President Trump signed an executive order requiring federal agencies to replace classical cryptography before quantum computers can break it.
Executive Order 14409, signed June 22, 2026, sets a December 31, 2030, deadline for federal High Value Assets and high-impact systems to adopt post-quantum encryption, and a December 31, 2031, deadline for post-quantum authentication. Federal contractors must also comply with post-quantum FIPS standards by end of 2030. The split reflects a real technical distinction: encryption needs to move first to stop "harvest now, decrypt later" attacks, where adversaries stockpile today's encrypted traffic and crack it once quantum hardware arrives. Authentication only becomes critical once a cryptographically-relevant quantum computer actually exists.
The two-phase structure matters because authentication is the harder migration. Post-quantum digital signatures are larger than classical ones, the dependency chain runs through certificate authorities, root stores, and browsers, and ecosystem deployment has barely started. Cloudflare, one of the earliest adopters, already protects over two-thirds of its browser traffic with post-quantum encryption — and it still set its own full-readiness target at 2029, a year ahead of the federal deadline.
The one-year gap between the two deadlines sounds generous until you account for how slowly cryptographic standards move across the entire internet stack. The fact that the government picked 2031 for authentication is itself a signal: policymakers believe there is a real chance a capable quantum computer could be operational around that time, which is not the kind of deadline you want to miss by six months.