The UK releases timeline for migration to post-quantum cryptography

(Image credit: Shutterstock / Sean Aidan Calderbank)

The UK Government has released new guidelines for post-quantum migration
The timeline outlines a target of full migration by 2031
SMEs should find this more simple due to updated guidance

The UK Government has released its guidelines on protecting technical systems from future quantum computers.

The National Cyber Security Centre set a timeline for the UK industry and government agencies to follow with key dates, firstly, by 2028 all organizations should have a defined set of migration goals, and an initial plan, and should have carried out a ‘full discovery exercise’ to assess infrastructure and determine what must be updated to post-quantum computing.

By 2031, organizations should carry out the highest priority migration activities, and have a refined plan for a thorough roadmap to completing the change. Finally, by 2035, migration should be completed for all systems, services, and products.

Large-scale threats

The UK Government labelled the move a ‘mass technology change that will take a number of years’ - but why is the migration needed?

The Government outlines that the threat to cryptography from future ‘large-scale, fault-tolerant quantum computers’ is now well understood, and that technical systems will need to evolve to reflect this.

“Quantum computers will be able to efficiently solve the hard mathematical problems that asymmetric public key cryptography (PKC) relies on to protect our networks today,“ the guidelines confirm.

“The primary mitigation to the risk this poses is to migrate to post-quantum cryptography (PQC); cryptography based on mathematical problems that quantum computers cannot solve efficiently.”

The report warns that the total financial cost of PQC migration could be ‘significant’, so organizations should budget accordingly, including for “preparatory activities” as well as the migration itself.

For SMEs, the PQC should be more straightforward and seamless, as services will typically be updated by vendors, but in the case of specialised software, PQC-compatable replacements or upgrades should be identified and deployed in line with the above timetable.

Take a look at our picks for the best small business software
Check out our choice for best antivirus software
"I have nothing to hide" - our readers react to Apple getting secret hearing in appeal against UK government

Ellen has been writing for almost four years, with a focus on post-COVID policy whilst studying for BA Politics and International Relations at the University of Cardiff, followed by an MA in Political Communication. Before joining TechRadar Pro as a Junior Writer, she worked for Future Publishing’s MVC content team, working with merchants and retailers to upload content.