This Edition in One Minute
Two more governments put dates on paper. Germany's interior ministry, digital ministry and federal security office (BSI) published a national guideline that recommends finishing a first cryptographic inventory and a binding migration plan by December 31, 2026, and moving high-risk systems to quantum-safe cryptography by the end of 2030. Singapore's Cyber Security Agency set 2031 for critical information infrastructure and asked other exposed organisations to have a plan by 2027 and finish by 2035. Both sets of dates are recommendations rather than law, but they match the 2030/2035 pattern now seen across Europe and Asia.
The most useful reality check came from MITRE. Its assessment for the PQC Coalition found post-quantum key exchange generally available in browsers, web servers, VPNs, PKI tools and cloud connectivity, but post-quantum signatures generally available only in code signing and PKI/CA tools, and no product yet doing post-quantum work inside a validated module. In plain terms, you can start protecting traffic from harvest-now-decrypt-later collection now, but authentication will take longer. Quantum hardware news was vendor-reported only and does not change credible timelines. NIST was quiet. The NSA CNSA 2.0 gate on January 1, 2027 is 72 days away.
This week's readiness step: check that your SSH connections use post-quantum key exchange. Most modern OpenSSH builds already do it by default; old servers and network equipment usually don't.
NIST: no new post-quantum announcements found this week. FIPS 206 (FN-DSA) and the HQC backup key-encapsulation standard remain pending. NSA: CNSA 2.0 unchanged. CISA: no new post-quantum guidance found.
The guideline applies the EU coordinated roadmap nationally and is aimed at federal, state and local government, companies, and critical infrastructure operators. Recommended milestones: by December 31, 2026, planning done, responsibilities and binding implementation plans set, migration started and a first cryptographic inventory finished; high-risk use cases migrated as early as possible and no later than end-2030; medium-risk use cases by end-2035; new purchases quantum-safe where possible by end-2030, or at least able to take quantum-safe updates. BSI recommends hybrid schemes that pair a classical algorithm with a post-quantum one, and points to its TR-02102 guidance for approved schemes. Practical inventory advice: model it on the IT-Grundschutz crypto register (CON.1.A19), use discovery tools and cryptographic bills of materials (CBOMs, for example in CycloneDX format), and where no register exists, start from your most important business processes. The dates are recommendations; the guideline asks Germany's federal–state IT planning council and the UP KRITIS critical-infrastructure partnership to make them binding by the end of 2026.
Date note: BSI announced this on October 12, two days before Edition #10, which did not cover it. It is included here because it is the first coverage in this briefing.
Owners of critical information infrastructure (CII) are expected to finish migration by 2031; CSA first gave them this milestone in June 2026. Other organisations exposed to quantum risk, such as those holding data that must stay confidential for years or running communications or digital-transaction services, are encouraged to have a migration plan by 2027 and complete migration by 2035. A Quantum-Safe Kickstarter Grant takes applications from November 1, 2026 to October 31, 2027 for pilots of up to six months, with priority use cases including cryptographic discovery and inventory and migration of operational technology and legacy systems.
Deadlines on the Board
| Deadline | Who it binds | Requirement | Status |
|---|---|---|---|
| Dec 31, 2026 | EU member states | Adopt national PQC migration strategies / begin transition (EU coordinated roadmap) | 71 days |
| Jan 1, 2027 | US National Security Systems (new acquisitions) | NSA CNSA 2.0 — new NSS equipment must support approved quantum-resistant algorithms | 72 days |
| Mid-2027 | Swiss financial institutions | FINMA Guidance 05/2026 — adopt PQC strategy and roadmap | ~8 months |
| Dec 31, 2026 → end-2035 | German public sector, companies, critical infrastructure | First inventory and plan (2026); high-risk migration (end-2030); medium-risk (end-2035) — recommendations, not counted as hard deadlines | New this edition |
| 2027 → 2035 | Singapore CII owners and exposed organisations | CII migration by 2031; others plan by 2027, complete by 2035 — advisory targets, not counted as hard deadlines | New this edition |
| End-2026 → end-2035 | Dutch central government | Staged migration targets (policy aims) | Carried from Edition #10 |
No post-quantum announcements from the 12 enterprise network/security vendors we track (Check Point, Cisco, Fortinet, Palo Alto Networks, VMware/Broadcom, Ivanti, Citrix, F5, SonicWall, Oracle, Arista, Microsoft) were found this week, and no new browser rollouts.
MITRE rated eight technology categories on how far post-quantum support has progressed. Key establishment (protecting confidentiality) reached the "integration" level, meaning generally available, for web browsers, web servers, VPN and network encryption, PKI/CA management and cloud service connectivity; volume encryption lags. Signatures (authentication) reached general availability only for code signing and PKI/CA management. No category reached the top level: MITRE found no product performing post-quantum functions through a validated cryptographic module in general release. Other gaps: browsers do not yet validate post-quantum certificates, web servers offer post-quantum authentication only through custom builds, no commercial post-quantum hardware TPM exists, and mainstream browsers lack ML-KEM-1024 and pure post-quantum TLS, which matters for national security systems. Caveat: the ratings rely on public evidence and vendor claims, not MITRE testing, so check your own products and configurations.
Meet calls from laptop web clients and meeting-room hardware now use post-quantum cryptography, with mobile "coming soon". It applies to all Workspace editions and personal Google accounts; there is no admin or user setting and nothing to do. Google's post does not name the algorithm. Client-side encrypted Meet calls already used quantum-safe encryption. This was announced two days before Edition #10 and is covered here for the first time.
The post-quantum TLS page still says Google will begin enabling hybrid X25519MLKEM768 by default "in October 2026" for load balancers with no SSL policy or no post-quantum setting, but its rollout table still lists the current state as disabled unless set to ENABLED, and no October release note records the switch. DEFERRED postpones it to October 2027. Separately, the October 14 release notes say Google-managed public certificates from Google's public CA are gradually moving from 90-day to 45-day validity, with no action required. Shorter certificate lifetimes are a crypto-agility signal: if anything in your estate pins or manually copies those certificates, it will now break twice as often.
No meaningful movement this week. No new credible reporting on harvest-now-decrypt-later collection or new sector-specific urgency signals was found. Europol re-promoted its October 6–7 reports on October 19; they were covered in Edition #10. Germany's and Singapore's guidance (Block 1) both name long-lived confidential data as the first priority, which reinforces rather than changes last week's picture.
Bottom line: nothing this week changes credible estimates of when RSA or elliptic-curve cryptography will be broken. One item is a narrower piece of an attack circuit, the other is a company's own accuracy claim.
| Item | What was claimed | What is verified | Crypto relevance |
|---|---|---|---|
| ECDSA.Fail leaderboard — low-qubit elliptic-curve point addition (circuit posted by Theta Labs' Jieyi Long; reported Oct 14) | One secp256k1 point addition, a step in a Shor-style attack on Bitcoin/Ethereum keys, in 893 logical qubits and ~2.2M Toffoli gates (follow-up: 874 qubits); a benchmark co-author said this could cut physical-qubit estimates in recent attack proposals by ~25% | BENCHMARK · NOT PEER REVIEWEDThe circuit passes the open benchmark with classical test inputs; no full attack estimate built on it has been published; one wider test failed about once per 3,250 additions; an independent analysis finds the 25% figure unverified and likely smaller in practice | Direct but partial. It narrows one step of the attack on the elliptic curves behind Bitcoin, Ethereum and much of today's ECDSA. A full resource estimate is the number to watch. |
| Quantinuum Helios — error-correction record (press release, Oct 19) | 99.9995% logical fidelity, "10×" better than its September result and "100×" lower error than Google's best published superconducting result; on track for fault tolerance by 2029 | VENDOR CLAIM ONLYNo paper or preprint linked; benchmark, workload and number of logical qubits not stated; we found no independent technical analysis this week | Indirect. Better logical qubits are a prerequisite for code-breaking machines, but one company's fidelity claim does not by itself move a Q-Day estimate. |
Also seen, not included: a RIKEN processor-scaling result and Xanadu DARPA funding (hardware, no direct cryptographic implication found).
SSH carries administrator passwords, configuration files, database dumps and file transfers, which is exactly the kind of traffic worth recording now and decrypting later. The good news is that SSH is one of the easiest places to get post-quantum key exchange: OpenSSH added a hybrid post-quantum method (sntrup761x25519) as its default in version 9.0, added the NIST-standard hybrid mlkem768x25519-sha256 in 9.9, and made it the default in 10.0. The gap is usually the old servers, appliances and network devices nobody has upgraded.
- Check what your clients support. Run
ssh -Q kexon admin workstations and jump hosts. Look formlkem768x25519-sha256orsntrup761x25519-sha512. - Check what a connection actually negotiates. Connect with
ssh -vand read thekex: algorithm:line. A curve25519 or diffie-hellman result means that session is not post-quantum protected. - Check your servers. On each Linux server run
sshd -T | grep -i kexalgorithmsand note the OpenSSH version (ssh -V). Anything before 9.0 has no post-quantum option. - List the devices you can't upgrade quickly. Firewalls, switches, routers, storage arrays, hypervisor hosts and IPMI/BMC cards often run their own older SSH. Record them in your crypto inventory and add them to vendor questions (Edition #10).
- Prefer the hybrid methods in configuration. Where you manage
KexAlgorithms, putmlkem768x25519-sha256(andsntrup761x25519-sha512) first, keeping a classical fallback until every client you depend on supports them. Test on one server before rolling out. - Prioritise by what crosses the link. Start with SSH paths that cross the internet or untrusted networks, and with automated transfers (SFTP, backups, Git over SSH) that move long-lived sensitive data.
- Know the limit. This protects session confidentiality. SSH host and user keys are still classical signatures (for example Ed25519 or RSA); post-quantum authentication will come later and is not a reason to delay key exchange.
Rotation note: previous topics were #1 crypto inventory · #2 certificate lifecycle / CA readiness · #3 TLS 1.3 + hybrid PQC planning · #4 hybrid TLS hardening · #5 PKI / root-first migration · #6 FIPS 140-2 → 140-3 procurement · #7 HSM / key-management migration · #8 post-FIPS-transition actions · #9 VPN / IPsec PQC readiness · #10 vendor post-quantum readiness questionnaires. SSH has not been this block's focus before.
- Window
- October 14 – October 21, 2026 (7 days since Edition #10)
- Changed since last edition
- Singapore CSA migration timeline and Kickstarter grant; MITRE/PQC Coalition capability report; ECDSA.Fail low-qubit point-addition circuit; Quantinuum error-correction claim; Google Cloud certificate validity moving to 45 days; Coinbase post-quantum requirements for Bitcoin (Block 7). Two items announced October 12 but missed in Edition #10 are covered for the first time: Germany's national guideline and Google Meet's post-quantum rollout.
- Checked, nothing new
- NIST PQC news (via search; NIST's site could not be loaded directly this week); NSA CNSA 2.0 (unchanged); CISA PQC guidance; the 12 tracked enterprise network/security vendors; Chrome, Firefox and Safari PQC rollouts; AWS and Azure PQC announcements; PQC patent activity; PQC-specific venture funding.
- Countdown
- CNSA 2.0 new-NSS acquisition gate: 72 days (Jan 1, 2027). EU member-state strategies: 71 days (Dec 31, 2026). Germany's recommended first inventory and plan: same date.
- Method notes
- The German guideline and MITRE report are summarised from secondary analyses (PostQuantum.com, The Quantum Insider, Quantum Zeitgeist); the official BSI pages are linked for verification. Quantinuum's own press release and two independent write-ups of it could not be retrieved this week, so the claim is labelled vendor-only. The German and Singapore dates are listed but not counted as hard deadlines because they are recommendations. Block 7's self-referential count uses the site search index and the full text of this service's daily reports from October 14 to 21.
- Corrections
- None this edition. Coverage note: Germany's guideline and Google Meet's rollout (both October 12) should have appeared in Edition #10.
Every row below is filtered for relevance to cryptography — quantum news without a cryptographic or security implication is excluded.
| # | Indicator | This edition |
|---|---|---|
| 1 | Research publications | Elliptic-curve attack circuits are being optimised in public: the ECDSA.Fail benchmark (paper: arXiv 2609.09582) produced point-addition circuits under 900 logical qubits this week. Leaderboard entries are not peer reviewed (Block 4). |
| 2 | Patent filings | No meaningful signal this week. |
| 3 | Startup funding | No verified PQC-specific venture round found. Public money: Singapore's Quantum-Safe Kickstarter Grant opens November 1 for migration pilots. |
| 4 | New product categories / entrants | No meaningful signal this week. |
| 5 | Standards progress (non-NIST) | Industry consortium: the PQC Coalition published MITRE's cross-category capability ratings (Block 2). In cryptocurrency, Coinbase pointed to Bitcoin proposal BIP-360 (P2MR) as a model for adding post-quantum signature types. |
| 6 | Enterprise adoption | Coinbase, which says it holds about 12% of all bitcoin, published seven requirements for Bitcoin's post-quantum transition (Oct 13), including staged hybrid outputs and compatibility with multi-party signing, and framed it as input rather than a final position. Starknet asked its stakers whether to research leaving Ethereum over quantum risk (reported Oct 17). |
| 7 | Regulatory references (beyond NIST/CNSA) | Germany (end-2030 high-risk, end-2035 medium-risk; recommendations) and Singapore (2031 CII; 2027 plan, 2035 completion for others) — see Block 1. |
| ★ | Frequency in DeepFalcon threat/vuln reports (since Oct 14) | 0 mentions. No quantum or post-quantum references in the titles, summaries or tags of the 12 daily vuln and threat entries in the search index from October 14 to 21, or in the full text of those daily reports. |