Topic starter
11/07/2026 8:47 pm
TL;DR: Quantum computing threatens RSA and ECC, while the NIST has already finalised three post-quantum cryptographic standards and signalled more to come, according to GlobalSign. The real issue for identity teams is not algorithm awareness but migration scope, because every device, server, browser, certificate, and communication path that depends on public-key trust will need a replacement path before quantum risk becomes practical.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Los 3 Nuevos Estándares Criptográficos Post-Cuánticos del NIST para un Futuro Seguro”.
Key questions
Q: How should security teams prepare identity systems for post-quantum cryptography?
A: They should start with a complete inventory of where cryptography underpins authentication, federation, signing, and encrypted transport.
Q: Why does post-quantum readiness create risk for certificate authorities and PKI operations?
A: Because cryptographic standards are only one layer of the problem.
Q: What breaks if organisations treat post-quantum migration as a one-time upgrade?
A: What breaks is the assumption that cryptographic change is isolated to one platform or one algorithm.
Practitioner guidance
- Map all public-key trust dependencies Inventory every device, server, browser, CA, application, and integration that relies on RSA, ECC, or certificate-based trust so migration scope is explicit.
- Classify long-lived data by harvest-now risk Prioritise data with long retention, high sensitivity, or regulatory exposure because encrypted content captured today may be recoverable later.
- Assess CA and HSM readiness together Verify whether certificate authorities, hardware security modules, and lifecycle tooling can issue and validate post-quantum-safe certificates without breaking current operations.
Bottom line: Post-quantum readiness is fundamentally about the identity systems that rely on public-key trust, not just about which algorithms are on a standards list.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:12 pm
Post-quantum readiness is an identity lifecycle issue, not a crypto inventory exercise: RSA and ECC sit inside certificate issuance, browser trust, device onboarding, and server authentication. That means migration scope is defined by where identity trust is used, not by which algorithm is named in policy. The implication is that identity teams must own the dependency map before any algorithm transition can be governed.
A question worth separating out:
Q: Should teams prioritise quantum-safe certificates or application compatibility first?
A: Neither should be treated in isolation. Teams need to prioritise the trust path end to end, because a quantum-safe certificate that applications cannot validate is not a usable control, while compatible applications without secure issuance still leave the identity chain exposed.
👉 Read our full editorial: Post-quantum cryptography readiness is now an identity problem