Post-quantum cryptography: What businesses must plan
4 min read
Businesses should identify where their IT systems use cryptographic methods and how long their data must remain confidential. Germany’s Federal Office for Information Security recommends supplementing classical key agreement methods with post-quantum methods in future. Separate requirements apply to digital signatures. Starting early gives IT leaders time to examine dependencies and plan the transition with their suppliers.
Key points at a glance
- The BSI recommendation concerns the use of classical key agreement on its own. A suitable combination with post-quantum methods remains possible.
- Data that must remain confidential for a long time warrants early attention. Intercepted data could later be decrypted using sufficiently powerful quantum computers.
- A cryptographic inventory provides the basis for planning. It identifies methods, affected systems and dependencies on vendors and service providers.
What the BSI recommends for key agreement
Many secure connections first require a shared secret key. Key agreement uses classical asymmetric methods whose security is threatened by future powerful quantum computers.
According to the Deutsche Bundesbank, the BSI recommends using classical key agreement methods on their own only until the end of 2031. For applications with very high protection requirements, it specifies the end of 2030. The BSI also recommends a hybrid approach that combines classical methods with post-quantum methods.
This recommendation does not impose a blanket legal obligation on all businesses to replace systems across all applications. The legal or contractual requirements that apply in each case depend in part on the sector and area of use.
The German federal government has also published national guidance for implementing the EU roadmap. It contains a timetable for the transition to post-quantum cryptography in Germany.
Why confidential data matters today
In a “harvest now, decrypt later” scenario, attackers intercept and store encrypted data. If sufficiently powerful quantum computers become available in future, they could try to decrypt the data retrospectively. It remains unclear when such computers will be available.
The length of time data needs to remain confidential therefore matters when setting priorities. Research documents, trade secrets or sensitive personal data may still need protection years after transmission. The IT department should identify the connections used to transmit such information and the methods used to protect the key.
Consider key agreement and signatures separately
What is post-quantum cryptography? The term refers to cryptographic methods designed to withstand attacks using powerful quantum computers. They run on conventional computer systems.
In 2024, the National Institute of Standards and Technology published three such standards: ML-KEM is used to establish a shared secret key. ML-DSA and SLH-DSA are used for digital signatures. These help verify the origin of data and detect subsequent changes.
For the migration, businesses must therefore examine each use case: a secure connection and the signature on a software update serve different purposes. The BSI dates for using classical key agreement on its own cannot be applied indiscriminately to every digital signature.
How to start the inventory
A cryptographic inventory records which methods and keys are used in applications, connections and devices. Examples include VPN connections, web services, certificates and signed software updates. External services and interfaces should also be included in the inventory.
Systems can then be prioritised according to their protection needs, the required period of confidentiality and their technical dependencies. It is worth asking vendors and service providers which post-quantum methods they support, how updates can be deployed and which components need to be compatible with one another.
A test environment is a useful place to start implementation. There, the team can assess how a suitable hybrid key agreement affects the interoperability and performance of the systems involved. The migration plan should account for responsibilities, procurement and subsequent testing. How long the transition takes and what it costs depend on the individual environment.
Frequently asked questions
Must businesses completely replace classical methods by the end of 2031?
The BSI recommendation mentioned above concerns the use of classical key agreement methods on their own. A suitable hybrid combination with post-quantum methods is possible. It does not create a general legal obligation to replace methods across all applications.
Why is hybrid key agreement envisaged?
It combines a classical method with a post-quantum method. The BSI recommends this approach for the transition. The specific combination and its implementation must be suitable for the intended use.
Which data should be considered first?
Data that must remain confidential for a long time is particularly relevant. Businesses should also assess which systems transmit or store it and how heavily those systems depend on external providers.
Read more on MyBusinessFuture
MyBusinessFutureCyber Resilience Act: What manufacturers must do nowMyBusinessFutureAI Act from August 2026: High-risk AI in mid-sized businessesMyBusinessFutureEdge Computing: Why the Cloud Isn’t Always Enough for SMEsMore from the MBF Media Network
SecurityTodayIdentity Security Gap: What Zero Trust does not protect (SecurityToday)Image source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
