- The British Government has released new guidelines for migration after quantity
- Timeline sketches a target for full migration in 2031
- SMEs need to find this more simple due to updated guidance
The British government has released its guidelines for the protection of technical systems against future quantum computers.
The National Cyber Security Center set a timeline for the British industry and state agencies to keep up with key dates, firstly, by 2028 all organizations must have a defined set of migration targets and an initial plan, and should have performed a ‘full discovery exercise’ to assess infrastructure and determine what to update for post-quantum computing.
By 2031, organizations should complete the highest priority migration activities and have a refined plan for a thorough roadmap to complete the change. Finally, by 2035, migration must be completed for all systems, services and products.
Large -scale threats
The British government noticed the relocation of a ‘mass change that will take a number of years’ – but why is migration needed?
The government outlines that the threat to cryptography from future ‘large, fault -tolerant quantum computers’ is now well understood and that technical systems will have to develop to reflect this.
“Quantum computers will be able to effectively solve the harsh mathematical problems that asymmetric public key chryptography (PKC) is dependent on to protect our networks today,” the guidelines confirm.
“The primary mitigation of the risk of this is to migrate to post-quantum cryptography (PQC); cryptography based on mathematical problems that quantum computers cannot solve effectively.”
The report warns that the overall financial cost of PQC migration may be ‘significant’, so organizations should budget accordingly, including for “preparatory activities” as well as migration itself.
For SMEs, PQC must be more straightforward and trouble-free, as services are typically updated by suppliers, but in the case of specialized software, PQC-compatible replacements or upgrades must be identified and implemented in accordance with the above schedule.
