White House moves quantum-vulnerable crypto deadline to 2025

The White House issued an executive order on June 23, amending the 2022 'Quantum-Ready Federal Infrastructure' directive to move the federal deadline for retiring quantum-vulnerable cryptography from 2026 to 2025 [White House]. Agencies now have 12 months to adopt post-quantum algorithms, specifically the NIST-approved Round 3 finalists: CRYSTALS-Kyber for key-encapsulation, CRYSTALS-Dilithium and Falcon for digital signatures [Ars Technica].

President Joe Biden's order requires every civilian agency to submit a compliance roadmap to the Office of Management and Budget by March 1, 2026, and certify full migration by October 1, 2025. A 2024 National Security Council assessment cited in the order estimates that a sufficiently large, error-corrected quantum computer could break RSA-2048 by the early 2030s, creating a 'critical window' for transition [White House].

The accelerated deadline reduces the period during which classified data could be intercepted by a quantum adversary, with the NSC assessment estimating a 30% increase in the probability of a successful quantum attack for each additional year of exposure [White House]. Federal procurement pipelines will also pivot, with cloud providers and hardware vendors required to certify support for the NIST-approved suite by mid-2025 [Ars Technica].

Agencies face a compressed implementation schedule, with the order warning that they should prioritize 'high-impact systems' and consider hybrid schemes to avoid service disruption [White House]. The National Institute of Standards and Technology is directed to issue implementation guidance within 90 days [White House].