dates and instruments will keep moving; the direction has been consistent for several years.
Where this sits in the domain
Quantum communication, sensing and security is the ninth of nine directions in Astra Trainer's semiconductors, electronics and quantum domain, and it is the one with the most immediate practical application. It pairs with quantum computing, which is the source of the threat, and with embedded systems and computer hardware, where long lived devices carry cryptography that must be replaceable.
It also connects outward to AI and computing for infrastructure security, and to medicine and healthtech, where record confidentiality obligations run for decades. You can see the nine directions here.
The inventory problem, which is the real work
The technical migration is the smaller half. The larger half is finding out what you have.
Most organisations of any age cannot answer a simple question: where is cryptography used across our systems, which algorithms, which key sizes, which libraries, and what depends on each.
The reasons are structural rather than negligent. Cryptography is embedded in operating systems, in libraries several dependencies deep, in hardware security modules, in firmware, in certificates whose issuance nobody tracks centrally, in vendor products that do not document their internals, and in protocols whose negotiation is invisible. It appears in devices installed a decade ago and in code nobody has touched since.
Four steps that make up the actual project.
Discovery. Finding every use, including in purchased products and long lived embedded devices. This takes far longer than teams expect and is where most programmes stall.
Prioritisation by data lifetime. Not everything needs migrating at the same pace. Systems handling data with long confidentiality requirements, and systems that cannot be updated easily, come first. A device in the field for fifteen years with fixed cryptography is a worse problem than a web server.
Agility. Designing so the algorithm can be changed without redesigning the system. This is the durable capability, because the standards published today will not be the final word, and at least one candidate algorithm in the wider competition was broken during the process.
Execution. Replacement, testing and the operational consequences. Post-quantum algorithms generally have larger keys and signatures than what they replace, which affects protocol behaviour, packet sizes, storage in constrained devices and performance in high volume systems. Hybrid approaches, running a classical and a post-quantum algorithm together, are widely used during transition so that a weakness in either does not break the whole.
Where quantum key distribution fits, honestly
Quantum key distribution uses quantum properties of photons to distribute keys in a way where interception disturbs the transmission and is therefore detectable. The physics is real and the demonstrations are real.
Its practical position is narrower than the marketing suggests, and this is worth stating plainly.
It requires specialised hardware and dedicated optical links, with distance limits set by loss. It solves key distribution and not authentication, which still requires conventional cryptography. It does not protect data at rest or the systems at either end. It is expensive, and it does not fit the general internet, where most encrypted traffic lives.
Several national security authorities have published assessments favouring post-quantum cryptography over quantum key distribution for general use, on the grounds that it protects a wider set of use cases with far less infrastructure. That does not make quantum key distribution useless. It has a defensible place in specific high value fixed links, particularly where the parties already control the fibre.
The honest summary: post-quantum cryptography is the general answer, quantum key distribution is a niche complement, and an organisation that adopts the second while neglecting the first has spent money on the wrong problem.
Quantum sensing, the part that is already shipping
Set aside computing and cryptography and there is a body of quantum technology in commercial use now.
Atomic clocks. Underpinning satellite navigation, telecommunications synchronisation and financial timestamping, with work towards smaller units that let systems hold accurate time when satellite signals are unavailable.
Gravimeters and inertial sensors. Atom interferometry for gravity measurement in survey, civil engineering and resource work, and for navigation without satellite reference.
Magnetometers. Extremely sensitive magnetic field measurement used in medical imaging research, materials inspection and navigation.
These are engineering products with real customers, and the skills they need, precision optics, atomic physics, laser systems, vacuum and control electronics, overlap heavily with the quantum computing workforce. For an organisation wanting exposure to quantum technology with a defined near term application, sensing is usually the more grounded route.
The roles, named
Cryptographic engineers. Implementation, protocol work, review.
Post-quantum migration leads. A new and rapidly growing role, closer to programme management with deep technical grounding than to research.
Cryptographic inventory and discovery specialists.
Security architects, designing for agility.
Embedded security engineers, for devices with long service lives.
Public key infrastructure and certificate management specialists.
Quantum communication engineers, for key distribution systems.
Quantum sensing engineers, for clocks, gravimeters and magnetometers.
Compliance specialists, tracking obligations across jurisdictions.
Who can be trained into it
Security engineers and architects. The main population, and the conversion is mostly about understanding what changes, what does not, and how to design for replacement rather than about learning lattice mathematics.
Infrastructure and platform engineers. Into discovery and migration, because they know where systems actually are, which is the scarce knowledge in this work.
Software engineers. Into cryptographic implementation and agility work.
Public key infrastructure administrators. Directly adjacent, already holding certificate lifecycle knowledge.
Embedded engineers. Into device side migration, which is the hardest part of the problem and the least staffed.
Risk and compliance staff. Into programme and obligation management, where the inventory discipline resembles work they already do.
Physics and optics people. Into quantum communication and sensing hardware.
Cryptographic implementation and regulation. Implementing cryptography correctly is difficult, and errors in implementation, key management or random number generation defeat the algorithm regardless of its strength. Production systems should use reviewed, validated implementations, and in many sectors validation and approval are legally or contractually required. Requirements and migration deadlines differ by jurisdiction and change. Training builds understanding and migration capability. It does not constitute cryptographic assurance, certification, or legal advice on any obligation.
What to take from this
The exposure is present tense for any data that must stay confidential for a long time, because captured traffic can be stored and decrypted later.
Public key cryptography is the part that breaks. Symmetric cryptography needs larger parameters, not replacement.
The dates exist. Deprecation around 2030, disallowance around 2035, with the gap intended as the migration window.
Most of the work is discovery, and most organisations cannot yet say where their cryptography lives.
Cryptographic agility is what actually survives, because today's standards will be revised and one candidate was broken during the competition that produced them.
Why act before a quantum computer exists?
Because encrypted traffic can be captured and stored now and decrypted later. Data with a confidentiality requirement measured in decades is already exposed, and migrations of this size take years.
Which cryptography actually breaks?
Public key algorithms, including RSA, elliptic curve signatures and key exchange, and Diffie-Hellman. Symmetric ciphers and hash functions face a more modest reduction handled by using larger key and output sizes.
What are the published deadlines?
NIST's transition roadmap sets deprecation of public key algorithms at the 112-bit security level around 2030 and disallowance around 2035. Other national authorities have published guidance of similar shape.
Is quantum key distribution the answer?
For general use, no. It needs dedicated optical links, has distance limits, solves key distribution but not authentication, and several national authorities favour post-quantum cryptography instead. It has a defensible niche in specific high value fixed links.
What is cryptographic agility?
Designing systems so the algorithm can be replaced without redesigning the system. It is the durable capability, because the current standards will be revised and at least one candidate algorithm was broken during the standardisation process.