V. The 2030 Deadline Almost Nobody Is Ready For

Some of our data already isn't safe — and most organisations are still(/neither) at the strategy stage

Magyarul: A 2030-as határidő, amire kevesen készülnek

A series on the future of digital payment, part 5

There is a kind of disaster you have to fix before you can see it. By the time it's visible it has already happened, years earlier, quietly.

The quantum threat is exactly that kind. And it splits people into two camps straight away. One says quantum computers are science fiction, decades off, there's time. The other, which includes Apple, Signal, Google and Cloudflare, has already moved its users' encryption to quantum-resistant algorithms. Several hundred million people's worth.

One of those camps is wrong. The only question is which one.

In the last part I introduced the digital banknote, Qashmore, and the Pactena Protocol behind it. This part is about what happens to all of today's encryption over the coming decade, and why that protocol had to be designed from the start so the question wouldn't catch it out.

Two clocks are running

To see this properly you have to watch two clocks at once.

The first measures how long we have until a quantum computer strong enough to break today's encryption exists. Nobody knows precisely, but the estimates are narrowing, and they keep pointing earlier.

The second measures how long the data you encrypt today has to stay secret. A bank transaction is sensitive for a few years. A medical record for decades. A state secret, a diplomatic cable, a patent file: often twenty or thirty years, sometimes longer.

If the second clock runs longer than the first, that is, if your data has to stay secret for longer than the time remaining until a quantum computer, then that data is already unsafe. Even though the quantum computer hasn't been built yet.

This is what "harvest now, decrypt later" means, and the logic is unsparingly simple. The attacker, typically a nation state's intelligence service, is recording and storing encrypted traffic today. They can't read it now. That doesn't bother them. They store it and wait. Once they have a machine strong enough, they decrypt the lot, retroactively, going back years.

What you send encrypted today, an attacker captures today and reads in a few years' time. A diplomatic cable intercepted in 2024 can still shape geopolitics in 2035. That isn't a conspiracy theory, it's how intelligence work has always operated.

What is actually at risk?

Much of the internet's security rests on the difficulty of a handful of mathematical problems. That factoring a large number into primes is slow. That certain operations are effectively impossible to reverse. RSA, Diffie–Hellman and elliptic-curve cryptography are built on those, which means everything behind the padlock in your browser, your bank connection and digital signatures.

In 1994 Peter Shor showed an algorithm that solves those problems on a sufficiently powerful quantum computer not slowly but quickly. Not somewhat faster. Orders of magnitude faster. What would take a classical machine lifetimes, a machine like that would finish in hours, even minutes.

So we've known for more than thirty years what will break our encryption. There just hasn't been anything to run the algorithm on.

How much time is actually left

In December 2024 Google unveiled a quantum chip called Willow. The headline number isn't the point; the result that got almost no publicity is. Willow showed that as you add more qubits to the system, the error rate goes down rather than up. For years that was considered the biggest obstacle: the fear was that a bigger machine would inevitably be a noisier one. It turns out that obstacle can be broken through.

The estimates are shrinking too, and fairly fast. In 2019 the field held that breaking a 2048-bit RSA key would need something like twenty million qubits. In May 2025 the same researcher, Craig Gidney, published a new calculation that brought it under one million, with better error correction and a smarter algorithm, on the same task. A twentyfold reduction in five years. Even a million is a lot next to today's machines, but the finish line is clearly not standing still. It's coming closer.

Nobody can name the date. It could be 2029, it could be 2035. But "exactly when" is the wrong question. The right one is whether the time the migration needs fits inside the time that's left.

What the European Union actually says

Let's be precise here, because a lot of imprecision circulates on this point.

In August 2024 the US standards body NIST finalised the first quantum-resistant encryption standards at the end of an eight-year process. On the EU side, a Commission Recommendation came in April 2024, followed in June 2025 by a coordinated implementation roadmap from the NIS Cooperation Group. That roadmap contains two dates. One: every Member State should begin the transition before the end of 2026. The other: critical infrastructure should become quantum-resistant as soon as possible, and no later than the end of 2030.

Formally this is a roadmap and a recommendation, not a regulation. Not yet. Anyone who concludes from that that there's time has misread the situation. NIS2 and DORA are binding, and both require "state of the art" technical measures. What counts as the state of the art is defined by precisely these roadmaps. When a supervisor asks in 2029 why the migration never started, the legal status of a recommendation won't interest anybody.

The problem is that most organisations are still at the strategy stage, or not even that far. Migration plans exist on paper; in many places implementation hasn't begun.

And replacing cryptography in a large system isn't a switch you flip. You have to map where you use encryption at all. The surprise is usually that it's in far more places than you thought, often in systems whose source code is long gone. Protocols, libraries and hardware have to be replaced. Tested. All of it while the system keeps running.

That's why I say the 2030 deadline is really a 2026 task. And that isn't my invention: it's exactly what the EU roadmap's first milestone says.

Who has already moved

If you want to know how serious a threat is, don't look at who talks about it. Look at who is spending money on it, away from the spotlight.

In early 2024 Apple shipped the largest cryptographic upgrade in iMessage's history, under the name PQ3. It didn't simply add a quantum-resistant layer; it redesigned the protocol so that keys rotate continuously, limiting how much can be read out of breaking any single key. Apple's stated reasoning was, word for word, the harvest-now-decrypt-later logic.

A year earlier Signal, the messenger the profession respects most, was first to deploy its own quantum-resistant handshake at scale. Google and Cloudflare built the same thing into web traffic encryption, in hybrid mode: the old and the new algorithm running together.

These aren't startups jumping on the next trend. The largest and most conservative technology companies in the world are rebuilding the encryption of hundreds of millions of users against a threat that sceptics say doesn't exist yet. They aren't doing it because they have spare time. They're doing it because they understand the two-clock logic exactly.

Don't build the wall, build the door

There's a deeper architectural lesson here, and I think it's the most important sentence in this article.

The naive reaction is to swap today's algorithm for the new quantum-resistant one and call it done. But how do we know the new algorithm will be secure forever? We don't. The history of cryptography is a graveyard of algorithms: what is strong today may turn out to be weak tomorrow.

So the right answer isn't a particular algorithm but a capability: cryptographic agility. Designing the system from the outset so the algorithm can be swapped, like a battery in a device, without rebuilding the whole thing. Putting up a wall and hoping it stands forever is more comfortable. Building a door whose lock can be changed is much harder, and close to impossible to retrofit.

Where my own work stands

This is where the earlier parts of the series meet the deadline.

The key system from part three, NPVDKGRS, runs in production today inside a regulated European institution, at a MiCA crypto-asset service provider under the licence and supervision of Latvijas Banka. It has a lattice-based, quantum-resistant variant I've been working on for years. The mathematics is done: the algorithmic construction fits the lattice-based direction NIST standardised. The next step is building it, roughly eighteen months of work, and it has somewhere to start from, because it starts from the existing production system.

The same holds for the Pactena Protocol, the digital banknote protocol from the last part. The architecture is built on cryptographic agility from the ground up: it isn't tied to a single algorithm, and the move to the quantum-resistant variant is designed in.

That isn't luck, and it isn't foresight either. When I started seven years ago it was already obvious that payment infrastructure has to think in decades, and if it's any good, on the scale of a century. A system an entire country uses can't be rewritten every five years.

The question to ask today

The quantum threat is insidious because every instinct we have works against it. We're tuned to react to visible, nearby danger. This danger is invisible and apparently distant. Except that by the time it becomes visible, the data has been sitting in someone else's warehouse for years, waiting to be decrypted.

The solution exists, the standards are ready, the technology works. What's missing isn't knowledge. It's the recognition that the deadline isn't somewhere in the future.

Because the quantum turn has a property most people overlook. It doesn't begin when the first quantum machine breaks the first key. It began when the first attacker started collecting encrypted data to read later. Which is not the future.

The next part is about a more everyday question that runs just as deep: why do you have to hand over your entire identity document today in order to prove that you're over eighteen? About the principle of showing only as much as is needed, and what that has to do with the digital banknote and with the European digital identity going live in December 2026.

This is part 5 of a series. New parts on Sundays and Wednesdays.

The full series: The Future of Digital Payment

András Szabolcsi — cryptographer, software architect, financial IT specialist; designer of the Pactena Protocol. Twenty years on the border between financial systems and applied cryptography.