The development of quantum computers is no longer an academic curiosity. For public administration, the military, and organizations responsible for national security, it has become a concrete vector of strategic risk that forces a fundamental shift in the approach to cryptography. The latest actions of the Department of Defense (Department of War) confirm that the era of algorithms based solely on factorization and discrete logarithms is coming to an end.
The US Department of Defense has initiated a comprehensive review of cryptography used across all its systems, with the goal of preparing IT and communications infrastructure for migration to quantum-resistant cryptography (Post-Quantum Cryptography, PQC). This is one of the most significant signals for the IT security market in years.

Quantum threat is real – why is the US acting now?

The core issue is not the mere existence of quantum computers, but their asymmetric advantage over classical cryptographic algorithms. Shor’s algorithm, theoretically known since the 1990s, enables:

• prime factorization in polynomial time,
• breaking RSA, DSA, and ECDSA,
• compromising ECDH and DH key exchange.

This means that most modern PKI, TLS, VPN, S/MIME, code signing infrastructures, and machine authentication mechanisms will eventually become cryptographically unreliable. The US Department of Defense does not assume that quantum attacks are an immediate threat. The key concern is a different phenomenon: harvest now, decrypt later – intercepting encrypted data today in order to decrypt it in the future, once sufficiently powerful quantum computers become available. For the military, diplomacy, and critical infrastructure, this means that data encrypted today may be disclosed in 10 to 15 years, even though it was formally considered secure at the time of transmission.

CIO DoD Memorandum – cryptography as a strategic asset.

In response to this threat, the DoD Chief Information Officer published the memorandum “Preparing for Migration to Post-Quantum Cryptography”, which formally initiates the largest cryptographic audit in the history of the US administration.
The document imposes the following obligations on all DoD components:

• full inventory of cryptography used in systems,
• identification of algorithms vulnerable to quantum attacks,
• development of migration plans to PQC,
• implementation of crypto-agility principles,
• centralized progress reporting.

Importantly, the memorandum does not apply exclusively to strictly military systems. It covers:

• NSS and non-NSS systems,
• cloud infrastructure,
• IoT and OT environments,
• legacy systems,
• commercial solutions used by the military.

This is a clear signal: PQC will not be a niche solution but the new standard of government cryptography.

The role of NIST and global PQC standardization.

A key element of the entire US strategy is the strict reliance on standards published by the National Institute of Standards and Technology. After a multi-year selection process, NIST approved the first post-quantum algorithms that will form the foundation of future systems:

• CRYSTALS-Kyber for key exchange,
• CRYSTALS-Dilithium for digital signatures,
• FALCON for high-performance signatures,
• SPHINCS+ for hash-based signatures with high security levels.

The US Department of Defense clearly states that all new systems will be designed using NIST-approved algorithms, and existing systems must be adapted accordingly.

Crypto-agility – the most important lesson for the market.

One of the most frequently repeated concepts in DoD documents is crypto-agility. This is an architectural principle that assumes:

• cryptographic algorithms are not hardcoded permanently,
• their replacement does not require rebuilding the entire system,
• cryptographic parameters can be changed quickly and in a controlled manner.

In practice, this means designing systems where:

• TLS supports multiple key exchange groups,
• PKI allows changing signature algorithms,
• X.509 certificates are prepared for new OIDs,
• applications do not assume a single fixed algorithm.

For the commercial sector, this is the most important conclusion from DoD actions. Organizations that do not consider crypto-agility today will face costly and chaotic migrations in the future.

The impact of PQC on TLS, PKI, and SSL certificates.

Migration to post-quantum cryptography is not a simple algorithm swap. In the context of HTTPS and SSL certificates, it implies deep architectural changes:

• the TLS handshake must support hybrid key exchanges such as ECDHE plus Kyber,
• certificates must account for post-quantum signature algorithms,
• key and signature sizes increase significantly,
• network performance and traffic characteristics change.

The US Department of Defense assumes a long transition period during which hybrid solutions will be used. This approach is already being tested by major market players, including browser vendors and CDN infrastructure providers.

What do these decisions mean for companies and IT administrators?

Although DoD actions concern US administration, their consequences are global. In practice, this means that:

• software vendors will require PQC compliance,
• new TLS standards will be adopted by browsers,
• certificate authorities will begin offering post-quantum certificates,
• security audits will include quantum resistance.

For companies, this means the need to:

• start cryptographic audits immediately,
• identify systems that are critical in the long term,
• update security policies,
• select vendors prepared for the PQC era.

A signal that cannot be ignored.

The decision of the US Department of Defense is not a reaction to media hype. It is a strategic move based on realistic technological forecasts. Migration to post-quantum cryptography is a multi-year, costly, and complex process, which is why it begins now and not at the moment the first commercial quantum computer appears. For the IT security market, this is a clear message: classical cryptography is no longer sufficient in the long-term perspective.
Organizations that treat PQC today as a future problem may face emergency migration tomorrow. Those that start preparing now will gain technological, regulatory, and business advantages.