Quantum computing and cryptography risk are colliding now

At a glance

What this is: This is an analysis of the advantages and disadvantages of quantum computing, with the central security finding that quantum progress collides with today’s public-key cryptography assumptions.

Why it matters: It matters because IAM, PKI and security teams must treat cryptographic agility, certificate lifecycle, and long-term data exposure as active governance problems rather than distant planning exercises.

Context

Quantum computing is a new compute model that uses qubits, superposition and interference to tackle certain problems differently from classical systems. In identity and security terms, the immediate issue is not just performance, but whether current cryptographic assumptions remain safe over the lifespan of protected data and authentication systems.

The article frames the risk as a present-day governance problem because encrypted data can be captured now and decrypted later when fault-tolerant quantum capability arrives. That makes certificate inventories, algorithm agility and cryptographic transition planning relevant to both human identity systems and machine trust infrastructure.

At the same time, the article notes that quantum systems remain fragile, costly and limited in real-world use today. That creates a gap between long-term threat and current operational readiness, which is exactly where identity and PKI programmes tend to fall behind.

Key questions

Q: How should organisations start quantum readiness planning for PKI and identity systems?

A: Start with certificate and cryptographic dependency discovery across identity, applications, cloud, and infrastructure. A credible plan depends on knowing where trust is embedded, who owns it, and which systems will break if algorithms change. Without that inventory, migration sequencing is guesswork and the real operational risk remains hidden.

Q: Why does quantum computing create risk before fault-tolerant machines exist?

A: Because attackers can capture encrypted material now and hold it until future quantum capability makes decryption feasible. The danger is not only live compromise, but delayed compromise of data whose confidentiality must survive for years. That is why long retention and hard-coded algorithms are such a poor combination.

Q: What breaks when cryptographic systems are not agile?

A: Systems that hardcode algorithms or bind trust to one certificate format become expensive and slow to replace. When post-quantum standards change, those environments cannot adapt cleanly, and migration turns into a multi-year operational project. In identity terms, brittle crypto creates trust debt that eventually has to be repaid.

Q: How should teams prioritise data for post-quantum cryptography migration?

A: Prioritise data by confidentiality lifetime, replaceability, and exposure spread. The most urgent datasets are those that remain harmful if disclosed for years, cannot be reissued easily, and already exist in multiple copies across backups, analytics, email, and cloud services. That gives you a practical queue for migration and compensating controls.

Technical breakdown

Why quantum threatens public-key cryptography

Quantum computers do not speed up every workload, but they change the maths behind factoring and discrete logarithms, which are the basis of RSA, Diffie-Hellman and elliptic curve cryptography. Shor’s algorithm is the key issue here: on a sufficiently capable quantum computer, the mathematical hard problems that protect certificates and secure channels become tractable. That is why the risk lands first in trust infrastructure, not in every application equally. The practical security problem is long-lived exposure, because encrypted traffic and stored data can be collected today and attacked later when capability matures.

Practical implication: inventory where RSA, Diffie-Hellman and elliptic curve cryptography underpin trust, and rank those systems by data lifetime.

What harvest now, decrypt later means for identity infrastructure

Harvest now, decrypt later is the strategy of stealing encrypted data today and waiting for future decryption capability. For identity teams, that matters wherever authentication artifacts, certificates, tokens or sensitive records must remain confidential for years. The control failure is not merely weak encryption in the abstract, but mismatch between cryptographic lifetime and data sensitivity lifetime. When the protected asset outlives the algorithm, the security boundary is only temporary. That makes PKI governance, key rotation discipline and algorithm migration planning part of identity risk management, not just cryptography housekeeping.

Practical implication: classify identity and PKI assets by confidentiality horizon, then prioritise migration paths for the longest-lived records.

Why quantum readiness is really about crypto-agility

Crypto-agility is the ability to switch algorithms, key sizes and trust dependencies without rebuilding every dependent system. That matters because the article shows quantum risk is both technical and operational: even if quantum capability arrives later than some forecasts suggest, organisations still need the ability to move quickly once transition becomes mandatory. A rigid certificate estate, hard-coded algorithm support, or poor inventory coverage turns a cryptographic shift into a prolonged outage risk. The article’s deeper point is that the security challenge is not predicting the exact quantum date, but avoiding lock-in to today’s algorithm choices.

Practical implication: design certificate and application dependencies so algorithm changes can be executed without a full platform redesign.

NHI Mgmt Group analysis

Crypto-agility is now an identity governance requirement, not a niche cryptography topic. The article shows that the most relevant quantum risk is not abstract compute superiority but the survival of long-lived trust dependencies across certificates, encrypted records and authentication flows. That moves the problem squarely into identity architecture, where lifecycle, inventory and migration planning determine how exposed future data will be.

Harvest now, decrypt later creates a governance mismatch between data lifetime and algorithm lifetime. Public-key systems were designed for an era in which algorithm strength changed slowly and predictably. That assumption breaks when adversaries can store protected data today and wait for future decryption capability, so practitioners must treat retention, sensitivity horizon and cryptographic choice as one governance decision.

Certificate and key inventories become the control plane for quantum exposure. You cannot protect what you cannot map, especially when cryptographic dependencies are embedded across applications, devices and service-to-service trust chains. The practical consequence is that visibility into where algorithms are used matters as much as the algorithms themselves.

Quantum readiness exposes the difference between theoretical security and operational resilience. The article is clear that quantum systems remain fragile and limited today, yet the preparation burden already exists. That means programme maturity will be measured by whether teams can transition trust without disruption, not by whether they can predict the exact date of cryptographic collapse.

Post-quantum migration is a lifecycle problem across human, machine and workload identity. The same organisation that manages certificates for humans, services and applications will need to govern which trust paths remain exposed to quantum-era risk. The implication is simple: plan migration by identity dependency, not by technology silo.

What this signals

Crypto-agility is the new baseline: organisations need to know where algorithm choices are embedded, who owns them, and how quickly they can be changed. The practical test is whether certificate and trust dependencies can be updated without platform rewrites or business interruption.

Quantum risk should be treated as a lifecycle issue across identity, not as a standalone cryptography project. Once protected data outlives the algorithm that secures it, the governance problem shifts from strength to transition readiness.

Teams that delay inventory work will struggle most when post-quantum migration becomes unavoidable. The organisations that already understand their trust paths will have the shortest path to controlled change.

For practitioners

• Map cryptographic dependencies across identity systems Build an inventory of where RSA, Diffie-Hellman and elliptic curve cryptography are used in certificates, TLS, service authentication and long-term data protection.
• Prioritise long-lived data first Rank systems by how long the protected data must remain confidential, then move the longest-lived records and trust paths to the front of the migration queue.
• Test algorithm swap readiness Validate whether applications, middleware and certificate services can change algorithms without code rewrites, outage windows or manual exception handling.
• Create a post-quantum transition plan Define owner, scope and sequencing for moving from current public-key algorithms to post-quantum options before decryption risk becomes operational.
• Review third-party trust dependencies Check which external services, cloud providers and certificate chains would delay your ability to retire vulnerable algorithms and renew trust relationships safely.

Key takeaways

• Quantum computing matters to identity and security because it weakens the long-term assumptions behind RSA, Diffie-Hellman and elliptic curve cryptography.
• The main exposure is not only future decryption capability, but the fact that encrypted data can be harvested now and decrypted later.
• Practitioners should focus on cryptographic inventory, algorithm agility and migration sequencing so the trust stack can change without disruption.

Key terms

• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
• Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
• Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
• Cryptographic lifecycle management: The governance of cryptographic assets from issuance through rotation, renewal, retirement, and replacement. In practice, this means assigning owners, tracking expiry, monitoring usage, and making sure certificate and algorithm changes are handled as part of normal identity and service operations.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.