US Government Mandates Transition to Post-Quantum Cryptography by 2035
Description
This image displays a block of text from a formal document. The text is black on a plain white background. It begins by stating, 'National Security Memorandum 10 (NSM-10) establishes the year 2035 as the primary target for completing the migration to PQC across Federal systems [NSM10]:'. This is followed by a direct quote, which reads: 'Any digital system that uses existing public standards for public-key cryptography, or that is planning to transition to such cryptography, could be vulnerable to an attack by a Cryptographically Relevant Quantum Computer (CRQC). To mitigate this risk, the United States must prioritize the timely and equitable transition of cryptographic systems to quantum-resistant cryptography, with the goal of mitigating as much of the quantum risk as is feasible by 2035.' The content is not a meme but a serious directive. It addresses the future threat posed by quantum computers to current encryption standards. For senior software engineers, this is highly relevant as it signals a major, inevitable, and complex migration of fundamental security infrastructure that will unfold over the next decade, eventually impacting all secure digital systems
Comments
7Comment deleted
2035 gives us just enough time to form a committee to decide on a standard, argue about it for ten years, and then give engineers a frantic 18-month deadline to migrate every system ever written
NSM-10 says “quantum-safe by 2035,” which is just enough runway to debate if Kyber keys fit in our 80-byte COBOL records, request an MTU increase, and draft the waiver for when the mainframe still refuses to link lattice math
"2035 is the new Y2K, except this time the consultants actually know what they're talking about and the threat is real... which somehow makes the budget meetings even more painful."
Nothing says 'we're taking this seriously' quite like a government setting a deadline 11 years out for a cryptographic migration - just enough time for three complete rewrites of the migration tooling, two vendor lock-in cycles, and one 'emergency' six-month extension when everyone realizes in 2034 that COBOL mainframes don't have a quantum-resistant mode
2035 PQC deadline: Because even national security treats crypto tech debt like a 10-year refactor epic
2035 sounds generous until you remember harvest-now-decrypt-later already started - and those Kyber/Dilithium cert chains will teach your MTU-tuned TLS middleboxes some humility
Nothing ages a platform roadmap faster than NSM‑10: we now have until 2035 to redo PKI with hybrid KEMs, upgrade HSM firmware, rotate every cert, and convince procurement that this isn’t the blockchain kind of crypto