Industry consensus on a shifting deadline
Google and Cloudflare now target 2029 for full post-quantum security. This decision follows research from Oratomic and Google suggesting that quantum algorithms can break elliptic curve cryptography sooner than expected. Oratomic estimates that 10,000 qubits can break P-256 on a neutral atom computer. Google also provided a zero-knowledge proof of their improved algorithm for breaking elliptic curve cryptography without revealing the specific algorithm details. IBM Quantum Safe CTO Michael Osborne says quantum moonshot attacks on high-value targets could happen as early as 2029. I conclude the industry is accelerating to meet a shifting deadline.
The progress in quantum computing advances on three independent fronts: hardware, error correction, and quantum software. Hardware approaches include neutral atoms, superconducting qubits, ion-trap, photonics, and topological qubits. Superconducting architectures require approximately 1,000 physical qubits for one logical qubit. The Oratomic research shows that reconfigurable neutral-atom machines require only 3 to 4 physical qubits per logical qubit. Google’s software improvements also massively speed up the algorithm to crack P-256. Progress on one front compounds progress on the others.
The urgent shift to authentication
The industry focus has moved from encryption to authentication. Most Cloudflare products mitigate harvest-now, decrypt-later attacks, which involve storing encrypted traffic today for future decryption. Authentication attacks involve adversaries using quantum computers to forge credentials or impersonate servers. An active quantum attacker only needs one trusted quantum-vulnerable key to enter a system. This capability allows attackers to bypass defenses, engage in unauthorized access, or execute remote code.
Migrating to post-quantum authentication involves a long dependency chain. This process requires coordinated upgrades across certificate authorities, root stores, and browsers. It also requires third-party validation and fraud monitoring. Unlike post-quantum encryption, which allows for a single massive push, authentication requires years of work. Organizations must rotate all secrets, including passwords and access tokens, previously exposed in quantum-vulnerable systems.
Performance metrics for NIST algorithms
NIST standardized CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures. Kyber provides efficient execution, but Dilithium’s signing step dominates runtime, accounting for over 60% of the total time. The increase in security levels affects execution time nonlinearly. For example, the increase from Kyber-768 to Kyber-1024 is smaller than the increase from Kyber-512 to Kyber-768. Hardware acceleration through AVX2 increases speed significantly.
| Algorithm | Security Level | Operation | Execution Time (ms) |
|---|---|---|---|
| CRYSTALS-Kyber | 512 | Key Generation | 0.127 |
| CRYSTALS-Kyber | 1024 | Decapsulation | 0.294 |
| CRYSTALS-Dilithium | 2 | Signing | 0.643 |
| CRYSTALS-Dilithium | 5 | Signing | 1.36 |
AVX2 optimizations yield a 5.98x speedup for Kyber and a 4.8x speedup for Dilithium.
Network and infrastructure strain
Larger cryptographic messages strain network infrastructure. PQC public keys and signatures are much larger than RSA or ECC. Kyber-768 key shares are approximately 1.2 KB, which can cause the ClientHello message to fragment. This fragmentation causes failures in middleboxes or load balancers that do not handle reassembly. The TCP-to-TLS delay increases sixfold with PQC, rising from 0.294 ms to as high as 1.90 ms. Client-side CPU usage increases from 3.7% to between 8.2% and 8.7%.
Network traffic grows from 5.2 to 6.6 Mb/s. QUIC traffic also faces issues because large handshakes might not fit in a single UDP datagram. Load balancers might see two initial packets from a client and drop the second one. Adding 9 KB of data to a TLS handshake causes a 15% slowdown in handshake time. If the handshake grows by 10 KB or 30 KB, connection failures occur at specific thresholds. I observe that these increases can erase the efficiency gains of TLS 1.3.
The adoption gap in the enterprise
Browser readiness and enterprise deployment show a massive gap. Over two-thirds of human-generated TLS traffic to Cloudflare uses hybrid ML-KEM. However, DigiCert’s 2026 survey found that only 7% of organizations have deployed quantum-safe cryptography across most of their digital certificates. Banking websites show even lower adoption at 3%.
The adoption of PQC is uneven across the web. Among the top one million websites, only 8.6% support hybrid PQC key exchange mechanisms. Additionally, 25% of websites do not support TLS 1.3 at all. Safari’s lack of support reduces global readiness to 57%. Most organizations are still in the discovery or pilot phases. You should verify your connection at pq.cloudflareresearch.com.
Federal mandates and regulatory drivers
Executive Order 14412 sets specific deadlines for federal agencies. Agencies must transition to post-quantum encryption by December 31, 2030, and authentication by December 31, 2031. Federal contractors must comply with NIST FIPS standards by the end of 2030. The order also requires agencies to identify a migration lead and review inventories of high value assets.
High Value Assets include databases with millions of federal employee records and systems processing classified intelligence. High impact systems include platforms managing federal financial transactions. The order also targets systems where a breach causes loss of life or major financial damage. These requirements apply to federal agencies, but the order does not bind critical infrastructure or state and local governments. This distinction leaves much of the nation’s infrastructure to rely on voluntary industry movement.
Managing the migration process
Organizations must prepare for downgrade attacks. Adding PQC support is insufficient if systems still allow connection to quantum-vulnerable algorithms. An attacker can force a connection to downgrade to classical cryptography to bypass new protections. Cloudflare suggests using PQ HSTS and certificate transparency to prevent this.
The transition to post-quantum authentication requires a long sequence of dependencies. This includes CA/Browser Forum approval and audit cycles. A successful migration requires a complete cryptographic inventory, often called a CBOM. Organizations must also prioritize long-lived keys like root certificates and code-signing certs. Will the transition to post-quantum authentication happen fast enough to beat the 2029 window? Organizations must also rotate all secrets previously exposed in quantum-vulnerable systems.
