The Clock That Cannot Be Paused: Why 2026 Is the Year to Act
The post-quantum cryptography transition has been described for years as a future problem. In 2026, it is a present procurement and engineering problem. NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024 — completing a process that began in 2016 with 82 submissions from researchers in 25 countries. These are now the standards. The evaluation period is over.
The NSA’s CNSA 2.0 (Commercial National Security Algorithm Suite 2.0) framework sets binding deadlines for US national security systems: quantum-safe algorithms must be used in all new national security systems by January 2027, with full application migration by 2030 and complete infrastructure migration by 2035. France’s ANSSI has announced that from 2027, it will not accept products for its security certification visa that do not incorporate post-quantum cryptography — directly affecting vendors that sell to Algerian government agencies procuring from France.
The threat driving urgency is not theoretical quantum computers breaking encryption today. It is “harvest now, decrypt later” (HNDL) attacks: adversaries capturing encrypted traffic now to decrypt it when quantum computing matures. Boston Consulting Group warned that “starting in 2030 will already be too late” for data that needs to remain confidential through 2035 or beyond. For Algerian government communications, banking transaction records, and telecommunications backbone traffic, that 10-year confidentiality horizon is entirely realistic.
Algeria’s Specific Exposure: RSA in Banking, TLS Everywhere
Algeria’s banking sector — Sonatrach, CPA, BEA, BNA, BADR, and the growing digital banking layer — relies on TLS 1.2 and 1.3 with RSA or ECDH key exchange for transaction security. These algorithms are not quantum-safe. Every bank-to-bank transfer, every customer API call, every inter-branch VPN tunnel that uses classical cryptography is a potential HNDL collection target.
Algerie Telecom and private operators (Mobilis, Ooredoo, Djezzy) operate backbone infrastructure secured with classical cryptographic protocols. The BGP routing infrastructure, MPLS backbones, and interconnects with international carriers are all secured using algorithms that CNSA 2.0 classifies as vulnerable. Government agencies using PKI-based document signing — the Digital Transformation Ministry’s e-signature infrastructure, notarial systems, and judicial document workflows — face the same exposure.
The engineering challenge is not simply swapping an algorithm. Meta published its PQC migration framework in April 2026, describing the process as a six-step multi-year effort: prioritize applications by HNDL risk, run a cryptographic inventory using automated discovery tools, address external dependencies (hardware HSMs, standards bodies, legacy systems), design hybrid implementations (classical + PQC in parallel), implement guardrails against new vulnerable key generation, and finally deploy. Meta recommends ML-KEM768 (NIST Level 3 security) for key exchange and ML-DSA65 for digital signatures.
Advertisement
What Algerian Organizations Must Do Now
1. Run a Cryptographic Inventory Before Year-End 2026
You cannot migrate what you cannot find. The first step for any Algerian bank, telecom, or government IT directorate is a full cryptographic inventory: which applications, services, APIs, VPNs, and infrastructure components use RSA or ECDH, at what key lengths, and in what configurations.
Meta’s approach used automated discovery tools combined with developer-reported inventory. For Algerian organizations without dedicated cryptographic tooling, a practical starting point is scanning TLS certificates on public-facing services using tools like SSL Labs or Qualys SSL — this surfaces key exchange algorithms immediately. For internal services, network traffic analysis tools can identify RSA/ECDH handshakes at the packet level.
The output should be a prioritized list segmented by HNDL risk: Tier 1 (data that must remain confidential for 10+ years — government secrets, long-term financial records), Tier 2 (data with 5-10 year confidentiality requirements — banking transactions, health records), Tier 3 (data with less than 5-year requirements — standard web traffic).
2. Adopt a Hybrid Cryptography Approach for New Deployments Starting Now
Any new TLS certificate, VPN configuration, or API gateway deployed today should use a hybrid approach: classical ECDH combined with ML-KEM in a dual-encapsulation scheme. This is the pattern Meta uses internally, and it is what ANSSI’s three-phase roadmap calls “hybridization for additional defense-in-depth.”
The practical implication: when Algerian organizations procure new firewalls, load balancers, HSMs, or TLS-terminating infrastructure in 2026-2027, they must include “ML-KEM/ML-DSA support” as a procurement requirement. Vendors that do not support PQC algorithms by 2027 will be selling products that cannot meet CNSA 2.0 or ANSSI certification requirements. Hardware HSMs are particularly critical here — they have 5-7 year replacement cycles, meaning HSMs purchased in 2026 need PQC support baked in.
3. Brief Leadership on the 2030 Migration Deadline as a Capital Project
Post-quantum migration is not a software update — it is a multi-year capital project. The global market for PQC migration is projected to exceed $15 billion by 2030, with enterprises budgeting 2-5% of annual IT security spend over four years for the transition. For a large Algerian bank or telecom with a $10-15 million annual IT security budget, that means $200,000–750,000 per year allocated to PQC migration over the next four years.
The governance conversation must happen at board level, not just IT. The risk of not migrating is HNDL exposure on current and historical traffic. The risk of delaying migration past 2028 is vendor lock-in: procurement cycles for banking core systems, telecom network equipment, and government IT run 3-5 years, meaning decisions made in 2026-2027 will determine whether 2030 migration targets are achievable.
Where Algeria Fits in the Regional Migration Picture
No specific DZ-CERT advisory on PQC migration has been published as of May 2026. This places Algeria behind peers: Singapore’s Cyber Security Agency published PQC migration guidance in 2024, the UK’s NCSC issued a detailed roadmap in 2025, and ANSSI (France) has issued sector-specific requirements with hard 2027 deadlines.
The absence of a national PQC migration mandate does not reduce Algeria’s exposure — it reduces coordinated response. Banks and telecoms should not wait for a national mandate before beginning their cryptographic inventories. The NSA and ANSSI deadlines create a market reality: by 2027-2028, counterparties in international finance and government procurement will require quantum-safe cryptography in connection parameters. Algerian institutions that are unprepared will face connectivity or compliance issues at the network layer.
DZ-CERT and ANSSI (the Algerian national cybersecurity authority, distinct from France’s ANSSI) should consider publishing a national PQC migration roadmap by Q4 2026, aligned with the NIST standards and using the NSA CNSA 2.0 deadlines as a reference framework. This would give Algerian enterprises a clear regulatory anchor for their migration planning — the same clarity that UK NCSC guidance has provided for British organizations.
The private sector should not wait. Algerian banks that clear international transactions, telecoms that interconnect with European carriers, and government agencies engaged in bilateral digital cooperation with France or the EU will face interoperability pressure as counterparties enforce quantum-safe connection requirements. The organizations that complete their cryptographic inventories in 2026 will be positioned to respond to that pressure through a planned migration; those that wait until the pressure arrives will face emergency procurement under vendor lock-in conditions.
Frequently Asked Questions
When will quantum computers actually be able to break RSA encryption?
Most expert estimates place “cryptographically relevant quantum computers” (CRQCs) in the 2030-2035 window, with some assessments pushing to 2040. However, the threat is not only about when CRQCs arrive — it is about “harvest now, decrypt later” attacks where adversaries collect encrypted traffic today. Data captured in 2026 with a 10-year confidentiality requirement (government secrets, long-term financial records) could be decrypted by a CRQC in 2035. The migration timeline needs to account for data longevity, not just the quantum computer arrival date.
What is the practical difference between ML-KEM, ML-DSA, and SLH-DSA?
These are the three NIST-standardized post-quantum algorithms. ML-KEM (FIPS 203) replaces RSA and ECDH for key encapsulation — it secures the key exchange step in TLS and VPN connections. ML-DSA (FIPS 204) replaces RSA and ECDSA for digital signatures — it secures document signing, code signing, and certificate authentication. SLH-DSA (FIPS 205) is a hash-based signature alternative to ML-DSA, providing mathematical diversity. For most Algerian organizations, ML-KEM for key exchange and ML-DSA for signatures covers the highest-priority migration targets.
Does adopting PQC algorithms require replacing all existing hardware?
Not necessarily, but hardware HSMs deserve special attention. Software-only implementations of ML-KEM and ML-DSA can run on existing servers — OpenSSL 3.5 and BoringSSL (used by Google Chrome) already include ML-KEM support. However, hardware security modules (HSMs) used for key management in banking and PKI infrastructure typically require firmware updates or hardware replacement to support PQC algorithms. Since HSMs have 5-7 year replacement cycles, those purchased in 2026 should include PQC support as a mandatory specification.
—
Sources & Further Reading
- NIST Post-Quantum Cryptography Standards FIPS 203/204/205 — NIST CSRC
- Post-Quantum Cryptography Migration at Meta: Framework, Lessons and Takeaways — Meta Engineering
- The $15 Billion Post-Quantum Migration — PR Newswire
- Post-Quantum Cryptography Migration Guide 2026 — Security Boulevard
- Post-Quantum Cryptography: 2026 Government Deadlines — AlgeriaTech
- ISACA Journal: Post Quantum Cryptography Migration 2026 — ISACA
