The post-quantum EO is an important milestone. Now it’s time to get to work (opens in new tab)

The post welcomes Executive Order 14409 as a major step toward post-quantum security, setting federal deadlines of 2030 for encryption and 2031 for authentication. It argues that the threat timeline has accelerated and that organizations must begin migration now, especially to prevent “harvest-now-decrypt-later” attacks. Cloudflare views the order as a strong foundation but believes agencies need clearer guidance and a coordinated migration roadmap.

Federal Post-Quantum Requirements

• The order primarily covers:
  • High Value Assets (HVAs), such as systems containing sensitive employee records, classified intelligence, or federal financial data.
  • High impact systems rated “high” under FIPS 199, where compromise could cause severe harm.
• Key deadlines include:
  • July 2026: Agencies name a post-quantum migration lead.
  • September 2026: Agencies inventory HVAs and high-impact systems, create migration plans, and submit them to OMB and the National Cyber Director.
  • December 2030: Key establishment must use post-quantum cryptography.
  • December 2031: Digital signatures and certificates must use post-quantum cryptography.
• National Security Systems are excluded from these deadlines and remain on a separate NSA-managed schedule.
• The order directly binds federal agencies, not state and local governments, critical infrastructure, academia, or civil society.

Encryption and Authentication Are Separate Migrations

• Post-quantum encryption protects key establishment and should begin immediately.
  • It prevents attackers from collecting encrypted data now and decrypting it after quantum computers become capable of breaking RSA and elliptic-curve cryptography.
  • This is especially important for government, financial, healthcare, defense, and telecommunications data with long-term value.
• Post-quantum authentication protects digital signatures, certificates, software signatures, and system access.
  • It prevents future quantum computers from impersonating servers or forging trusted signatures.
  • Its primary threat emerges once a cryptographically relevant quantum computer exists.
• The order’s 2031 authentication deadline suggests the U.S. government considers an operational quantum computer around that period a meaningful possibility.

Standardized Cryptography Over Quantum Key Distribution

• The order emphasizes NIST-standardized post-quantum algorithms.
• The authors support this focus because Quantum Key Distribution requires specialized hardware and dedicated physical links, making it unsuitable for Internet-scale deployment.
• Cloudflare reports that more than two-thirds of browser traffic reaching its network already uses post-quantum encryption.
• Its Cloudflare One platform supports post-quantum protection across TLS, MASQUE, and IPsec, while broader post-quantum authentication deployment is still beginning.

Why Authentication Is More Difficult

• Post-quantum ML-DSA signatures are larger than traditional signatures, potentially reducing performance in systems such as short-lived TLS connections.
• Cloudflare is working with Google Chrome on Merkle Tree Certificates to reduce this TLS overhead.
• Authentication requires coordinated upgrades across a larger ecosystem:
  • Clients and servers
  • Certificate authorities
  • Certificate transparency logs
  • Root stores
  • Web browsers
• By comparison, post-quantum key establishment is already more widely available and easier to deploy incrementally.

Organizations should begin with asset inventories, risk assessments, and post-quantum key-establishment upgrades now rather than waiting for the federal deadlines. Authentication migration should also start early because its broader dependency chain and larger signatures make it the more complex transition.