Germany publishes its national post-quantum cryptography migration guideline

[Austin]

Germany has published a national guideline setting out how it will carry out the EU's roadmap for post quantum cryptography. The Quantum Insider reports that it was produced jointly by the Federal Ministry of the Interior, the Federal Ministry for Digital Affairs and State Modernisation, and the Federal Office for Information Security, known as the BSI

The guideline is aimed at all levels of government, as well as businesses and critical infrastructure operators. It sets two key dates. High risk systems should move to quantum safe methods as soon as possible and finish no later than the end of 2030. The wider transition should be largely complete by 2035

The recommended measures are practical. They include clear responsibilities for migration with binding deadlines, adopting post quantum cryptography in line with the state of the art, building quantum risk into normal risk management, and involving manufacturers and supply chains early

A big theme is crypto agility, meaning systems and procurement should be designed so that algorithms or key lengths can be changed quickly. The guideline also notes that AI is speeding up attacks on cryptography, which adds urgency. The underlying BSI release appears to date from 12 October, so the news is a few days old

Clear national timelines help organisations plan, and Germany's approach is sensibly focused on practical steps rather than abstract warnings. Crypto agility in particular is good advice for any organisation, whatever happens with quantum computers

Are 2030 and 2035 realistic deadlines? And how prepared is your organisation for post quantum migration?

Germany Publishes National Post-Quantum Cryptography Migration Guidelinethequantuminsider.com

[CrimsonFury31]

Involving manufacturers early is key. Most organisations rely on vendors for their cryptography. If the vendors are not ready, nobody is. Hardware security modules and smart cards will need replacing in many places. That takes years of planning

[AsteroidCandle]

Our company has barely started thinking about this. Guidelines like this help make the case to management. Deadlines focus minds. An inventory of where we use cryptography would be the first step

We do not even have that yet. Most companies probably do not

[Jacob]

AI speeding up attacks on cryptography is an interesting point. That adds pressure regardless of quantum progress

Strong, modern cryptography is good practice anyway. Side channel attacks especially could benefit from AI pattern finding