Pentagon PIV and CAC Smart Cards Must Use Post-Quantum Algorithms by 2030, Says DoD PQC Director Britta Hale: Why Every Card Reader and Server Has to Be Ready by the End of 2029

What DoD's post-quantum director said about PIV and CAC cards

Britta Hale, director of post-quantum cryptography at the Defense Department, told an AFCEA DC audience that Personal Identity Verification (PIV) cards and Common Access Cards (CACs) have to carry the new algorithms by 2030. Federal News Network reported her remarks on 9 October 2026. Her reasoning runs backwards from that date: if a card arrives with post-quantum signatures and the reader, server or certificate authority behind it cannot process them, the holder is locked out. In practice, she said, every system and product in the department has to be ready by the end of 2029.

Why the identity card sets the pace for federal PQC migration

A smart card is a small computer with limited memory, issued in the millions and replaced on a multi-year cycle. ML-DSA, the NIST post-quantum signature standard and the leading candidate for the card, produces signatures roughly 38 to 72 times larger than a raw elliptic-curve signature. NIST is revising SP 800-73 and SP 800-78, the two documents that define the card interface and its algorithms, and GSA's FICAM program is piloting a post-quantum PKI for the Federal PKI. This post sets the DoD date against the governmentwide 2030, 2031 and 2035 milestones and against what the card standards still have to change.