Microsoft has moved the deadline for full post-quantum cryptography implementation from 2030 to 2029. This is not a whim – it is a response to real threats that are already shaping the future of digital security. Will the industry manage to prepare before quantum computers break RSA?
In May 2026, Microsoft surprised the industry by announcing an accelerated schedule for implementing post-quantum cryptography. The new goal? Full migration by 2029 – one year earlier than planned. This decision is not driven by technological optimism, but by a growing awareness of threats that are already appearing on the horizon. Quantum computers, though still imperfect, are developing at a pace that is beginning to worry even the biggest market players.
Why did Microsoft change its plans?
Microsoft's official statement from May 2026 points to three key factors:
- Advances in quantum computing research: In 2025, IBM unveiled the Quantum System Two processor with 1121 qubits. Although millions of qubits are still needed to break RSA-2048, algorithm optimizations could significantly reduce this number. As MIT Technology Review notes, "it's not a question of if quantum computers will break current encryption, but when it will happen."
- "Harvest now, decrypt later" attacks: As early as 2024, the NSA warned against adversaries collecting encrypted data for future decryption. In 2025, Chinese hackers stole over 10 petabytes of data from American companies – this data could be decrypted in the future once quantum computers reach sufficient power.
- Legal regulations: In 2025, the European Union adopted the Quantum Cybersecurity Act, requiring companies to conduct quantum risk assessments by 2028. Similar regulations have been introduced in the USA, where the NSA requires government agencies to migrate by 2030.
"We cannot wait until quantum computers become a real threat. Migration must begin now to avoid chaos in 2030."
Microsoft is not acting in a vacuum. Other tech giants are taking similar steps:
- Google: Since 2025, Chrome has supported TLS with the Kyber algorithm, with plans for full migration by 2030.
- IBM: In 2026, it introduced Quantum Safe Cryptography for enterprise clients, with a migration schedule set for 2032.
- AWS: Since 2024, it has offered AWS KMS with a post-quantum option, planning full migration by 2030.
What post-quantum solutions is Microsoft implementing?
Microsoft is focusing on algorithms approved by NIST in 2022 (final standards were published in 2024):
- CRYSTALS-Kyber: Public-key cryptography, already being deployed in Azure since 2025.
- CRYSTALS-Dilithium: Digital signatures, tested in Office 365 since 2026.
- SPHINCS+: A backup digital signature algorithm.
In practice, this means:
- Azure: Since 2025, cloud services have offered optional support for TLS 1.3 with Kyber.
- Windows 12: Built-in support for post-quantum algorithms in BitLocker and Windows Hello is planned for 2027.
- Office 365: Post-quantum encryption tests for email began in 2026.
- Developer tools: The Microsoft Quantum Development Kit (QDK) and Azure Key Vault have supported post-quantum keys since 2026.
This is an ambitious plan, but it comes with serious challenges.
Migration challenges: Will the industry make it in time?
Accelerating Microsoft's schedule is not just a matter of technology, but also organization. Migration to post-quantum cryptography faces several key issues:
1. Performance and compatibility
Post-quantum algorithms are significantly slower than current standards. According to Cloudflare tests from 2024, Kyber is 2-10 times slower than RSA. This could impact system performance, especially for older IoT devices that will not be able to handle the new algorithms.
Backward compatibility is also a problem. As the IETF notes, migration requires replacing billions of keys in global infrastructure. Not all systems will be able to do this without disruption.
2. Key management
Replacing cryptographic keys on a global scale is a logistical nightmare. As Gartner estimates, keys in hundreds of millions of devices will need to be replaced by 2029. Microsoft is collaborating with other companies as part of the Post-Quantum Cryptography Alliance, but the pace of work may prove insufficient.
3. Costs and resources
Migration is not just a technical issue, but a financial one as well. Companies must invest in new solutions, training, and security audits. For smaller enterprises, this may be an insurmountable barrier.
Are quantum computers already a threat?
In 2026, quantum computers are still unable to break current cryptographic standards. The most powerful processors, such as the IBM Quantum Heron (133 qubits, 2026), are far from the required power. According to NIST, about 20 million qubits are needed to break RSA-2048 – though this number may decrease due to algorithm optimizations.
The real threat, however, does not lie in the current capabilities of quantum computers, but in future-oriented attacks. The "harvest now, decrypt later" strategy means that data encrypted today can be decrypted in the future once quantum computers reach sufficient power. That is why migration must begin now.
What risks do companies face if they don't make it in time?
Delaying migration can have serious consequences:
- Critical infrastructure: Banking, energy, healthcare – these systems are most vulnerable to quantum attacks. In 2026, the World Economic Forum warned that without proper preparation, quantum attacks could paralyze the global economy.
- Long-term data: Medical records, trade secrets, government archives – this information must be protected for decades. If not encrypted with post-quantum algorithms, it could be decrypted in the future.
- Legal regulations: Companies that fail to comply with new regulations may face penalties. In the EU, the Quantum Cybersecurity Act mandates risk assessments by 2028, and in the US, the NSA requires government agencies to migrate by 2030.
Microsoft is aware of these threats, which is why it is accelerating its work. But will the rest of the industry follow its lead?
Summary: A race against time
The acceleration of Microsoft's schedule is a signal to the entire industry: the post-quantum era is arriving faster than we expected. Although quantum computers are still unable to break current standards, the threat is real and requires immediate action.
Migration to post-quantum cryptography is not just a matter of technology, but also of organization, costs, and time. Microsoft has set an ambitious goal – full implementation by 2029. Will other companies manage to keep up? And what about end-users who may not be aware of the threats?
One thing is certain: digital security is entering a new era, and the race against time has already begun.
If you are interested in data security, also read our post on flaws in end-to-end encryption in 2026 or learn why blind trust in corporate AI is a mistake.
Sources
- https://sekurak.pl/juz-nie-rok-2030-microsoft-przyspiesza-prace-nad-wdrazaniem-rozwiazan-postkwantowych-nowym-punktem-granicznym-jest-2029-r/
- https://www.ibm.com/quantum
- https://www.nsa.gov/
- https://digital-strategy.ec.europa.eu/
- https://www.technologyreview.com/
- https://azure.microsoft.com/
- https://www.microsoft.com/security/blog/
- https://www.microsoft.com/microsoft-365/roadmap
- https://github.com/microsoft/Quantum
- https://azure.microsoft.com/updates/
- https://csrc.nist.gov/
- https://www.nature.com/
- https://www.scmp.com/
Comments