后量子密码技术转型协同实施路线图

Part 1, Version: 1.1, EU PQC Workstream 11.06.2025 Contents 1Executive Summary2Introduction and motivation 3Scope and definitions3.1Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3.2Definitions of frequently used technical terms . . . . . . . . . . . . . . . . . . 4Timeline4.1Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2The timeline in detail: Milestones, first and next steps. . . . . . . . . . . . . 5Estimating the quantum risk 6Steps towards the PQC migration6.1Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2First Steps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.3Next Steps. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7What the EU can do 1Executive Summary Digital infrastructures require robust cybersecurity.Cryptographic systems are vital toprotect the confidentiality and authenticity of data. Quantum computing will be a threatto many of the cryptographic algorithms used to achieve these protection goals. Data thatis currently not quantum-safe, whether it is stored or transmitted, and that must remainconfidential for a long time, may be compromised in the future by quantum computers Consequently, on 11.04.2024, the European Commission published a “Recommendationon a Coordinated Implementation Roadmap for the transition to Post-Quantum Cryptog-raphy” [1]. For the development of this “Implementation Roadmap” the Commission rec- This document is the first deliverable of the NIS CG work stream on PQC and is meant tobe a first high-level paper aimed at the Member States. The set of recommendations thatMember States need to implement for a synchronised transition to PQC are divided into First Stepsthat are required to initiate the transition, andNext Stepsthat should follow.The recommendations in this document include measures to ensure that all stakeholders ensure that the quantum threat becomes a part of risk management of all relevant enti-ties and to establish mature cryptographic asset management to facilitate the transitionto PQC and to improve cryptographic agility in general. Many of the steps highlighted in In addition to these recommendations, this document presents a recommended timelinefor the transition to PQC in the European Union, taking into account the current assess-ment of the status of quantum computer development by the German Federal Office for In particular, it is recommended that all Member States initiate a national PQC transitionstrategy followingFirst Stepsby the end of 2026 and coordinate their efforts at the EUlevel. At the same time, high-risk use cases should be transitioned to PQC as soon as pos-sible, no later than the end of 2030. Furthermore, quantum-safe upgrades should then beenabled by default and the PQC transition plans should be refined, in particular by imple-menting the recommendedNext Steps. By 2035, the transition should be completed for Over the past years, the EU has put in place a strong strategic, policy and legislative frame-work to strengthen the EU’s cybersecurity and collective resilience. In particular, the NIS 2Directive [2] and the Digital Operational Resilience Act (DORA) [4] require entities in scopeto adopt cybersecurity risk-management measures, including on the use of state-of-the-art cryptography, and provide that the entities’ management bodies can be held liable forfailing to comply with these requirements. Furthermore, the Cyber Resilience Act (CRA) [5]lays out horizontal cybersecurity requirements for all products with digital elements placedon the EU market starting from 11.12.2027, including a requirement to protect confiden-tiality through encryption where relevant. The necessity to ensure the authenticity and 2Introduction and motivation Cryptography is crucial to securing a broad range of services having a direct impact onour daily lives. Those encompass, for instance, digital government services, the bankingsystem, and communication services such as messaging apps.Cryptography is vital to If the currently deployed cryptography was to be broken, the consequences on digital in-frastructures would be devastating. The development of quantum computers poses sucha threat to cryptography. This is known since 1994, when Peter Shor published quantumalgorithms, which can be used to break many of the cryptographic algorithms in use. The There is currently no evidence that this is already possible. Nevertheless, in 2015 the USNational Security Agency (NSA) issued an urgent warning about the imminent threat tocurrent quantum-vulnerable cryptography posed by the development of quantum com-puters. European agencies have also publicly informed about this threat from early on, e.g.in [6]. In order to properly assess the current state of development or the potential futureavailability of quantum computers, the study “Status of quantum comp