What the European Supervisory Authorities published on 23 September 2026

The EBA, EIOPA and ESMA released their Autumn 2026 Joint Committee update on risks and vulnerabilities, document JC 2026 29, first presented to the Financial Stability Table of the EU's Economic and Financial Committee on 10 September. Most of it concerns external dependencies and private credit. One slide, under the heading on cyber risk and frontier AI, warns that an advanced quantum computer could undermine cryptography used to secure communications, transactions, databases and blockchains, and that such threats could materialise earlier than any viable commercial application.

Why the ordering of risk and benefit matters for EU finance

In this update the three authorities say the attack on cryptography may come before the commercial benefit. They tie the point to harvest now, decrypt later collection, to the Digital Operational Resilience Act's requirement for state-of-the-art cryptography, and to the EU roadmap that recommends Member States to begin the move to post-quantum cryptography by the end of 2026.

What the recommendations do not yet contain

The closing recommendation on AI and quantum computing lists three actions: rely on DORA and the AI Act, keep operational resilience strong, and adopt AI-powered security testing. None of the three is specific to quantum computing. This analysis reads the slide closely and sets it against DORA, which binds banks, insurers and fund managers, and against the EU roadmap, which recommends dates to Member States.

What Stephen Weis's September 2026 note says about the 19 September factorization

RSA-896, a 270-digit challenge modulus, was factored with Claude on 19 September 2026, according to a note Weis posted in September 2026. Claude ported the open-source CADO-NFS number field sieve to GPUs and orchestrated it across a fleet of up to 2,048 GPUs as a low-priority job in idle time between regular workloads; the run took about ten days and roughly 30 GPU-years of compute. Weis states that the work did not meaningfully improve the runtime of the general number field sieve and does not affect deployed RSA-2048 keys, and that it demonstrates 1,024-bit RSA keys are vulnerable to many actors with data-center-scale GPU fleets.

Where the record stood: 829 bits in February 2020, 862 bits on 3 September 2026, 896 bits now

RSA-250 (829 bits) was factored in February 2020 with CADO-NFS on CPUs. Cognition's RSA-260 (862 bits) followed on 3 September 2026 at about 4,900 GPU-days, which its author priced at about $400,000. RSA-896 adds 34 bits sixteen days later, on a little over twice the GPU-years. Cognition's author estimates RSA-1024 at roughly $30 million per number at market GPU prices. No properly generated 1,024-bit RSA modulus has been publicly factored.

What the rules already say about 1,024-bit RSA, and where it still lives

For federal use, NIST SP 800-131A Rev. 2 has disallowed RSA moduli under 2,048 bits for signature generation and key transport since 2014, keeping them only for legacy verification. RFC 8301 still permits DKIM signers to use 1,024-bit RSA keys, because a 2,048-bit key does not fit some DNS TXT record tooling. The gap between those two documents is where Weis's sentence lands, and it is an inventory question before it is a cryptography question.

What Oracle released on 15 September 2026

Java 27 ships JEP 527, Post-Quantum Hybrid Key Exchange for TLS 1.3. The JDK's TLS client now offers X25519MLKEM768, a combination of X25519 elliptic-curve Diffie-Hellman with ML-KEM-768, as its most preferred named group, ahead of x25519 and secp256r1. An application that uses the JDK's own SunJSSE implementation over TLS 1.3 with the default group list offers a hybrid post-quantum key exchange, and uses it when the server selects that group. Two further hybrids, SecP256r1MLKEM768 and SecP384r1MLKEM1024, are implemented and switched off by default.

Why the calendar matters more than the release

Java 27 is a non-LTS release with premier support to March 2027. The runtimes that carry production workloads are the long-term-support lines, and Oracle's roadmap post of 6 August 2026 gives each of them an expected date for Oracle JDK: JDK 25 with the October 2026 Critical Patch Update, JDK 21 and JDK 17 in the first half of 2027, and JDK 8 and JDK 11 in the second half of 2027. JDK 8, released in March 2014, remains under Oracle extended support until December 2030, so the two oldest supported lines are scheduled last. For JDK 8 and 11 estates carrying long-lived sensitive data, that is the latest Oracle backport date, and an operator can move earlier by upgrading the runtime or changing the TLS stack; on any line, protection arrives only when the update is installed and the hybrid group is confirmed to be negotiated.

What the post examines

The chronology from the KEM API of September 2023 to the H2 2027 backport, what JEP 527 deliberately leaves out, how the LTS backport calendar compares with the migration dates supervisors such as FINMA and NIST have set, and what a runtime default can move in the installed base that a supervisory deadline cannot.

What Cloudflare announced on 10 September 2026

Cloudflare's public resolver 1.1.1.1 validates DNSSEC signatures made with ML-DSA-44, the lattice signature NIST standardized in FIPS 204 in August 2024 and the first post-quantum algorithm with an IANA DNSSEC number, 18. Sebastiaan Neuteboom and Bas Westerbaan's post gives the sizes: a 1,312-byte public key and a 2,420-byte signature, against 64 bytes for ECDSA P-256. The company plans full post-quantum security across its network by 2029.

Why the packet size and the downgrade rule matter

RFC 1035 restricted DNS over UDP to 512 bytes in November 1987; EDNS(0) raised the ceiling, DNS operators settled on 1,232 bytes, and RFC 9715 of January 2025 recommends 1,400. One ML-DSA-44 signature exceeds that budget before the answer carries anything else, so an authoritative server truncates the signed response and the validating resolver retries over another transport, usually TCP; a client that asks 1.1.1.1 for an address without requesting DNSSEC data sees none of this. The second problem is older than the algorithm. RFC 6840 tells validators they should accept any single valid path, which lets a zone publish classical and post-quantum keys together. Once a classical key can be forged, that same rule is a downgrade path. 1.1.1.1 now treats a post-quantum DS record in the parent zone as an authenticated signal and refuses to validate on a classical path alone, a local policy RFC 4035 permits and no standard yet requires.

What is settled and what is still open

NIST fixed the algorithm, IANA assigned the number, and the DNSSEC specification remains an individual Internet-Draft by Westerbaan of Cloudflare and Sophie Schmieg of Google, revision 04 of 11 August 2026, with no working-group adoption. An end-to-end post-quantum chain, from authoritative signing through registrar DS submission and registry publication to the root, remains incomplete. This post reads what the resolver change proves, what the packet arithmetic forces, and why the root key is the one that decides whether any of it counts.

What happened between 13 August and 9 September 2026

On 3 September 2026 Eric Lu, an engineer at Cognition, posted a 130-digit prime factor of RSA-260 on X. The number, 260 decimal digits and 862 bits, had stood unfactored since RSA Security published its challenge list in 1991. Scientific American ran a story the next day in which the only method on offer was a remark about "good old paper and pencil". On 9 September Cognition published Lu's technical write-up: a GPU port of the open-source CADO-NFS number field sieve, prepared and run with Devin coding agents, consuming about 4,900 GPU-days on NVIDIA GB200, GB300 and B200 nodes, which Lu prices at about $400,000 at current market rates.

How the cost compares with 2020 and 2009

RSA-250 was factored in February 2020 by six academic cryptographers using about 2,700 CPU core-years of CADO-NFS. RSA-768 took thirteen people two years to December 2009. Lu writes that he reports essentially no algorithmic advance, that the work was a side project on a single-digit percentage of Cognition's cluster, and that the barrier to entry for cryptanalytic work is far lower than it used to be.

What it means for keys in use

By Lu's own scaling, RSA-1024 is 78 times more computation, an extrapolated $30 million at market GPU prices, and RSA-2048 is roughly a billion times harder again. NIST's draft transition plan, IR 8547 of November 2024, proposes that RSA-2048 be deprecated after 2030 and disallowed after 2035; the proposal rests on the quantum threat, and this result does not revise it. What moved is the extrapolated price of a classical attack on 1,024-bit keys, which NIST disallowed for new signatures after 2013.

What arXiv:2609.09582 says

On 9 September 2026, 36 authors led by Jieyi Long published the results of Eigen Labs' ECDSA.Fail contest: an eight-week public leaderboard in which humans and AI agents submitted evaluator-verified improvements to the reversible secp256k1 point-addition circuit inside Shor's algorithm. Participants cut the benchmark score, peak logical qubit width times average Toffoli count, by 86.1 percent. At the 26 July 2026 cutoff the best circuit used 1,151 qubits and about 1.30 million Toffoli gates. A later low-width design reached 813 qubits. The paper states that these figures sit more than 50 percent below Google's published point-addition thresholds of March 2026, under different accounting conventions, and that they are not a full-Shor estimate.

What the Howard Center found in 50 states

On 10 September 2026 the Howard Center for Investigative Journalism at Arizona State University and Scripps News published a 50-state analysis of post-quantum cryptography planning. Four states have an active migration plan: New Jersey, New York, Maryland and Missouri. Fourteen are committed to or developing one. Thirty-two gave the reporters no confirmation of an active or developing plan; nine of those declined to say. Executive order 14412 of 22 June 2026 sets 31 December 2030 for key establishment and 31 December 2031 for digital signatures on federal high-value systems, and contains no direction to state or local government.

The question this post answers

Whether a circuit-design contest that cut a benchmark score by algorithm alone changes what a city or state technology office with a cybersecurity budget and no post-quantum line item should do next, and why the federal deadlines that exist do not answer that question for it.

What the guidance is

FINMA published Guidance 05/2026 on 9 July 2026. It reports a survey of 60 authorised Swiss banks, insurance companies, managers of collective assets and financial market infrastructures, run between November 2025 and January 2026, and sets out five post-quantum cryptography recommendations. The headline recommendation is that supervised institutions draw up a migration roadmap by mid-2027 at the latest, on the basis of a strategy adopted by the board of directors.

What this read covers

A section-by-section read of the eight-page instrument: how the reported 72 percent decomposes, what the 8 percent with a roadmap actually forecast, the scope of the section 3.2 cryptographic inventory, and the crypto-agility clause section 3.5 recommends for new outsourcing arrangements in the software and data sectors. It also notes the sentence that excludes quantum key distribution from the recommendations altogether, which is worth having in writing when a proposal arrives.

Why the survey is more interesting than the date

The percentages are the part that repays attention. Around two-thirds of those surveyed expect quantum cyber risk to become directly relevant for them within seven years, while almost two-thirds do not expect to run quantum computing applications themselves for another eight years or more. Those are two aggregate distributions rather than a respondent-level comparison, but the order they describe is the whole document: the gap between what the sector says it understands and what it has done about it.

One document now decides what “quantum-safe TPM” means

On 24 August 2026 the Trusted Computing Group published guidance telling purchasers how to test a vendor's claim that a Trusted Platform Module is post-quantum ready, and it does so by pointing at a single specification: the PC Client Platform TPM Profile version 1.07, published 23 March 2026. The profile states that a conformant TPM shall support either ML-KEM-768 or ML-KEM-1024 and either ML-DSA-65 or ML-DSA-87, makes SHA-512 mandatory, and rules out SHA-1 entirely.

Memory is the demanding part

Post-quantum objects are large — an ML-DSA-87 signature runs to 4,627 bytes — so the profile sets two normative floors: at least 68 NV indexes totalling 11,026 bytes, and a minimum of 6,896 bytes for persistent objects. The non-normative example behind the persistent-object figure reaches it by storing key seeds instead of expanded keys. Pre-provisioning endorsement key certificates in the factory stays optional, and where a vendor does pre-provision them, the profile requires a classical credential paired with the post-quantum one.

What the 3 September announcements actually claimed

SEALSQ and wolfSSL described the QVault TPM as on track to be the first shipping TPM implementing the post-quantum algorithms of the TPM 2.0 Library Specification v1.85, with testing across ML-DSA and ML-KEM at all key strengths; the release cites the library specification rather than the platform profile, and gives no shipping date. WiSECURE and ITRI showed a FIPS 203/204/205 chip at SEMICON Taiwan the same day, which the company describes as commercial grade — a cryptographic application chip, outside the scope of a PC client TPM profile. This piece reads the profile's own text against both announcements, and sets out what the two TCG designations, PQC-ready and PQC-upgradable, mean for a hardware budget.

Six dates between 11 September and 22 October 2026, and what each one changes

Executive Order 14412 sets 2030 and 2031 as the federal post-quantum destinations, and OMB Memorandum M-26-15 makes every agency migration plan due on 22 October 2026. Five other dates arrive first, and they move the estate rather than the plan. On 11 September the Cyber Resilience Act starts a 24-hour early warning duty for actively exploited vulnerabilities. On 15 September JDK 27 is scheduled to deliver JEP 527 and place X25519MLKEM768 first in the default TLS 1.3 preference list, so services left on that default will offer hybrid post-quantum key exchange from their next deployment. On 21 September the Cryptographic Module Validation Program moves every FIPS 140-2 certificate to the Historical List, which changes the standing of certificate numbers already written into proposals and contract schedules. On 27 September a Department of War request for information closes, specifying ML-KEM-1024 key transport for software-only encryption. On 19 October the Windows Production PCA 2011 signing certificate expires.

The parameter-set seam, and the artifact to ask for on each date

Java's default and Cisco's supported IKEv2 hybrid land on ML-KEM-768; the defense specification asks for ML-KEM-1024. Both sit inside FIPS 203, and they do not meet by accident. This read walks the six dates in order and states, for each, the single artifact a buyer or a supplier can request and check: a reporting playbook with a named CSIRT endpoint, a runtime inventory with TLS-inspection test results, a certificate register with successor or legacy status for every 140-2 number, a written parameter-set position, Microsoft's five developer actions answered for every signed component, and a checkable package for each federal customer whose plan is due.

A certificate that changes status on 21 September 2026 without the module changing

The NIST Cryptographic Module Validation Program has said that on 21 September 2026 it will move every FIPS 140-2 validated module to the Historical List, where federal agencies should not include the module in new systems and may procure it for legacy systems only. Nothing inside the hardware changes on 22 September. What changes is the status of the certificate a proposal cites, which turns "FIPS-validated" into three questions: which standard, which certificate number, and what status on the day the proposal is read.

A readiness level in the field, a product-attributed pipeline, and three vendor dates

Three more documents sit alongside it. QuSecure said on 2 September 2026 that QuProtect R3 reached Technical Readiness Level 7 at the U.S. Army's Project Convergence Capstone 6 at Fort Irwin, providing quantum-resistant communications, cryptographic agility and cryptographic discovery and inventory for tactical mission systems; the rating is the company's own account of the exercise. SEALSQ's preliminary first-half results of 6 July 2026 put unaudited company-wide revenue near $11 million and attributed more than $60 million of a $225 million management-estimated pipeline to the QS7001 secure element and the QVault TPM, and on 3 September the company announced wolfTPM support for that part. JDK 27 reaches general availability on 15 September 2026 with hybrid post-quantum key exchange first in the default TLS preference list, Microsoft's Windows Production PCA 2011 expires on 19 October 2026, and Cisco IOS XE 26.x carries an ML-KEM-768 hybrid for IKEv2.

Why the four together describe a procurement test

The four documents carry dates spread across July, August and September, and what changed in the first week of September is that a buyer could request all of them at once. Each names an organisation, a date and a checkable particular. Read against Executive Order 14412, OMB Memorandum M-26-15 and the Department of War request for information closing 27 September 2026, they show what a buyer of post-quantum cryptography can now ask for and expect to receive.

A five-year-old build flag, not a broken cipher

On 30 July 2026 Block's Bitcoin engineering and security team published a root-cause analysis of thefts from Coinkite's Coldcard hardware wallets. A single commit on 1 March 2021 left the macro MICROPY_HW_ENABLE_RNG defined with the value zero, and the supporting library tested whether that macro was defined rather than whether it was enabled. Seed generation silently fell through to MicroPython's Yasmarang software generator, initialised from a chip serial number and two timer registers. No error appeared on any screen for five years.

What the counts say, and where they disagree

Galaxy Research mapped a sweep of 1,082.65 BTC out of 1,196 addresses in forty-one minutes on 30 July. TRM Labs put the running total at roughly 1,816 BTC and about USD 116 million across more than 5,200 addresses by 5 August. Coinkite's own advisory of 1 August describes about 72 bits of entropy against the 128 bits a BIP-39 seed assumes. Block's figures are harsher: deterministic output on the Mk2 and Mk3, and roughly 2^31 average enumeration on the Mk4, Mk5 and Q — both figures conditional on an attacker knowing the device identifier, the timer state and the history of calls to the generator, and neither backed by an end-to-end benchmark. Attribution of individual thefts remains open.

The gap in what a federal migration plan must contain

OMB memorandum M-26-15 of 24 June 2026 fixes what a federal agency's post-quantum cryptography migration plan must contain, and Appendix B lists nine items. Entropy is not among them, and the words "entropy" and "SP 800-90B" appear nowhere in the memorandum. Entropy quality is governed separately, through NIST SP 800-90B and the Entropy Source Validation stream inside the Cryptographic Module Validation Program. This piece reconstructs the Coldcard failure end to end and shows why an algorithm inventory of the affected devices could be entirely accurate and still miss it.

What Simon submitted on 3 August 2026, and what the abstract claimed

Cryptology ePrint Archive 2026/1591, “A Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem,” by Daniel R. Simon of Amazon Web Services, was received on 3 August 2026 and filed under attacks and cryptanalysis. Building on Regev's reduction techniques, it claimed to handle modular subset sum without a subset-sum oracle and to yield polynomial-time quantum algorithms for lattice problems, including a polynomial-factor approximation to the shortest vector and learning with errors at noise parameter α = √n polylog(n). The abstract never mentions ML-KEM, FIPS 203, or any deployed parameter set. The paper was revised four times, most recently on 17 August 2026.

What Gupte, Ragavan and Zhandry posted on 15 August 2026

ePrint 2026/1693, “The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP,” by Aparna Gupte of MIT, Seyoon Ragavan of Google Quantum AI and MIT, and Mark Zhandry of Google Quantum AI and Stanford, was received on 15 August 2026 and last revised on 1 September. The formal finding is that Simon's algorithm does not extract the least-significant bit of the dihedral coset secret with non-negligible guessing advantage, and so cannot solve the problem it targets. The authors state that their no-go covers a much broader class of algorithms than Simon's — those that carry only a limited digest of the classical Fourier information into the uncomputation stage — and they released Lean 4 code so the argument can be machine-checked.

Why the twelve days matter more than the result

Executive Order 14412's key-establishment deadline of 31 December 2030, the Java runtime shipping hybrid key exchange on 15 September 2026, and the enterprise plans behind them all lean on lattice mathematics for key establishment. When the strongest public challenge to that mathematics this year appeared, the quality control that answered it came from three academics posting a formal no-go within twelve days, and from the author leaving his own paper up with the challenge attached. That is the working crypto-agility argument, made by demonstration.

What BSI dated on 11 February 2026 and what FINMA recommended on 9 July 2026

Two European authorities put years on the post-quantum transition in 2026, and neither is American. One is a cybersecurity agency and one is a financial supervisor. Germany's Federal Office for Information Security, in the annual update of its cryptographic guideline TR-02102, set the first expiry for classical asymmetric procedures: end of 2031 for key agreement and encryption, end of 2030 where protection needs are high, and end of 2035 for classical signature procedures. Switzerland's financial supervisor followed on 9 July 2026 with Guidance 05/2026, drawn from a survey of 60 authorised banks, insurers, managers of collective assets and financial market infrastructures run between November 2025 and January 2026. Around two thirds of them expect quantum-related cyber risk to reach their own institution within seven years. Seventy-two per cent had planned or implemented nothing.

The inventory FINMA recommends covers stored data, and that is the harder half

FINMA recommends a post-quantum cryptography roadmap drawn up by mid-2027 at the latest, resting on a strategy adopted by the board of directors and an inventory of every business process, explicitly covering encryption in transmission as well as stored data. The transmission half is moving on its own wherever both endpoints have shipped hybrid key agreement. The stored half is not. A record 176.5 exabytes of compressed LTO tape capacity shipped in 2024, a fourth consecutive year of growth, into archives whose key hierarchies and signature chains were designed when RSA was considered safe for a working lifetime.

Why the constraint is key management rather than algorithm choice

Standardised algorithms exist. What many archives lack is the ability to move the keys that protect decades of stored records, through key-management servers, backup appliances and self-encrypting drives, without rewriting the data itself — and whether that shortcut is available at all depends on how a given site built its key hierarchy and which payload cipher it chose. BSI's 2030 and 2031 dates fall on the asymmetric side of that question; 2035 falls on the signature chains that make an archive provable. It is a records-retention question for medical, pension and insurance files as much as a cryptographic one.

Who recommended it, where, and when

On 6 November 2025, Mauritz Kop published “A Bletchley Park for the Quantum Age” in War on the Rocks. The essay named the General Services Administration and asked that federal purchases be conditioned on validated cryptographic modules, and it asked separately that fielded systems be tested rather than vendor promises accepted. Nine months later, on 24 August 2026, GSA published a post titled “GSA Leads the Transition to Quantum-Resistant Technology”. The recommendation came first, it named the right agency, and both of the things it asked for — buy only what is validated, test what is fielded — are now federal work.

What GSA actually operates

Two things, and both are procurement rather than protocol. GSA is modernizing the Federal Identity, Credential, and Access Management architecture for quantum-resistant algorithms, with crypto agility as the stated design goal, through an interagency working group that OMB Memorandum M-26-15 ordered it to stand up and that first met on 12 August 2026. And GSA’s FIPS 201 Evaluation Program, executed through its Physical Access Control System lab, is starting to incorporate quantum-resistant algorithms into the testing that decides which badge readers and door controllers reach the Approved Products List. No quantum-resistant access product has been approved yet.

Why the doors are the hard part

Algorithm migration inside a browser handshake can often be delivered through software updates. Credentials and readers run on hardware-refresh cycles measured in a decade, which is why M-26-15 puts access control built on public-key infrastructure in its priority tier. Put quantum-resistant algorithms inside the FIPS 201 test suite and covered identity and access purchases start inheriting the requirement from the buying rule rather than from a new mandate.

A change underneath the measurement

Encrypted-traffic classifiers read the outside of a connection — packet sizes, directions, timings — and infer what is inside without decrypting it. A preprint posted to arXiv on 24 August 2026 by Bingzhen Li and eight co-authors asks what happens to those models when TLS moves to hybrid post-quantum key establishment. Using the deployed group X25519MLKEM768, which pairs the classical X25519 exchange with ML-KEM-768 from FIPS 203, the authors show that the larger post-quantum handshake reshapes observable traffic while leaving the application above it and its label untouched. They name the effect PQC-induced protocol drift, and they put numbers on it.

Relocated, not removed

Across five representative classifiers and three experimental settings, the result holds: the signal survives the migration but moves, and models that score well under matched conditions lose reliability once the cryptographic domain shifts beneath them. The mixed period — part traditional traffic, part hybrid, in proportions that change every month — lasts as long as both domains share the same wire, and it is precisely the condition the field's benchmarks are not built to measure. The measured scope is narrow and is stated as such: closed-world website fingerprinting, one deployed hybrid group, one purpose-built benchmark.

Why the loss has no owner

In the same week, the US Treasury launched its Quantum-Readiness Task Force under Executive Order 14412, with third-party and vendor readiness as one of three workstreams. Migration is becoming procurement. Procurement asks whether a supplier supports the new algorithm, and has no natural place to record that switching it on ages a detection baseline owned by a different team. This piece reads the paper closely and follows that seam into the operational and civic consequences, including a temporary privacy dividend that nobody planned and nobody owns.

A date, and no algorithm

Microsoft's guidance of 20 August 2026 sets three steps for the chain of trust that decides which software a Windows machine will accept. The Microsoft Windows Production PCA 2011 expires on 19 October 2026, with a replacement authority already rolling out. Signing moves to RSA-3072 and SHA-384 by the end of 2026. And in 2027, Windows signing transitions to post-quantum signing, which Microsoft says might use hybrid signature constructions. The guidance commits to a date and a direction while naming no post-quantum algorithm at all.

The bench that is supposed to answer

NIST's additional-signatures on-ramp exists chiefly to diversify beyond structured-lattice signatures, and secondarily to find short signatures and fast verification for applications that need them. Nine candidates advanced to its third round on 14 May 2026; on 29 July the HAWK team withdrew, and eight remain. Cloudflare's July analysis walked the same bench and concluded that none of the compact candidates is ready to carry the first migration, committing instead to ML-DSA on a 2029 target.

Deployment pressure, not a verdict

A vendor calendar fixed to 2027 without an algorithm. A programme built to diversify, one candidate lighter. An infrastructure provider settling on the general-purpose standard because it is finished. And a cross-regional pilot announced on 24 August that will put financial supervisors inside a live ML-DSA-65 test as observers. Microsoft selects nothing; only the last two actually pick a scheme. What they share is narrower than a verdict and still worth acting on: near-term deployment pressure is settling on ML-DSA while the alternatives mature, in a layer of the stack almost nobody outside cryptography can see.

A twentyfold-lower estimate, now through review

In a Perspective accepted by PRX Quantum on 6 July 2026, Ryan Babbush and colleagues — a Google-led multi-institution team including Craig Gidney, Adam Zalcman, Tanuj Khattar, Justin Drake and Dan Boneh — put the quantum cost of breaking elliptic-curve cryptography at about 1,200 logical qubits and 90 million Toffoli gates in one configuration, or 1,450 logical qubits and 70 million in another, mapping to fewer than 500,000 physical qubits: roughly twenty times below the prior physical-qubit estimate for the same task. Run straight through, those circuits take 23 or 18 minutes. Only a primed attack, with the precomputation already done, falls to about 12 or 9 minutes, which is the variant that draws level with the window in which a transaction sits on a public network with its key exposed.

The deadlines that stayed where they were

None of the migration dates examined here moved. Executive Order 14412 still sets 31 December 2030 for post-quantum key establishment across federal high-value and high-impact systems and 31 December 2031 for signatures; the European roadmap still runs to 2030 for critical infrastructure; the ICAO passport standard is still expected around the middle of 2027. The US order was signed after the preprint of 30 March 2026; the European roadmap and the ICAO target both predate it. A search of official communications on 22 August 2026 found no US, EU or ICAO statement revising any of them in light of the work.

Why that is mostly defensible

Those deadlines were never derived from a resource estimate. They are procurement calendars, keyed to certification and product queues that no executive order can shorten, and a co-author of the paper has cautioned that a rushed transition is the likelier catastrophe. The reasoning holds wherever a secret can be rotated. Where something has already been captured and cannot be reissued — a biometric, an archive, a public key long since published — harvest now, decrypt later means the useful deadline for that particular record has already gone, whatever date the instrument carries.

One key, one place, one number

Stateful hash-based signatures are the one post-quantum family that behaves like a book of numbered receipts: every leaf may be used exactly once, and the count of what has already been spent is part of the secret. NIST's 2020 recommendation for those schemes holds the line with two plain conformance clauses. The cryptographic module may not export private keying material, even in encrypted form, and it may not use a one-time key more than once. Sign twice at the same index and, in NIST's words, it becomes computationally feasible for an attacker holding both signatures to forge further ones.

Where it meets the recovery plan

Ordinary resilience engineering runs on the opposite reflex. Many conventional copy-based designs duplicate the signing environment or roll it back in time, and where they do, both faults land in the same place: an index issued twice. Safer state-aware mechanisms exist and have been catalogued at the IETF; they are simply not what most recovery machinery does by default. The problem is well enough known to have its own engineering literature at the IETF, and it reached the banking press this week through a Swiss custody bank explaining why Ethereum's post-quantum roadmap is already an operational question. Switzerland's supervisor had reached an adjacent finding in July, reporting that in most cases among the sixty institutions it surveyed there was "a lack of a clear roadmap and sufficiently forward-looking planning" for the migration.

What the standard proposed instead

The interesting part sits in the recommendation itself. NIST anticipated module failure in 2020, refused the copy, and gave over a whole section to two architectures in its place — several independent keys across several modules, or one multi-tree key whose subtrees are generated on separate hardware. That is redundancy without duplication, and it has to be chosen at the key-generation ceremony, years before anyone reaches the migration deadline written in the plan.

What the report describes

On August 11, 2026, Check Point Research published an account of an Operation Dream Job intrusion chain aimed at defense and aerospace staff in France, Germany, India and Brazil. The lure was a recruiter approach. The payload was a use-after-free race in the Windows socket driver AFD.sys, tracked as CVE-2026-68820, giving local escalation to SYSTEM. Microsoft received the report on July 28, assigned the identifier on August 5, and patched on August 11. CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, with a federal remediation date of August 25.

The detail that matters

Before the exploit moved, the privilege-escalation loader carried out post-quantum key establishment with its server: it took server public keys, generated fresh key material with Kyber/ML-KEM, returned the encapsulated result, and only then requested the zero-day. The report places this inside that loader's exchange, not across the campaign's wider command infrastructure. A second cipher layer sat on top of the existing AES transport, using a randomly generated 16-byte session key prepended to each packet. The rootkit that followed blinded 94 event-tracing providers and tampered with Smart App Control.

Why it reads as an organizational story

As a general matter, a classical ephemeral exchange offers comparable protection against later decryption, so a post-quantum primitive is not by itself a new offensive capability. What the case shows is speed. NIST finalized ML-KEM in August 2024; it appeared here in an ordinary tooling update, integrated by a team with no inventory to survey and no supplier to wait for. Enterprises measure the same transition in years because their constraint was never the mathematics. That asymmetry, not the handshake, is what inspection-based defense now has to plan around.

A consultation with one word missing

On August 12, 2026, NIST opened a public consultation on rebuilding the National Vulnerability Database for an era of AI-assisted attack and machine-readable security data. The notice runs to seven groups of questions, from automation of the vulnerability lifecycle through to the standards that govern vulnerability data and a five-year vision for the database itself. Comments close on October 13, 2026. The word cryptography does not appear anywhere in it.

Why the omission matters

Two years after the first post-quantum standards were finalized, European rules now require entities in scope to hold policies on the use of cryptography, and the Dutch implementing statute takes effect three days after this notice published. No instrument orders anyone to keep a cryptographic inventory — but a policy that cannot be checked against deployed systems is not one an auditor can test. The database ingests vulnerability records within about an hour of publication, so speed was never the binding constraint. The constraint is structural: a register answers only the questions its schema anticipated, and a flaw record was never built to describe a key exchange or a signing algorithm.

Who this decides for

Cryptographic discovery is already procurable by anyone with a budget, and no central record could replace it: what a given operator has configured is local knowledge that has to be found locally. What a public record could supply is the reference layer underneath — what a product version implements — so that local discovery resolves against something instead of being re-derived by everyone independently. Whether that layer acquires a cryptographic dimension will shape the real pace of migration among smaller operators more than any further deadline, and it is being settled on an open docket rather than in an instrument.