Question 1

What is the ASD post-quantum cryptography deadline?

Accepted Answer

The Australian Signals Directorate expects organisations to have a refined post-quantum transition plan by the end of 2026, to have commenced migration of critical systems by the end of 2028, and to have completed the transition by the end of 2030. Traditional asymmetric cryptography, RSA, Diffie-Hellman, ECDH and ECDSA, is not approved beyond 2030.

Question 2

Does the ASD allow hybrid post-quantum cryptography?

Accepted Answer

Yes, but it does not recommend it. The ISM states that post-quantum traditional hybrid schemes are not recommended; however, it is not prohibited, citing added complexity and computational overhead. ASD is explicit that hybrid is transitional: a cryptographically relevant quantum computer will render the traditional element obsolete, so all organisations should expect to move to purely post-quantum algorithms.

Question 3

Is ML-KEM-768 approved in Australia?

Accepted Answer

Yes, currently, but not beyond 2030. The ISM approves both ML-KEM-768 and ML-KEM-1024 and requires preferably ML-KEM-1024, while stating that ML-KEM-768 will not be approved beyond 2030 for interoperability and maintainability reasons. The same applies to ML-DSA-65 on the signature side, where ML-DSA-87 is preferred.

Question 4

If our cloud provider has enabled post-quantum encryption, are we compliant?

Accepted Answer

Not for the full term. The prevailing global configuration is hybrid ML-KEM-768 with X25519, and under the Australian ISM both components are unapproved beyond 2030. Inheriting it is a reasonable first step, but a transition plan that stops there commits you to a second migration on the same deadline.

Question 5

What is ISM-1917?

Accepted Answer

An Australian Information Security Manual control requiring that a post-quantum cryptography transition plan is developed, implemented and maintained. The related procurement control, ISM-2073, requires new cryptographic equipment, applications and libraries to support ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512 and AES-256 by no later than 2030.

Question 6

Does the post-quantum deadline apply to small businesses?

Accepted Answer

The ISM applies most directly to government and regulated entities, but the practical reach is much wider through procurement: regulated buyers pass their cryptographic requirements to suppliers. A small business selling into government, banking or critical infrastructure will be asked about its PQC position regardless of whether a regulator obliges it directly.

Question 7

Does New Zealand have a post-quantum deadline?

Accepted Answer

On our current understanding, no equivalent domestic mandate sets a timeline. NZ organisations nonetheless inherit ASD, NIST or UK NCSC timelines through vendors, cloud providers and Australian parent companies. The exposure is the same. Only the deadline is missing.

Question 8

Why migrate now when no quantum computer can break RSA?

Accepted Answer

Harvest-now-decrypt-later. Encrypted traffic captured today can be decrypted once the capability exists, so any data with a confidentiality lifetime extending past 2030 is already exposed. ASD's guidance directs organisations to prioritise exactly that long-lived sensitive data.

ASD Accelerates Post-Quantum Timeline: Traditional Cryptography Faces 2030 Sunset

Abstract

Key Takeaways

What's Inside

The Quantum Threat: What the ASD is Solving

What the deadline actually requires

The readiness mirage

Who is actually prepared

The vendor questionnaire is the real enforcement mechanism

New Zealand: same exposure, no domestic clock

What to do in the next five months

Implications and watchlist

Frequently Asked Questions

Sources