Post-quantum cryptography raises identity security stakes for data holders

At a glance

What this is: This is Yoti’s analysis of how quantum computing changes cryptography risk, with the key finding that asymmetric schemes are exposed sooner than AES-256 and that post-quantum transition planning is already underway.

Why it matters: It matters to IAM and identity teams because identity verification, biometric data, and federated authentication depend on cryptographic trust that must survive long data-retention windows and external dependencies.

By the numbers:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
• Only 5.7% of organisations have full visibility into their service accounts.
• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.

👉 Read Yoti's analysis of post-quantum cryptography readiness for identity data

Context

Quantum computing changes the cryptographic assumptions that underpin identity systems, especially where asymmetric encryption is used for transport security, key exchange, and digital signatures. The primary concern is not faster classical processing, but the possibility that today’s protected data can be collected now and decrypted later once quantum capability matures.

For identity, verification, and personal-data programmes, that means the lifetime of the data matters as much as the algorithm in use. Biometric templates, identity records, and federated trust links can remain valuable for years, so post-quantum planning is part of identity governance as well as cryptography governance.

Key questions

Q: How should security teams prepare identity systems for post-quantum cryptography?

A: They should start with a complete inventory of where cryptography underpins authentication, federation, signing, and encrypted transport. Then they should rank systems by business lifetime and migration complexity, because the most dangerous dependencies are the ones that must remain trusted for years. Crypto-agility matters when replacement can happen without re-architecting the whole identity stack.

Q: Why do identity and biometric systems need earlier post-quantum planning?

A: Because their data often remains valuable long after collection, which gives harvest-now-decrypt-later attacks a long window to pay off. Identity records, biometric templates, and signed assertions can all outlive current cryptographic assumptions. The longer the confidentiality requirement, the sooner post-quantum readiness becomes a governance requirement.

Q: What breaks when organisations treat AES-256 as enough for quantum resilience?

A: They risk overlooking the asymmetric layers that actually establish trust, such as RSA, ECC, and digital signatures. AES-256 remains strong, but many identity and transport systems still depend on public-key cryptography for key exchange and authentication. The result is partial protection that leaves the trust layer exposed.

Q: How do security teams manage quantum migration across third parties?

A: They need contract, assurance, and architecture views at the same time. If a relying party, library, or hardware provider cannot support post-quantum algorithms on the same timeline, the organisation inherits that delay. Clear dependency mapping and staged transition testing are essential before the weakest external link becomes the blocker.

Technical breakdown

Why asymmetric cryptography is the first quantum target

Asymmetric cryptography relies on mathematical problems such as factoring and discrete logarithms, which are difficult for classical computers but far easier for sufficiently powerful quantum machines using algorithms like Shor’s. That affects RSA and elliptic-curve cryptography, which are widely used for TLS handshakes, signatures, and trust establishment. Symmetric cryptography behaves differently because quantum speed-ups reduce, rather than eliminate, effective key strength. That is why RSA and ECC are the urgent migration focus, not AES-256. The architectural challenge is less about replacing every cipher at once and more about identifying where asymmetric trust anchors sit in identity and access flows.

Practical implication: inventory every identity, TLS, and signing dependency that relies on RSA or ECC before setting migration priorities.

What harvest-now-decrypt-later means for identity data

Harvest-now-decrypt-later is the strategy of capturing encrypted traffic today and storing it until future quantum capability can break the protection. That risk is especially relevant for identity systems because personal data, biometric records, and authentication exchanges often have long confidentiality horizons. Even if current encryption remains intact now, the security value of the data can outlast the current cryptographic era. This makes retention policy part of cryptographic risk management. If data must stay confidential for a decade or more, the organisation must treat PQC readiness as a current requirement, not a future optimisation.

Practical implication: classify identity and biometric data by confidentiality lifetime, then align stronger transition urgency to the longest-retained records.

Why cryptographic agility matters more than one-time migration

Cryptographic agility is the ability to swap algorithms, key sizes, libraries, and trust mechanisms without redesigning the whole service. That matters because post-quantum adoption will not happen in one clean cutover. Organisations must coordinate with software vendors, hardware security module providers, TLS endpoints, and signing infrastructure, or they will create dependency gaps where one weak link breaks the whole chain. In practice, the hardest part is often operational, not mathematical: mapping where cryptography is embedded, where certificates are issued, and where signatures are verified across systems and third parties.

Practical implication: build a cryptographic inventory that includes vendors, libraries, HSMs, and external relying parties, then test controlled algorithm switching.

Threat narrative

Attacker objective: The attacker wants to preserve encrypted identity data now and unlock it later when quantum capability or weak migration paths make it exploitable.

1. Entry occurs when attackers capture encrypted traffic, stored identity records, or signed artefacts that rely on RSA or elliptic-curve cryptography.
2. Escalation follows when those archives remain readable or trusted across long retention windows, letting the attacker wait for quantum capability or exploit weak transition coverage.
3. Impact is delayed compromise of identity, biometric, or authentication data, including retrospective decryption of traffic and potential forgery of signatures.

NHI Mgmt Group analysis

Quantum risk is now an identity governance issue, not just a cryptography problem. The article is right to tie post-quantum planning to personal data, biometric data, and federated trust. Those are identity assets with long confidentiality lifetimes, which means today’s cipher choices affect tomorrow’s privacy exposure. Practitioners should treat cryptographic transition as part of identity governance rather than a narrow security engineering task.

Harvest-now-decrypt-later creates a retention problem before it becomes a decryption problem. The real governance failure is assuming encrypted data is safe simply because it is unreadable today. If identity records, session traffic, or biometric templates are valuable for years, the risk window extends beyond current controls. Practitioners should align data retention, cryptographic strength, and transition timelines.

Cryptographic agility is the named concept that will separate managed transition from brittle exposure. This means the organisation can update algorithms, certificates, and libraries without a full replatforming exercise. In identity programmes, that capability matters because TLS, signing, and verification chains cross internal and third-party boundaries. Practitioners should prioritise agility wherever trust depends on externally managed components.

Public-key migration will expose hidden dependency chains in identity platforms. The article highlights a coordinated transition across customers, regulators, hardware providers, and libraries, which is the right framing. Identity teams rarely own every cryptographic dependency end to end, so the challenge is mapping where trust is asserted and where signatures are verified. Practitioners should build migration plans around dependencies, not just algorithms.

What this signals

Cryptographic agility will become a programme-level capability, not an architecture footnote. Identity teams need to know which systems can swap algorithms, which cannot, and which depend on external service providers for trust functions. That means building dependency maps, transition test plans, and retirement criteria for legacy RSA and ECC usage.

Post-quantum readiness intersects with workload identity and signing governance. Where TLS, certificates, and digital signatures support human or machine trust, the control problem is the same: verify who or what is trusted, for how long, and through which dependencies. The relevant external reference is NIST SP 800-63 Digital Identity Guidelines for assurance and ISO/IEC 27001:2022 Information Security Management for governance discipline.

The practical signal is whether your retention model matches your cryptographic model. If a record is kept for a decade but protected only by today’s public-key assumptions, the organisation has already accepted future exposure. That is a governance mismatch, not just a technical debt item.

For practitioners

• Map all public-key dependencies Inventory every RSA and elliptic-curve use case across TLS endpoints, signing services, identity verification flows, and third-party integrations. Classify each dependency by data sensitivity and retention horizon so migration order reflects business exposure, not just technical complexity.
• Prioritise long-lived identity data Identify biometric templates, identity records, and other data expected to remain sensitive for 10 years or more. Give those assets the earliest post-quantum transition path because they are the most likely harvest-now-decrypt-later targets.

Key takeaways

• Quantum risk matters because identity systems depend on cryptographic trust that must survive long data-retention windows.
• The biggest near-term exposure is harvest-now-decrypt-later, which turns today’s encrypted traffic into tomorrow’s liability.
• Organisations need cryptographic agility, dependency mapping, and migration timing tied to data lifetime rather than system convenience.

Key terms

• Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
• Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
• Cryptographic agility: The ability to change cryptographic algorithms, key lengths, or trust models without reworking every application. For machine identities, it reduces the risk that long-lived services will fail when standards shift or when post-quantum migration becomes necessary.

What's in the full article

Yoti's full analysis covers the operational detail this post intentionally leaves for the source:

• The TLS and signing migration details behind the hybrid post-quantum approach, including where asymmetric dependencies remain.
• The cryptographic inventory milestones and target dates that shape the transition roadmap.
• The internal architecture choices around on-device keys, centralised signing, and larger classical key sizes.
• The standards references that inform the transition timeline, including NIST and NCSC alignment.

👉 The full Yoti article covers the transition roadmap, cryptographic choices, and identity data implications in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to broader security programmes and long-term operational change.