Pentagon PIV and CAC Smart Cards Must Use Post-Quantum Algorithms by 2030, Says DoD PQC Director Britta Hale: Why Every Card Reader and Server Has to Be Ready by the End of 2029
On 27 August 2004 President Bush signed Homeland Security Presidential Directive 12, which ordered a single, secure identity credential for federal employees and contractors. NIST answered within six months with FIPS 201, and the result was the PIV card: a smart card holding private keys that a government reader can challenge and a government server can trust. Two decades on, that card opens doors, unlocks laptops, signs email and authorizes access to classified and medical systems. Its current rules sit in FIPS 201-3 and in two NIST Special Publications, SP 800-73-5 on the card interface and SP 800-78-5 on its algorithms and key sizes, both published in July 2024. None of the three yet specifies a post-quantum algorithm for the card.
On 9 October 2026, Jason Miller of Federal News Network reported remarks by three federal officials at an AFCEA DC lunch on what the post-quantum migration means for those cards. The most concrete came from the Defense Department.
Practical takeaway. DoD's PQC director says PIV and CAC cards must use post-quantum algorithms by 2030, which means every reader, server and certificate authority that accepts those cards must handle them by the end of 2029. NIST has not yet published the revised card specifications, and GSA's post-quantum certificate authority for the Federal PKI is still a pilot. The card is where the federal signature migration becomes physical, and it carries the shortest clock.
What DoD's PQC director Britta Hale said about PIV and CAC cards, reported 9 October 2026
Britta Hale directs post-quantum cryptography for the Defense Department. She told the audience that identity and authentication are among the hardest parts of meeting the White House deadlines, and that if an agency's public key infrastructure cannot handle post-quantum cryptography, the other goals are moot. Federal News Network quotes her: "Personal Identity Verification (PIV) and Common Access Cards (CACs) have to incorporate the algorithms, which means all your core infrastructure, all your PKI infrastructure has to be ready by 2030. That really means actually using PQC by 2030, and that starts a countdown where you go backwards in time."
She then ran the countdown. A department-wide rollout requires systems that already accept post-quantum algorithms, "otherwise, when you plug in those cards, nothing works, and people lose access." Her conclusion was that "by the end of 2029, all systems and products in the department have to be post-quantum ready."
The same report gives the governmentwide frame. Agencies owe their migration plans to the Office of Management and Budget and the Office of the National Cyber Director by the end of October. The White House deadlines, as Federal News Network summarizes them, are post-quantum readiness for all high-value assets and systems by 2030, post-quantum digital signatures for those assets before the end of 2031, and full migration of all other systems by 2035. Hale's card date sits ahead of the general signature deadline. A PIV or CAC card authenticates by signing, so on her account DoD's card credentials would move to post-quantum algorithms a year before the governmentwide signature date.
Why a 2030 card deadline means every reader and server must be ready by the end of 2029
A card upgrade differs from a software upgrade because the relying side has to move first. A PIV or CAC card proves its holder's identity by signing a challenge with a private key that never leaves the chip. The reader passes that signature to a server, which checks it against a certificate issued by a certificate authority, which in turn chains to a federal root. Every system that verifies the signature or the certificate chain has to understand the new algorithm before the first new card is switched on. Card management systems, door controllers, domain controllers, VPN concentrators, email clients and the certificate authorities themselves all fall inside Hale's 2029 line.
That is a large estate to inventory, and the inventory itself is weak. Patrick Manley, who leads quantum security at the Cybersecurity and Infrastructure Security Agency, told the same audience that the annual cryptographic inventory process has become "a box check," filled in on spreadsheets and submitted. He also said budgets are being cut and that agencies "don't have a good understanding of what their inventory looks like, nor how to estimate their cost." That echoes the audit Quentir covered on 8 October, in which GAO found that none of 24 agencies met all of its inventory, funding and testing practices. Card readers and physical access controllers sit in buildings rather than data centers, which makes them easy to leave out of a software-led inventory.
The people affected are concrete. A CAC is how a service member logs into a workstation and how a contractor badges into a facility. A clinician working in a federal health system uses a PIV card to reach patient records. A migration that ships cards before the relying systems are ready produces the failure Hale described: the card works cryptographically and the holder still cannot get in.
How much larger an ML-DSA signature is than the ECDSA signature on today's cards
The physical constraint is size. NIST's post-quantum signature standard, FIPS 204 (ML-DSA), published in August 2024, defines three parameter sets. The smallest, ML-DSA-44, uses a 1,312-byte public key and a 2,420-byte signature. The largest, ML-DSA-87, uses a 2,592-byte public key and a 4,627-byte signature. A raw ECDSA P-256 signature of the kind current cards can produce is 64 bytes before encoding. The post-quantum signature is therefore about 38 to 72 times larger, and each certificate in the chain carries a larger key and a larger signature from its issuer. ML-DSA is the standardized candidate; which parameter sets a PIV card may carry is for the revised NIST card specifications to decide.
A smart card holds a few certificates and keys in a small secure element and answers the reader through a narrow interface, one short message at a time. Larger objects mean more storage on the chip, more data passing through the reader and more time at a door that is expected to open quickly. Whether a given reader must be replaced depends on the system: some readers only relay data to a server or controller that does the verification. Bill Newhouse, PQC project lead at NIST's National Cybersecurity Center of Excellence, described the work to Federal News Network as a re-architecture: the new algorithms "don't fit as a replacement" for what agencies use on their devices, so "there is recoding and re-standardization that was necessary." He also flagged an open choice of security strength, between what DoD and the intelligence community need and what agencies use for ordinary communication with the public.
The web faces the same arithmetic. Quentir's post on Cloudflare's plan to become a public certificate authority issuing Merkle Tree Certificates described one industry response: restructure the certificate so that browsers carry less signature data per connection. A PIV card has no such shortcut yet. Its certificates are presented by a physical token to a reader that may be ten years old.
What NIST and GSA are changing: SP 800-73, SP 800-78 and the FICAM PQC pilot
Two federal workstreams carry the answer. According to the Federal News Network report, NIST is updating SP 800-73 Parts 1 and 2 and SP 800-78 to support post-quantum standards. Those revisions will decide which algorithms and parameter sets a PIV card may carry and how the card exposes them to a reader. Until they are published as drafts, card makers and agencies are building against an unannounced specification.
The second workstream is the General Services Administration's Federal Identity, Credential, and Access Management (FICAM) program. Its post-quantum page says Phase 1, whose findings were published in June 2025, tested RSA-3072 and RSA-4096, Ed25519, X25519 and several Dilithium variants (the pre-standard name of ML-DSA) for PIV credential issuance, authentication, signing and full certificate lifecycle management. Phase 2 is under way and aims at "a deployable, standards-aligned, PQC PKI CA service blueprint and an operational pilot that can scale across agencies while maintaining compatibility with Federal PKI trust expectations and existing PIV workflows." The Federal PKI has also opened a test environment, the Bridge & Root Authority Working Lab (BRAWL), which offers partners an ML-DSA-87 self-signed root certificate and bridge CA, so they can test post-quantum certificate paths end to end.
The choice of ML-DSA-87 for that test root is worth noting. It is the largest and strongest ML-DSA parameter set. A root's own self-signed certificate is normally held as a trust anchor rather than sent over the wire, but every certificate the root issues carries a 4,627-byte signature from it. If a production post-quantum root used the same parameter set, the certificates it directly signs would carry that size, whether or not they are cached by the validating system. BRAWL is a test lab, and it does not settle what the production Federal PKI will use.
How Quentir Reads It
The 2004 directive succeeded because one card specification and a shared Federal PKI let a credential issued by one agency be trusted by another. That interoperability now shapes the post-quantum change. The Federal PKI is a network of root, bridge, cross-certified and issuing authorities, so agencies can migrate in stages and run classical and post-quantum certificates side by side for a period. What they cannot do is issue post-quantum cards that the systems relying on them do not yet accept. Hale's statement turns that dependency into a date for DoD: the relying systems come first, by the end of 2029, and the cards follow by 2030.
The open variable is timing at NIST. The revised SP 800-73 and SP 800-78 are the documents card manufacturers will build to, and agencies cannot buy compliant cards and readers until those revisions settle. Every month between today and their final publication comes out of the window Hale described. Two signals are worth watching: the public draft of the revised SP 800-78, which will name the permitted post-quantum parameter sets, and whether GSA's FICAM Phase 2 blueprint becomes a production certificate authority service. The migration plans due at OMB at the end of October will show whether civilian agencies have priced their card readers and door controllers or are still counting servers.
Federal contractors are part of this. Contractor staff carry PIV cards and CACs, and vendors whose card management, reader and physical access products serve DoD systems will need roadmaps that fit the 2029 readiness date Hale described. Quentir's Signature Report, the PQC Migration Roadmap covers the full sequencing question for organizations planning that work, with an executive summary, refresh triggers and an internal-use license; this post covers only the identity-card thread opened on 9 October.
Sources: Jason Miller, Federal News Network, "In preparing for PQC, agencies must ensure integration with smart identity cards", 9 October 2026 (remarks by Britta Hale, DoD; Patrick Manley, CISA; Bill Newhouse, NIST NCCoE; White House deadlines as summarized there); General Services Administration, IDManagement.gov, "FICAM Drives Federal Quantum Readiness", accessed 11 October 2026; NIST, SP 800-73-5 Part 1 and SP 800-78-5, July 2024; NIST, FIPS 204, Module-Lattice-Based Digital Signature Standard, August 2024; NIST, FIPS 201-3, January 2022; Homeland Security Presidential Directive 12, 27 August 2004.
Published intelligence, built to inform your own decisions. Published: October 11, 2026.