Notifications
Clear all
Topic starter
01/08/2026 8:54 pm
TL;DR: Quantum computing will eventually weaken much of today’s public-key cryptography, while AES-256 remains robust, according to Yoti’s analysis. The practical issue is not only algorithm choice but cryptographic agility across identity, TLS, and long-lived personal data, where harvest-now-decrypt-later risks are already shaping transition plans.
NHIMG editorial — based on content published by Yoti: post-quantum cryptography and identity data resilience
By the numbers:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- Only 5.7% of organisations have full visibility into their service accounts.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
Questions worth separating out
Q: How should security teams prepare identity systems for post-quantum cryptography?
A: They should start with a complete inventory of where cryptography underpins authentication, federation, signing, and encrypted transport.
Q: Why do identity and biometric systems need earlier post-quantum planning?
A: Because their data often remains valuable long after collection, which gives harvest-now-decrypt-later attacks a long window to pay off.
Q: What breaks when organisations treat AES-256 as enough for quantum resilience?
A: They risk overlooking the asymmetric layers that actually establish trust, such as RSA, ECC, and digital signatures.
Practitioner guidance
- Map all public-key dependencies Inventory every RSA and elliptic-curve use case across TLS endpoints, signing services, identity verification flows, and third-party integrations.
- Prioritise long-lived identity data Identify biometric templates, identity records, and other data expected to remain sensitive for 10 years or more.
What's in the full article
Yoti's full analysis covers the operational detail this post intentionally leaves for the source:
- The TLS and signing migration details behind the hybrid post-quantum approach, including where asymmetric dependencies remain.
- The cryptographic inventory milestones and target dates that shape the transition roadmap.
- The internal architecture choices around on-device keys, centralised signing, and larger classical key sizes.
- The standards references that inform the transition timeline, including NIST and NCSC alignment.
👉 Read Yoti's analysis of post-quantum cryptography readiness for identity data →
Post-quantum cryptography: what it means for identity and data teams?
Explore further
01/08/2026 9:03 pm
Quantum risk is now an identity governance issue, not just a cryptography problem. The article is right to tie post-quantum planning to personal data, biometric data, and federated trust. Those are identity assets with long confidentiality lifetimes, which means today’s cipher choices affect tomorrow’s privacy exposure. Practitioners should treat cryptographic transition as part of identity governance rather than a narrow security engineering task.
A question worth separating out:
Q: How do security teams manage quantum migration across third parties?
A: They need contract, assurance, and architecture views at the same time. If a relying party, library, or hardware provider cannot support post-quantum algorithms on the same timeline, the organisation inherits that delay. Clear dependency mapping and staged transition testing are essential before the weakest external link becomes the blocker.
👉 Read our full editorial: Post-quantum cryptography raises identity security stakes for data holders
