Question 1

When do we actually have to finish our cryptographic migration, and what's the strict deadline?

Accepted Answer

The Australian Signals Directorate enforces a hard expiration date of 2030 for legacy asymmetric cryptography and intermediate parameter sets. Enterprises operating in critical sectors must complete their transition to mandated post-quantum standards by this exact threshold. Any transition strategy extending beyond 2030 without final-tier parameters will fail regulatory compliance.

Question 2

If our vendors claim they support post-quantum cryptography today, is that enough to check the box for compliance?

Accepted Answer

Simple vendor assertions of post-quantum support are insufficient for enterprise procurement and will leave systems exposed to quantum decryption threats. Standard procurement questionnaires must explicitly reference ISM-2073 parameters, specifically demanding ML-KEM-1024 for key encapsulation. Vague confirmations regarding hybrid readiness fail to meet strict ASD migration mandates.

Question 3

Are intermediate hybrid security setups sufficient to protect our networks through the next decade?

Accepted Answer

Relying on default hybrid schemes like ML-KEM-768 paired with X25519 only provides a temporary mitigation that officially expires in 2030 under Australian regulatory standards. Infrastructure buyers must bypass these intermediate configurations and directly procure systems capable of supporting higher-tier parameters. Failing to enforce this distinction forces a costly secondary hardware and software refactor before the end of the decade.

Question 4

Which exact parameter sizes should we demand from suppliers for our digital signatures and encryption keys?

Accepted Answer

Procurement teams must mandate ML-KEM-1024 as the preferred post-quantum key encapsulation mechanism and ML-DSA-87 as the required digital signature parameter by 2030. Additionally, all new enterprise procurements must enforce AES-256 for symmetric key parameter sizes to withstand anticipated quantum attacks. Specifications falling below these exact thresholds violate upcoming national security directives.

Quantum Cryptography Explainer: Technologies To Beat the Quantum Threat

Abstract

Key Takeaways

What's Inside

Defining the CRQC Threat

Why the ASD is Acting Now

The "Harvest-Now-Decrypt-Later" Strategy

ASD ISM Procurement & Cryptographic Standards

Cryptographic Standards and Technologies

How the CRQC threatens current encryption technologies

Frequently Asked Questions

Abstract

Key Takeaways

What's Inside

Defining the CRQC Threat

Why the ASD is Acting Now

The "Harvest-Now-Decrypt-Later" Strategy

ASD ISM Procurement & Cryptographic Standards

Cryptographic Standards and Technologies

How the CRQC threatens current encryption technologies

Frequently Asked Questions

Related Reports

Unlock the full report

Free

Lite

Team