Federal Contractors Should Prepare Now for Post-Quantum Cryptography

Federal contractors should begin preparing for post-quantum cryptography (PQC) as finalized standards move the issue from research toward migration planning. The source reports that the National Institute of Standards and Technology (NIST) published FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) on August 13, 2024. ML-KEM is identified as the principal agreed post-quantum key-encapsulation mechanism, with parameter sets ML-KEM-512, ML-KEM-768, and ML-KEM-1024. The practical procurement implication is that agencies and their contractors may need to assess cryptographic dependencies, implementation options, and validation needs before a specific solicitation requires a migration approach.

The key immediate exposure is public-key cryptography used for key exchange. The source emphasizes the “harvest now, decrypt later” risk: an adversary can record encrypted traffic today and attempt to decrypt it in the future. Contractors should therefore identify where RSA and elliptic-curve cryptography (ECC) are used, prioritize systems that protect long-lived sensitive information, and evaluate rollout paths. A hybrid approach pairing ML-KEM with X25519 for TLS is described as the path that can ship first, retaining a classical component while adding a post-quantum mechanism. The article also discusses pure ML-KEM deployments and composite approaches that combine a lattice-based key with RSA-OAEP, ECDH, X25519, or X448 for certificates and messaging formats.

The proposed transition dates require careful treatment in compliance planning. Draft NIST IR 8547, dated November 2024, proposes deprecating quantum-vulnerable RSA and ECC uses after 2030 and disallowing them after 2035. The source says no later version has been confirmed and characterizes these dates as proposals rather than settled requirements. Contractors should use them as planning signals—not represent them as binding deadlines—and monitor NIST guidance for updates. The source further states that NIST recommends applying finalized standards and migrating systems that depend on quantum-vulnerable public-key cryptography, while migration guidance dated October 18, 2026, recommends ML-KEM-768 or ML-KEM-1024 where appropriate.

Standards development for certificates and protocols creates potential implementation and validation work for technology providers and federal integrators. The source reports that RFC 9935, published in March 2026, defines X.509 algorithm identifiers for ML-KEM, enabling certificates and PKI tooling to carry ML-KEM keys. It also describes IETF drafts addressing TLS 1.3 groups, IKEv2, JOSE, and CMS, while cautioning that drafts remain under review and are not adopted standards. For capture-and-retain risks, key exchange is the part that “cannot wait”; however, organizations should avoid treating any single vendor capability or draft protocol as a complete compliance solution. Google Cloud, Cloudflare, and SEALSQ are cited as examples of providers or products reporting post-quantum capabilities, not as government awardees. No specific procurement, award, contract value, or vendor selection is reported.

• NIST finalized FIPS 203, FIPS 204, and FIPS 205 on August 13, 2024; contractors can use these standards as a basis for migration assessments.
• Inventory RSA and ECC across applications, infrastructure, certificates, key management, and communications to identify systems requiring a transition plan.
• Evaluate a controlled hybrid ML-KEM/X25519 TLS pilot, considering interoperability, performance, operational constraints, and applicable validation requirements.
• ML-KEM includes ML-KEM-512, ML-KEM-768, and ML-KEM-1024; migration guidance dated October 18, 2026, recommends ML-KEM-768 or ML-KEM-1024 where appropriate.
• Treat NIST IR 8547’s proposed 2030 and 2035 dates as planning signals only: the source says the draft remains unconfirmed and the dates are not settled requirements.
• Track certificate and protocol standards: RFC 9935 defines X.509 identifiers for ML-KEM, while cited IETF work on TLS 1.3, IKEv2, JOSE, and CMS remains in draft or review.
• Assess potential supplier and integrator demand for implementation, interoperability testing, certificate updates, and cryptographic validation as organizations prepare to use finalized standards.
• Google Cloud, Cloudflare, and SEALSQ are cited for reported post-quantum capabilities; the article does not identify them as federal awardees or name a government procurement.
• Include the “harvest now, decrypt later” threat in prioritization, particularly for encrypted information that must remain confidential over long periods.
• Monitor the source-described HQC backup-algorithm work separately: it is not yet a standard, and the source expects a final standard in 2027; it complements rather than replaces ML-KEM.