Quantum Computers Are Coming. Washington Is Finally Paying Attention.

Encryption protects your data from prying eyes. The complex math problems that underpin encryption, however, may soon no longer keep your data safe.

Quantum computers test multiple answers simultaneously, meaning that they solve math problems much faster than today’s computers. A large enough quantum computer will render today’s encryption obsolete. Fortunately, Washington is finally taking notice.

The Office of Management and Budget released a memorandum on June 24 that ordered all federal agencies to expedite their transition to stronger encryption in case America’s adversaries develop advanced quantum computers first. The memo follows a June 22 White House executive order, EO 14412, warning that quantum computers will exacerbate the damage America’s adversaries are already doing by exploiting cybersecurity gaps to steal U.S. secrets.

The Executive Order Sets Deadlines for the Post-Quantum Transition

For at least the last 20 years, computer scientists have been trying to get ahead of this challenge by developing more complicated algorithms as part of post-quantum cryptography (PQC). But this will not matter if federal agencies and private companies do not make the switch. The executive order requires federal agencies to move faster and meet specific deadlines to integrate PQC into their systems.

The order specifies a few tools that will be essential for an efficient transition. Federal agencies need to be aware of what encryption they currently have and where it is used, so that they know what needs to be updated.

That is where a cryptographic bill of materials (CBOM) — a structured inventory, generated through automated discovery tooling, that gives organizations a baseline picture of where their cryptography lives and lets them prioritize migration activities accordingly — enters the frame. The executive order tasks the Cybersecurity and Infrastructure Security Agency and National Institute of Standards and Technology (NIST) to develop a standard of what a useful CBOM must include.

Accelerated PQC Migration Is Essential Because of Harvest Now, Decrypt Later and Rapid Quantum Advancements

A rapid migration is vital for two major reasons. First, federal security agencies have warned that adversaries may be collecting and storing encrypted information now with the intent to decrypt it later once advanced quantum computers have sufficiently developed. Even if the data is years old when adversaries decrypt it, it may still contain secrets the U.S. government does not want adversaries to know.

Additionally, advanced quantum computers will become a reality faster than previous timelines accounted for. In March, Google moved its internal deadline for PQC migration forward to the end of 2029, a clear signal from a tech giant that it believes that by the end of this decade, technology will have developed to the extent that a quantum computer will be capable of breaking the cryptography used for the past couple of decades.

NIST Should Develop Clear Standards That Enable Widespread CBOM Adoption

The executive order says that NIST must create a new standard for CBOMs. Whether they are a separate document or an addition to the existing software bill of materials (SBOM) standard — machine-readable documents that inventory all aspects of the software used by an organization, including supply chain details and components needed for proper functionality — CBOMs are foundational infrastructure for executing the nation’s post-quantum transition.  

The president’s quantum security executive order sets the destination. CBOMs can provide the roadmap, without which agencies may struggle to meet the new deadlines.

Dr. Georgianna Shea is chief technologist at the Center on Cyber and Technology Innovation (CCTI) and the Transformative Cyber Innovation Lab at the Foundation for Defense of Democracies (FDD), where Stephen Thursby is an intern. For more analysis from the authors and FDD, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.