Quantum computing and the future of encryption

Quantum computers use qubits to create correlations unavailable to conventional chips, allowing certain mathematical problems to be solved far faster. This does not mean every digital security control falls at once: the direct risk comes from the mathematics behind public-key encryption and from the prospect of attackers storing encrypted traffic for later analysis.

For Australian organisations, the issue is already relevant to long-lived cloud data and hybrid infrastructure. Many businesses in Sydney, Melbourne and Canberra combine on-premises systems with Microsoft, AWS or Google workloads, while local security teams commonly use the term pentest for penetration testing. Boards need measured exposure, not predictions that overstate quantum timelines.

Why current encryption is at risk

Shor’s algorithm could allow a sufficiently large fault-tolerant quantum computer to solve the integer factorisation and discrete logarithm problems underpinning RSA, Diffie–Hellman and elliptic-curve cryptography. That would endanger key exchange, digital signatures and certificate-based authentication used by VPNs, web services and software updates. It is principally public-key cryptography that is in the direct line of fire.

The useful distinction is between present capability and future capability. Today’s encryption is not being broken in bulk by current quantum hardware, and no reliable public timetable identifies when a cryptographically relevant machine will arrive. Attackers can, however, collect encrypted data now and attempt decryption later, making data retention, inventory and cryptographic agility business concerns today rather than speculative science.

The harvest-now-decrypt-later scenario

Harvest-now-decrypt-later activity starts when an attacker records encrypted network traffic or steals encrypted files and databases, then keeps them until more capable computing becomes available. The underlying information may include trade secrets, health information, government records, customer communications or intellectual property. Long retention periods can therefore convert a future decryption possibility into a present data-protection problem.

Preparation does not require replacing every system immediately. It requires knowing where sensitive information lives, which algorithms protect it and how quickly each service could change. A current quantum risk snapshot can help structure that conversation, while inventories should also record certificate authorities, key-management systems, hardware modules, software dependencies and third-party access.

Why the exposure differs across Australia

Australian financial institutions, healthcare providers, retailers and government agencies hold records that can remain sensitive for years or decades. Cloud adoption in Sydney and Melbourne has increased that exposure, particularly where data is replicated across regions or copied into backups and analytics platforms. Weak identity controls, storage permissions or a recovery service can matter more than a theoretical weakness in an isolated on-premises server.

Regulatory drivers make the planning more concrete. The Australian Signals Directorate and Australian Cyber Security Centre publish post-quantum guidance, while APRA’s CPS 234 requires regulated financial institutions to manage information-security risk and protect against cyber threats. The Privacy Act and Australian Privacy Principles add another reason to limit unnecessary exposure. Many Australian teams align remediation to the Essential Eight, and local pentest reports should show cryptographic dependencies rather than treating encryption as a single line item.

What remains secure and what must change

Not all cryptography is equally affected. Grover’s algorithm provides a quadratic speed-up for unstructured search, so a sufficiently powerful quantum adversary would reduce the effective security of symmetric algorithms; AES-256 is generally expected to remain robust, with far greater practical overhead than attacks on RSA or elliptic curves. Quantum improvements to hash collisions matter too, but modern SHA-384 and SHA-512 sizes retain a substantial margin.

The migration target is post-quantum cryptography, not simply larger classical keys. NIST has standardised ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures, giving organisations a foundation for pilots. Adoption will be gradual because devices, protocols, libraries and vendor products must interoperate, and because hybrid classical-plus-quantum exchanges can add bandwidth and complexity. Cryptographic agility lets teams replace vulnerable primitives without rebuilding an entire platform each time.

Controls Australian teams can use now

The first control is visibility. The second is a staged route from discovery to pilot testing and remediation.

Immediate priorities include the following:

• Inventory public-facing TLS, VPNs, SSH endpoints, certificates, code signing and firmware keys.
• Map sensitive data across cloud, on-premises, mobile and third-party systems.
• Review key lifetimes, revocation processes, legacy protocols and privileged access.
• Test how quickly compromised keys and certificates can be replaced.

The longer programme should connect technical inventories to accountable owners:

• Assign owners and target dates for each cryptographic dependency.
• Pilot ML-KEM and ML-DSA through supported products and controlled integrations.
• Measure handshake size, latency, certificate size and rollback behaviour.
• Add quantum-readiness criteria to procurement and board risk reporting.

Hybrid environments need cloud-specific prioritisation, especially where the guidance on prioritising cloud findings explains why strong on-premises controls cannot offset weak cloud identities, storage or key management. Each business case should show which quantum-exposed assets justify early action, rather than treating every encrypted endpoint as equally urgent.

Move from planning to verified action

Infoziant Security helps Australian organisations map cryptographic exposure through vulnerability assessment, penetration testing, cloud and mobile security reviews, infrastructure audits and compliance support. Its 24/7 SIEM monitoring and threat-intelligence services can track exposed services, key misuse and suspicious access, while a cryptographic readiness review can turn scattered inventories into a ranked remediation plan with owners, dependencies and test dates.

Start with a 30-day discovery sprint covering internet-facing assets, privileged cloud identities, long-retained data and critical third parties. Contact Infoziant Security to commission that assessment, require a cryptography register and validated proof-of-concept for priority systems, and include quantum migration milestones in the next board security report.