Moving past the 2030 PQC deadlines requires shifting from theoretical mathematics to practical decentralized engineering.
The collective sigh of relief in Washington last week is entirely understandable. With the signing of Executive Order 14412 and the release of the Department of War’s Post-Quantum Cryptography (PQC) Strategy, the U.S. government has delivered a serious, forward-looking policy designed to protect the nation against advanced cryptographic attacks. Technical experts and trade groups have reasonably welcomed the 2030 and 2031 migration deadlines as “appropriately aggressive” steps to accelerate defenses already underway.
Yet, setting a deadline is merely an administrative beginning. Translating a policy directive into operational resilience requires moving past mathematics to focus on engineering. Swapping out legacy code for quantum-resistant math is an excellent initial step, but if treated as a comprehensive cure-all, it overlooks a broader structural reality.
To understand how to practically achieve true quantum readiness, we should look away from Washington’s policy briefs and look instead at the hull of a U.S. Navy DDG-51 class destroyer. A modern warship is a floating microcosm of our entire digital infrastructure. The architectural lessons learned from securing its networks provide a blueprint for the three critical areas the broader post-quantum transition must address.
1. Shift From Algorithmic Updates to Decentralized Architecture
The prevailing consensus in federal IT circles treats quantum readiness primarily as an algorithmic problem. The logic dictates that updating systems with National Institute of Standards and Technology (NIST) approved algorithms will insulate networks from future compromise.
However, mathematical upgrades alone do not address architectural vulnerabilities. If a network continues to rely on centralized key storage, it retains a single point of failure. An adversary armed with a sophisticated social engineering exploit, does not need to break the post-quantum algorithm if they can compromise the central honeypot where the keys reside.
Consider the destroyer’s Gigabit Ethernet Data Multiplex System (GEDMS). This internal network connects more than 200 critical systems across each ship, linking essential operations from the throttle directly to the engine. Under a traditional centralized encryption model, a disruption at the key-management center would impact the entire vessel. For this reason, GEDMS has avoided encryption altogether.
True resilience requires shifting the architecture itself. In working with the Navy’s Program Executive Office (PEO) Ships to implement a decentralized key management solution, VIA demonstrated an alternative framework: private cryptographic keys are held exclusively by the individual endpoints sending and receiving data, eliminating centralized storage entirely. If individual nodes are permanently disrupted, the rest of the ecosystem continues to operate seamlessly. True quantum readiness is achieved not merely by upgrading the lock, but by decentralizing the vault.
2. De-Risking the Transition through Dual-Layer Hybrid Protocols
A second challenge in the rapid shift toward quantum readiness is the temptation to deploy “quantum-only” protections. Because these mathematical algorithms are relatively new to production environments, moving to them exclusively introduces a distinct operational risk. That is, it exposes data to unproven math while discarding the battle-tested classical infrastructure that currently wards off existing cyber threats.
The most logical path forward is a hybrid approach that elegantly nests classical and post-quantum standards simultaneously. By layering the two, data remains shielded by established classical mathematics even while navigating the transition to post-quantum defenses.
For real-time applications, there are legitimate operational latency concerns with a dual-layer approach, especially on assets like a destroyer where the baseline network latency is a mere 50 milliseconds and throttle-to-engine commands require near-instantaneous execution.
However, for mission-critical applications, such as getting data off a ship, this delay becomes immaterial. Navy ships collect up to 150 TB of data per day, per ship. This is, as the Navy likes to say, more than any other Department of War system. Securing that staggering volume of data, both for the present and the future, is critical. A hybrid approach accomplishes that.
3. Extending the Perimeter to the Wider Commercial Supply Chain
Finally, while Executive Order 14409 creates a robust roadmap for federal agencies, policy must account for the broader commercial ecosystem. State-sponsored cyber adversaries rarely focus exclusively on heavily fortified government data centers. Instead, they frequently look downstream to the thousands of suppliers, engineering firms, and enterprise vendors that comprise the Defense Industrial Base.
This interconnectedness is underscored by the reality of “Harvest Now, Decrypt Later.” Intellectual property within the supply chain often has an incredibly long shelf life. For instance, design specifications for Navy ships and submarines remain highly valuable across the entire multi-decade operating life of the vessels. If an adversary intercepts encrypted blueprints from a tier-two (or more likely tier-twenty-two) commercial supplier today, that data retains immense strategic utility whenever it is decrypted down the road.
To successfully secure the enterprise, cryptographic tools cannot remain the exclusive domain of specialized military hardware. They must be practical, non-disruptive, and easy for commercial suppliers to adopt.
Moving Forward Strategically
The U.S. government’s recent announcements have successfully catalyzed the conversation around post-quantum protection. The destination has been clearly marked. The task now is to focus on the vehicle.
