QUANTUM COMPUTERS AND ENCRYPTION Preparing for Q-Day: From Shor's Algorithm to the NIST Post-Quantum Standards, from the 'Harvest Now, Decrypt Later' Threat to Türkiye's Quantum Strategy Review Article Keywords: Quantum Computer • Post-Quantum Cryptography • Shor • NIST FIPS 203/204/205 • HNDL • ML-KEM • Q-Day ABSTRACT Quantum computers, with their capacity to process through superposition, entanglement and quantum interference problems that classical computers struggle or fail to solve, pose an existential threat to the cryptographic infrastructure of the digital age. The algorithm Peter Shor developed in 1994 theoretically defines quantum circuits able to solve the problem of factoring large numbers into primes — the mathematical foundation of today's RSA encryption — in polynomial time. Google's Willow chip, announced at the end of 2024, established the feasibility of large-scale fault-tolerant quantum computing by proving that error rates fall exponentially as qubit counts rise — that the error threshold has been crossed. In August 2024 NIST published the post-quantum cryptography standards FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA), the product of an eight-year standardisation process. This review article addresses comprehensively the fundamental principles of quantum information processing, the cryptographic effects of the Shor and Grover algorithms, the 'Harvest Now Decrypt Later' (HNDL) threat model, the NIST PQC standards and lattice-based cryptography, the transition process for critical infrastructure, Türkiye's quantum strategy, and the measures organisations must take against this threat.
Keywords: quantum computer, post-quantum cryptography, Shor's algorithm, Grover's algorithm, NIST FIPS 203, FIPS 204, FIPS 205, ML-KEM, ML-DSA, SLH-DSA, CRYSTALS-Kyber, CRYSTALS-Dilithium, lattice-based cryptography, HNDL, Q-Day, crypto-agility, Türkiye quantum strategy, TÜBİTAK BİLGEM ABSTRACT Quantum computers pose an existential threat to the cryptographic infrastructure of the digital age, with the capacity to process problems that classical computers struggle or fail to solve through superposition, entanglement, and quantum interference principles. The algorithm developed by Peter Shor in 1994 theoretically defines quantum circuits that can solve the problem of factoring large numbers into prime factors — the mathematical foundation of modern RSA encryption — in polynomial time. Google's Willow chip announced at the end of 2024 registered the feasibility of large-scale faulttolerant quantum computing by demonstrating that error rates decrease exponentially as qubit counts increase. NIST published the post-quantum cryptography standards FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024, the product of an eight-year standardization process. This review article comprehensively addresses the fundamental principles of quantum information processing, the cryptographic impacts of Shor and Grover algorithms, the Harvest Now Decrypt Later (HNDL) threat model, NIST PQC standards and lattice-based cryptography, the transition process for critical infrastructures, Turkey's quantum strategy, and the measures organizations should take against this threat.
Keywords: quantum computing, post-quantum cryptography, Shor algorithm, Grover algorithm, NIST FIPS 203, FIPS 204, FIPS 205, ML-KEM, ML-DSA, SLH-DSA, lattice-based cryptography, HNDL, Q-Day, crypto-agility, Turkey quantum strategy, TÜBİTAK BİLGEM 1. Introduction In 1994 the mathematician Peter Shor defined a quantum algorithm able to solve the problems of factoring large integers into primes and computing discrete logarithms in polynomial time. At the time that discovery was largely theoretical, because no quantum hardware existed that could run Shor's algorithm. Thirty years later, in 2024, the picture is changing fundamentally: Google's 105-qubit Willow chip has proved that the error rate falls exponentially as qubit count rises — that the 'error threshold has been crossed'. According to the assessment of Techvorta.com (2026), this development is 'the breaking point that fundamentally changes the quantum computing journey.' The urgency of the quantum threat is not merely a future risk; the 'Harvest Now, Decrypt Later' (HNDL) strategy brings the threat into the present. As Jena's (2025) work in the European Journal of Computer Science and Information Technology states: 'The HNDL threat model reveals the fact that adversaries exfiltrate long-lived encrypted data today, anticipating that it will be decrypted by quantum means in future.' This type of attack has already begun today, even though quantum computers are not yet sufficient to break RSA.
NIST's response took shape through an eight-year international standardisation process running from 2016 to 2024. The FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) standards published in August 2024 form the basic building blocks of post-quantum cryptography. Those standards will remain the only valid transition target for quantum-vulnerable algorithms such as RSA, ECDSA and Diffie-Hellman up to 2035 (NIST IR 8547, 2024).
The aim of this article is to examine comprehensively the foundations of quantum information processing, the threat to existing cryptographic systems, the NIST standards and lattice-based cryptography, the HNDL risk model, critical infrastructure transition processes, Türkiye's quantum initiative and practical recommendations for institutional preparation. The article is written from a digital forensics and information security perspective and assesses legal, technical and institutional dimensions together. 2. The Foundations of Quantum Information Processing 2.1 From the Classical Bit to the Qubit Classical computers process information through a binary system: each bit takes the value either 0 or 1. Quantum computers work on qubits, using three fundamental principles of quantum mechanics. These principles offer a fundamentally different computational capacity. Superposition: a qubit can exist in a mathematical superposition of the states 0 and 1 until a measurement is made. One can think of this as a coin being both heads and tails after it has been tossed but before it is looked at. A system of n qubits can represent 2^n different states at once, providing an advantage in parallelism incomparable with a classical computer.
Entanglement: correlations that cannot be explained by classical physics can be established between two or more qubits. Measuring one entangled qubit determines the state of the other instantly — independently of the distance between them. This property forms the critical infrastructure for secure communication in quantum networks and for distributed quantum computing. Interference: similarly to wave interference, quantum interference increases the probability of correct answers while reducing the probability of wrong ones. Quantum algorithms use this principle to steer the computation. The efficiency of the Shor and Grover algorithms rests largely on this mechanism.
2.2 Quantum Computer Types and Hardware Approaches Today several approaches to developing quantum computers exist, using different physical substrates. Superconducting qubits (IBM, Google): superconducting circuits operating at millikelvin temperatures and close to CMOS production technology. IBM and Google are the leaders in this field. IBM's Nighthawk chip, to be made available to users by the end of 2025, contains 120 qubits with 218 connectors (IBM, 2025).
Trapped ion qubits (IonQ, Honeywell/Quantinuum): ionised atoms are held with electromagnetic fields. This approach stands out for high coherence times and low error rates, but scales more slowly. IonQ has announced a target of a cryptographically relevant quantum computer (CRQC) by 2028 (postquantum.com, 2025). Photonic qubits (PsiQuantum, Xanadu): this approach, using photons as qubits, can operate at room temperature and offers data-centre-like scaling potential. Microsoft's topological qubit (Majorana-based) initiative represents a high-risk, high-reward approach; if successful it could dramatically reduce the qubit overhead required for a CRQC (postquantum.com, 2025).
2.3 The NISQ Era and the Importance of Error Correction Today's quantum computers are in the 'Noisy Intermediate-Scale Quantum' (NISQ) era. Although these machines have sufficient qubit counts for real-world problems, high error rates limit computational reliability. It is estimated that running Shor's algorithm at a scale sufficient to break RSA-2048 requires roughly 4,000 logical (error-corrected) qubits; each logical qubit requires hundreds to thousands of physical qubits with current technology. The critical contribution of Google's Willow chip in 2024 lies precisely here. As SpinQ (2025) recounts, Willow 'proved the phenomenon of exponential error reduction as qubit count rises — crossing below the error threshold.' This is the first experimental proof that scalable error correction is genuinely possible. IBM's 2024 paper in Nature presented a bivariate bicycle qLDPC code encoding 12 logical qubits in 144 data qubits, significantly increasing error correction efficiency.
3. Quantum Computer Development: Milestones and Roadmaps Figure 1. Quantum Computer Qubit Development and the Q-Day Risk Timeline 3.1 Google Willow: Crossing 'Below the Error Threshold' Google's Willow chip, announced in December 2024 and analysed comprehensively throughout 2025, contains 105 superconducting qubits. Willow's basic achievement is completing in roughly five minutes a benchmark computation that a classical supercomputer would take 10^25 years to complete. But the more critical achievement is that the error rate falls as qubit count rises — an indication that the fundamental problem quantum computing history has been trying to solve has been overcome. Fred Chong of UC Berkeley characterised this development as 'a tsunami in the 2025 error correction wave' (techvorta.com, 2026). 3.2 The IBM Roadmap: The 2029 Fault-Tolerant Quantum Target IBM has the sector's most detailed and most openly published roadmap. According to the comprehensive assessment of Postquantum.com (2025), IBM's critical milestones for the 2025-2029 period are: 2026 — Kookaburra (a 1,386-qubit multi-chip processor, combining three chips into a system of 4,158+ qubits). 2027-2028: serious progress in logical qubits and proof of error correction effectiveness. 2029: the target of delivering the world's first large-scale fault-tolerant quantum computer.
The experimental Loon processor IBM announced in November 2025 shows 'the first demonstration by IBM of all the basic processor components required for fault-tolerant quantum computing' (IBM, 2025). That announcement is a critical signal not only of scale but of architectural maturity.
3.3 Q-Day: When Might It Happen?
Q-Day denotes the hypothetical date on which quantum computers reach a scale able to break existing encrypted communications. The Global Risk Institute's 2024 Quantum Threat Timeline Report (Mosca and Piani) places the central probability distribution in the 2033-2037 range. As Qryptonic (2025) recounts, the error correction advances in IBM's Nature paper reduce the required number of physical qubits by sixty per cent and point to an estimate of 2027 (±1 year) for RSA-breaking capacity.
The reason for these differing estimates lies in uncertainty about error correction efficiency: how many physical qubits are required per logical qubit, how error rates will scale and how quantum network architecture will be realised are not yet settled. According to the candid analysis of Introtoquantum.org (2025): 'IBM took a much more conservative step in 2024, claiming only 100,000 qubits in 2033 — but that machine is expected to meet error correction requirements.' The key message of this picture is: while the exact date of Q-Day is uncertain, the time required for the transition is not.
4. The Quantum Threat to Existing Cryptography Figure 2. The Status of Cryptographic Algorithms Against Classical and Quantum Attacks 4.1 Shor's Algorithm: The End of Public Key Encryption RSA encryption rests on the fact that factoring large numbers into primes is a problem requiring exponential time for classical computers. Breaking a 2048-bit RSA key by classical methods would take longer than the age of the universe. Shor's algorithm changes that equation fundamentally: on a quantum computer with sufficient qubits and a low error rate, RSA-2048 can be broken in polynomial time using the quantum Fourier transform and a period-finding mechanism.
In Sectigo's (2025) concise definition: 'Shor's Algorithm shows that quantum computers can factor integers far more efficiently than a classical computer, and this makes quantum computers more efficient at breaking RSA and ECC.' According to ISACA's (2025) assessment, the algorithms Shor targets are: RSA (large number factoring), DSA, ECDSA and Diffie-Hellman (discrete logarithm). All of these algorithms form the foundation of today's banking, e-government, TLS/HTTPS and digital signature infrastructure.
4.2 Grover's Algorithm: The Effect on Symmetric Encryption Grover's algorithm is a quantum search algorithm solving unstructured search problems in O(√N) steps. This corresponds to a square-root speed-up in the brute-force search of an n-bit key. In the words of Shaw's (2025) arxiv work: 'Grover's algorithm reduces the effective security of symmetric and hash-based schemes. AES-128 falls to 64-bit security; SHA-256 drops to 128-bit security.' The practical implication of this finding is: AES-256 retains 128-bit effective security after a Grover attack — which is still regarded as secure. AES-128 weakens, falling to 64 bits. For this reason doubling existing lengths for symmetric ciphers (AES-128 → AES-256) is one of the basic recommended measures in post-quantum transition plans. SHA-256 can be replaced by SHA-384 or SHA-512; but unlike RSA and ECC, for symmetric encryption and hash functions it is sufficient to upgrade the existing algorithms — no transition to an entirely new algorithm family is required.
4.3 The Effect on Blockchain and Cryptocurrencies Blockchain technology depends directly on the security of cryptographic keys and digital signatures. The ECDSA signature scheme used by major cryptocurrencies including Bitcoin and Ethereum is extremely vulnerable to Shor's algorithm. A policy document submitted to the SEC (Costa, 2025) carries the following warning: 'A cryptographically relevant quantum computer (CRQC) could break the fundamental security protecting trillions of dollars of assets, leading to systemic risk, devastating investor losses and a complete erosion of market confidence.' According to Citi's January 2026 report, a September 2025 Federal Reserve study examined the Harvest Now Decrypt Later attack and assessed data privacy risks for distributed ledger networks. This risk indicates that the cryptocurrency ecosystem must move to post-quantum signature algorithms before it is broken.
5. 'Harvest Now, Decrypt Later': The HNDL Threat 5.1 How Does HNDL Work?
The 'Harvest Now, Decrypt Later' (HNDL) strategy establishes that the quantum threat is not a risk deferred to the future but a threat actively taking place today. The concept is simple: a national threat actor or an advanced persistent threat (APT) group collects encrypted traffic today — TLS handshake records, VPN tunnels, email content — and archives it in secure storage. When quantum computers cross the cryptographic threshold, that archive becomes decryptable.
As Quantum Security Defence (2026) recounts, Mosca's inequality makes this risk concrete mathematically: if x (transition time) + y (the period for which the data must remain confidential) > t (Q-Day), the data is at risk. Put into practice: an organisation launching a PQC transition programme in 2026, working with a realistic three-year transition period (x=3) and data requiring 15 years of confidentiality (y=15), needs Q-Day not to arrive before 2044 for the data to be safe. The GRI's 2024 report places Q-Day in the 2033-2037 range. That data is not safe.
Figure 3. Mosca's Inequality: The HNDL Risk Window and the Critical Path of the Transition (2024–2040) 5.2 Current Evidence of HNDL Evidence that the HNDL attack is a practical rather than theoretical threat is growing. According to Qryptonic's (2025) analysis of a US Congressional hearing: 'Foreign adversaries are already applying a "steal now, decrypt later" strategy.' Public notices from the FBI and NSA confirm that certain nation-state actors are conducting large-scale encrypted data collection operations.
Mastercard's 2025 white paper summarises the threat: 'The purpose of HNDL is to break the RSA/ECC portion in future using a CRQC, thereby revealing the symmetric secret keys and then decrypting the data.' In this sense HNDL establishes that TLS sessions are a particularly dangerous target: the future breaking of the asymmetric encryption used in the TLS handshake stage can lead to the disclosure of all content transmitted in that session.
5.3 Measures Against HNDL: Hybrid TLS and Forward Secrecy Two basic technical measures stand out against the HNDL threat. Forward Secrecy ensures that a separate ephemeral key is used for each session, preventing past sessions from being decrypted through the compromise of long-term keys. But forward secrecy is insufficient if the key exchange mechanism used is vulnerable to quantum attack.
Quantum Security Defence's (2026) recommendation is: 'Hybrid key exchange for active communications: hybrid TLS, using both classical (ECDH) and post-quantum (ML-KEM) key exchange together during the transition, provides security against both systems.' This approach also solves the backward compatibility problem in environments where one side uses only classical cryptography.
6. The NIST Post-Quantum Cryptography Standards Figure 4. The NIST Post-Quantum Cryptography Standards: FIPS 203, 204, 205 and the Planned FIPS 206 6.1 An Eight-Year Standardisation Process NIST's post-quantum cryptography standardisation project began with a global call in 2016 and covered a comprehensive eight-year evaluation process conducted with the participation of industry, academia and governments. In a process that received 82 submissions at the outset, multiple elimination rounds were held consisting of security analyses, performance evaluations and cryptographic breaking attempts. According to the Federal Register's (2024) official announcement, the FIPS 203, FIPS 204 and FIPS 205 standards took effect on 14 August 2024.
6.2 FIPS 203 — ML-KEM: The Key Encapsulation Standard FIPS 203 defines the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) standard. Derived from the CRYSTALS-Kyber algorithm, ML-KEM is the primary key exchange mechanism foreseen to replace RSA and ECDH. According to QRAMM's (2024) assessment, three security levels are offered: ML-KEM-512 (AES-128 equivalent security, smallest key size), ML-KEM-768 (AES-192 equivalent, balanced option) and ML-KEM-1024 (AES-256 equivalent, highest security).
The NSA's CNSA 2.0 guidance mandates the use of ML-KEM-1024 for national security systems and foresees full transition by 2030. ML-KEM's basic mathematical hardness is the Module Learning With Errors (Module-LWE) problem: its resistance to both classical and quantum computation rests on the fact that the problem in this configuration requires exponential rather than polynomial computation.
6.3 FIPS 204 — ML-DSA: The Digital Signature Standard FIPS 204 defines the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) standard. Derived from CRYSTALS-Dilithium, ML-DSA is the primary digital signature algorithm foreseen to replace ECDSA and RSA-PSS. It is NIST's recommended default standard for use in code signing, certificate signing, document signing and authentication protocols. Three parameter sets exist: ML-DSA-44 (small signature size, faster), ML-DSA-65 (balanced) and ML-DSA-87 (highest security, 4,595-byte signature size). As Quantum Security Defence (2026) observes, ML-DSA's mathematical basis is the 'Fiat-Shamir with Aborts' approach, using the same lattice problems as ML-KEM: key generation creates a public-private key pair from structured lattices. During signing, the process may be repeated until an acceptable signature is obtained. Verification checks the authenticity of the signature with the public key.
6.4 FIPS 205 — SLH-DSA: The Hash-Based Backup Signature FIPS 205 defines the Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) and is derived from SPHINCS+. Its basic difference from ML-DSA is that its security assumption rests on a different mathematical foundation: resting on the security of hash functions, SLH-DSA constitutes a fallback alternative should a weakness in lattice-based algorithms be discovered in future. As DigiCert (2024) recounts, SLH-DSA is 'larger and slower than the other algorithms' — which makes it suitable for long-term archiving and code signing where performance is not critical.
7. Lattice-Based Cryptography: Mathematical Foundations 7.1 What Is the Lattice Problem?
Lattice cryptography rests on the hardness of mathematical problems in high-dimensional lattices. Geometrically a lattice is a regular grid of points formed from n linearly independent vectors in a vector space. Two basic forms of these problems constitute the mathematical ground of lattice cryptography.
The Shortest Vector Problem (SVP): finding the shortest non-zero vector in a lattice. As dimension increases this problem grows exponentially hard for both classical and quantum computers.
Learning With Errors (LWE): solving a system of linear equations with small errors deliberately added. Developed by Regev (2005), the LWE problem forms the basis of ML-KEM and ML-DSA. The module lattice version (Module-LWE) provides a performance advantage while preserving the security level.
7.2 Why Is It Quantum-Resistant?
Unlike RSA and ECC, lattice problems cannot be attacked with Shor's algorithm: Shor uses the Quantum Fourier Transform to solve factoring and discrete logarithm problems, but SVP and LWE do not have that mathematical structure. Nor is a notable square-root advantage obtained from Grover search.
NIST's eight-year evaluation process carried out comprehensive cryptanalysis, including active attack research. In Fractal.ai's (2024) summary: 'Unlike RSA, which can be broken with Shor's algorithm, the NIST-approved PQC algorithms are resistant to the known capabilities of quantum computers. There are nevertheless trade-offs in performance and storage.' 7.3 A Performance Comparison: RSA vs ML-KEM Post-quantum algorithms display different performance profiles compared with RSA: Table 1. A Key Size and Performance Comparison of RSA-2048 and ML-KEM Parameter RSA-2048 ML-KEM-512 ML-KEM-768 ML-KEM-1024 Security Level ~112 bits 128 bits 192 bits 256 bits Public Key Size 256 bytes 800 bytes 1,184 bytes 1,568 bytes Ciphertext Size 256 bytes 768 bytes 1,088 bytes 1,568 bytes Quantum Security BREAKING Secure Secure Secure Key Generation Speed ~1,600 op/s ~800,000 op/s ~550,000 op/s ~400,000 op/s Note. Sources: QRAMM (2024); NIST FIPS 203 (2024); Quantum Security Defence (2026); ISACA (2025). 8. The PQC Transition for Critical Infrastructure 8.1 The Concept of Crypto-Agility Crypto-agility describes a system's capacity to update its cryptographic algorithms without requiring wide-ranging architectural change. This concept has moved to the centre of the post-quantum transition: a system's transition to PQC algorithms requires the capacity to change them in isolation. Under IBM's framework, crypto-agility covers a cryptographic inventory, an updatable modular architecture, agnostic protocols and coordinated update processes (Shaw, 2025).
The practical difficulty ISACA (2025) stresses is: 'Replacing existing cryptographic standards with the new post-quantum standards creates significant technical difficulties because of worldwide connectivity and entrenched protocols.' This makes a phased, risk-based transition strategy essential rather than updating all systems at once. 8.2 The Banking and Finance Sector The banking sector is in a particularly vulnerable position, both because its high-value data requires long-term confidentiality and because its real-time transaction infrastructure depends deeply on cryptography. According to Citi's (2026) report, the Bank of Israel published guidance in January 2025 assessing 'the readiness of the banking system for cyber risks arising from quantum computing capabilities'. The same report recounts that the Federal Reserve's September 2025 study examined HNDL risk for distributed ledger networks. Mastercard addressed corporate transition methodology comprehensively in its 2025 white paper. Risk assessment, cryptographic inventory, SoA-like statements of applicability and transition prioritisation form the basic components of that methodology. 8.3 Government and e-Government Systems The US White House published in January 2025 an 'Executive Order on Strengthening and Promoting the Nation's Cybersecurity', which defines the PQC transition as a federal priority. The EU Commission published a 'Coordinated Implementation Roadmap' for the transition to post-quantum cryptography in June 2025, and in October 2025 requested contributions on preparations for a Quantum Act (Citi, 2026).
NIST's own timeline is: it plans to remove quantum-vulnerable algorithms from the standards by 2035, and foresees a much earlier transition for high-risk systems (NIST IR 8547, 2024). The NSA's CNSA 2.0 guidance issues the directive 'begin transition immediately' for software and firmware signing while allowing until 2033 for legacy infrastructure.
8.4 PKI and Certificate Infrastructure Public Key Infrastructure (PKI) forms the fundamental backbone of internet security. Certificate Authorities (CAs), web servers, email encryption, code signing and authentication systems all depend on PKI. As Sectigo (2025) observes: 'PKI rests on just two standardised algorithms, RSA and ECC. Quantum computers threaten this digital trust.' The particularly demanding dimension of the PKI transition is updating root certificate authorities. The lifetime of root CA certificates is generally 25-30 years; if the signing algorithms of those certificates are ECDSA or RSA, the entire certificate hierarchy becomes vulnerable. According to DigiCert's (2024) assessment, the NSA issues the directive 'begin transition immediately' for software and firmware signing.
9. PQC Transition Planning: Methodology and Tools 9.1 The Cryptographic Inventory (CBOM) The first step of the post-quantum transition is to inventory the organisation's existing cryptographic usage systematically. The Cryptography Bill of Materials (CBOM) is a framework developed for that purpose. According to Shaw's (2025) work, a CBOM involves a multi-layered cryptographic discovery methodology covering 'software dependency graphs, binary analysis and network auditing'.
A CBOM should document all the algorithms used (RSA, ECDSA, AES, etc.), the software components and versions in which those algorithms are used, key sizes, the context of use (encryption, signing, key exchange) and replacement priority. NIST NCCoE SP 1800-38 forms the reference guide to this methodology. 9.2 A Risk Prioritisation Matrix The following framework may be applied for risk prioritisation in the PQC transition: • Priority 1 — Immediate Transition: root CA certificates and code signing keys. These long-lived credentials affect the whole certificate chain in an HNDL attack. • Priority 2 — Short Term (1-2 years): TLS/HTTPS server certificates, API authentication, document signing. Hybrid TLS may be recommended for active communications. • Priority 3 — Medium Term (2-3 years): internal network encryption, VPN infrastructure, database encryption keys.
• Priority 4 — Long Term (3-5 years): embedded systems, IoT devices and firmware. Transition should be planned in coordination with hardware replacement cycles. 9.3 Legal and Compliance Requirements The legal dimension of the PQC transition is developing rapidly. In the United States, the NIST IR 8547 timelines are binding for federal agencies. In the EU the NIS2 Directive and the forthcoming Quantum Act will impose transition obligations on critical infrastructure operators. According to Citi's (2026) report, the EU Commission's June 2025 roadmap sets the coordinated transition timetable for member states.
In the Turkish context it is critically important to follow the regulatory steps of the BDDK (Banking Regulation and Supervision Agency) and the BTK (Information and Communication Technologies Authority) in this field. Defining quantum-safe cryptography requirements within the Information and Communication Security Guide should be one of the strategic agenda items in Türkiye's international alignment process.
10. Türkiye's Quantum Strategy and Cryptographic Preparation 10.1 The First Quantum Computer at TOBB ETÜ In November 2024 Türkiye publicly presented its first domestic quantum computer, developed by TOBB University of Economics and Technology (TOBB ETÜ). As Quantumzeitgeist (2024) recounts, 'TOBB ETÜ aims to create a quantum ecosystem whose infrastructure is designed to support continuous development, helping ventures develop domestic quantum hardware and components for global competitive advantage.' Türkiye's move reflects its goal of being among the countries that produce, and not merely use, quantum technology. President Erdoğan said on the subject: 'With this critical development we aim to position Türkiye as a key player on the global stage.' The planned superconducting chip production facility will open the way to producing high-capacity processors.
10.2 TÜBİTAK BİLGEM UEKAE: Quantum Cryptography Infrastructure TÜBİTAK BİLGEM UEKAE is Türkiye's key institution in quantum information security research. According to BİLGEM's website (2023), UEKAE has conducted national and international projects in the fields of quantum cryptography, quantum random number generation (QRNG), single-photon quantum key distribution (QKD) and quantum ghost imaging. At the beginning of 2023 a Quantum Technologies Department was established, giving work in this field an institutional structure.
In the defence sector, the SSB (Presidency of Defence Industries) approved the establishment of a Quantum Technologies Development Centre at the Defence Industry Executive Committee meeting in August 2024. As the Herdem law firm (2025) recounts, that centre will operate in the fields of 'quantum communication, encryption, detection and advanced computing'. 10.3 International Cooperation: QuantERA 2025 Under the QuantERA 2025 Call, TÜBİTAK will accelerate Türkiye's cooperation in international quantum technology research projects. Launched by the QuantERA III Consortium, this call encourages cross-border cooperation on quantum phenomena and resources and on applied quantum science. As Türkiye Today (2025) recounts, project proposals may fall under two topic headings, with a maximum institutional share of 650,000 TL.
10.4 Türkiye's PQC Transition Priorities Türkiye is in a position to implement a PQC transition agenda in parallel with global standards. The critical priorities may be addressed under the following headings: e-government and authentication systems based on the Turkish Republic Identity Number, state correspondence requiring high confidentiality, defence communications infrastructure and financial system messaging (SWIFT, interbank communication).
Turkish BDDK regulations covering quantum security, the National Cyber Security Strategy including a PQC transition timetable and the BTK publishing a PQC transition guide for TLS/PKI infrastructure are foremost among the regulatory steps that must be taken in this field. BİLGEM UEKAE establishing a post-quantum algorithm testing and certification platform is also of strategic importance for national capability.
11. A Sectoral Impact Assessment 11.1 The Health Sector and Medical Data Privacy The confidentiality lifetime of health data is particularly long: a patient's medical history falls within the scope of personal data that must be kept confidential for decades. Assessed through Mosca's inequality, the requirement that a health record created in 2024 be protected for 30-40 years makes it one of the data categories with the highest HNDL risk. For HIPAA in the United States and the GDPR in the EU to be applied as required, health institutions must move their cryptographic infrastructure to PQC.
11.2 Electricity Grids and Critical Infrastructure Electricity grids, water systems and transport infrastructure use operational technology (OT) systems, and updating and patching those systems is extremely difficult. Most OT devices are deployed with a lifetime of ten years or more and were not designed for cryptographic upgrade. According to the DHS's (undated) assessment: 'Replacing existing cryptographic standards with the new post-quantum standards creates significant technical difficulties because of worldwide connectivity and entrenched protocols.' 11.3 Smart Contracts and DeFi The Decentralised Finance (DeFi) ecosystem and smart contracts carry a deep dependency on ECDSA signatures. In Ethereum, wallet security, transaction signing and smart contract authentication are ECDSA-based. The Ethereum Foundation continues research into the transition from ECDSA to post-quantum signatures; but the transition of the existing infrastructure to PQC, with its backward compatibility requirements, constitutes an extremely complex engineering problem.
12. Notable Developments of the 2025-2026 Period 12.1 Quantum Key Distribution (QKD): Physical Security Post-quantum cryptography (software-based) and Quantum Key Distribution (QKD, hardware-based) represent two complementary security approaches. QKD offers physical security resting on the fundamental laws of quantum mechanics: an eavesdropping attempt causes measurement disturbance and thus becomes detectable. China's Beijing-Shanghai backbone, the world's most extensive QKD network, reached a length of 2,000 km in 2022.
In Türkiye, TÜBİTAK BİLGEM UEKAE continues its research into single-photon QKD systems. The long-term strategy for quantum-safe communication rests on the hybrid use of PQC (cost-effective for widespread deployment) and QKD (for critical links).
12.2 McKinsey's Forecast of a USD 100 Billion Quantum Technology Market The McKinsey analysis presented at a US Congressional hearing forecasts that the quantum technology market could exceed USD 100 billion by 2040 (Qryptonic, 2025). That growth demonstrates the strategic importance of the quantum-safe cybersecurity market. According to Citi's (2026) analysis, investment in quantum technology grew by fifty per cent in 2024 to reach roughly USD 2 billion, while governments spent USD 3.1 billion. 12.3 Artificial Intelligence and Quantum: Synergies and Risks The intersection of artificial intelligence and quantum computers produces a two-way effect. On the positive side: quantum machine learning (QML) algorithms offer the potential for exponential speed-up in certain AI tasks. On the negative side: LLM-based tools are producing new toolsets that automatically detect cryptographic weaknesses (Shaw, 2025), which increases the risk of legacy cryptographic implementations being discovered and exploited. From 2030 onwards, AI-assisted quantum error correction systems could bring the Q-Day timetable forward.
13. An Institutional Preparation Framework and Recommendations 13.1 A PQC Readiness Assessment Model Five maturity levels are proposed for assessing an organisation's PQC readiness:
• Level 1 — Awareness: top management and IT teams are unaware of the quantum threat. There is no PQC planning.
• Level 2 — Discovery: a cryptographic inventory exercise has been launched. Threat assessment is under way. A CBOM has been created.
• Level 3 — Planning: risk prioritisation is complete. A transition roadmap has been prepared. Budget has been allocated.
• Level 4 — Implementation: the PQC transition has begun in high-priority systems. Hybrid cryptography has been deployed. Internal audit has begun.
• Level 5 — Maturity: all critical systems have moved to PQC. Crypto-agility has been fully implemented. Continuous monitoring is active.
13.2 Practical Recommendations: A 12-Month Quick Start Plan A recommended 12-month priority action timetable for organisations:
• Months 1-3 — Cryptographic Inventory: documenting cryptographic usage across all software, hardware and network components within a CBOM framework.
• Months 2-4 — Risk Assessment: applying Mosca's inequality to calculate data confidentiality requirements and transition duration. Modelling Q-Day scenarios. • Months 3-6 — Prioritisation and Roadmap: identifying high-risk assets and constructing the transition timetable in line with the NIST IR 8547 guidance. • Months 6-9 — Pilot Implementation: piloting ML-KEM or ML-DSA in a low-risk test environment. Configuring hybrid TLS.
• Months 9-12 — Phased Transition: completing the transition of Priority 1 assets (root CA, code signing). Internal audit and documentation.
Table 2. A Mapping Table of Existing and Post-Quantum Cryptographic Algorithms Use Existing (Risk) PQC Transition Target NIST / NSA Directive Key Exchange ECDH, RSA-OAEP ML-KEM (FIPS 203) NSA CNSA 2.0: ML-KEM-1024 mandatory (for NSS) Use Existing (Risk) PQC Transition Target NIST / NSA Directive Digital Signature ECDSA, RSA-PSS ML-DSA (FIPS 204) NIST: primary standard; immediate transition recommended Signature (Backup) RSA-PKCS#1v1.5 SLH-DSA (FIPS 205) Backup if ML-DSA is broken; long-term archive Symmetric Encryption AES-128 AES-256 Double the key length; no change of algorithm required Hash SHA-256 SHA-384 / SHA-512 Extend 256→384/512; Grover protection TLS Handshake ECDHE + RSA/ECDSA Hybrid: ECDHE+ML-KEM Hybrid TLS recommended during the transition (IETF RFC) PKI Certificate RSA-2048 / ECDSA P-256 ML-DSA + Hybrid Cert. DigiCert, Entrust: hybrid certificate transition products Note. Sources: NIST FIPS 203/204/205 (2024); NSA CNSA 2.0 (2022); DigiCert (2024); Quantum Security Defence (2026).
14. Digital Forensics and Legal Dimensions 14.1 The Risk to the Legal Validity of the Digital Signature The legal validity of a digital signature rests on cryptographic reliability. In Türkiye, Electronic Signature Law No. 5070 governs the legal consequences of the secure electronic signature; those signatures are built on RSA- or ECDSA-based certificates. After Q-Day the protection of those signatures against forgery will disappear: an actor with a quantum computer could imitate an RSA-based digital signature without the private key. The legal dimension of that threat is this: digital signatures certified before a notary, e-commerce contracts and official correspondence valid today will become questionable in reliability in the post-Q-Day environment. Updating Türkiye's secure electronic signature standards under Law No. 5070 to cover post-quantum algorithms will become a legal necessity.
14.2 Encrypted Evidence and the Problem of Seizure The increase in quantum computers' code-breaking capacity will produce a two-way effect on the integrity of legal evidence. The positive side: making encrypted data accessible in judicial proceedings may facilitate some criminal investigations. The negative side: it may become harder to determine whether encrypted evidence taken into the legal chain of custody has been altered using quantum computers. Computing the cryptographic hash values used for integrity checking in digital forensics with quantum-resistant algorithms (SHA-384, SHA-512) will be of critical importance.
14.3 A New Legal Category: Quantum Deterrence Quantum computers' code-breaking capacity passing into the hands of state actors brings new questions for international law. Under what conditions is the NSA's or a comparable intelligence unit's use of quantum capacity against encrypted communications deemed lawful? How does the decryption with quantum tools of data collected in advance under HNDL affect the limits of surveillance under international humanitarian law? These are questions of public international law that remain unanswered. 15. Conclusion The algorithm Peter Shor defined in 1994 remained largely a theoretical threat for thirty years. In 2024 that picture changed: Google Willow proving it had gone 'below the error threshold', IBM maintaining its 2029 fault-tolerant quantum computer target and the GRI placing Q-Day in the 2033-2037 range show that we are now discussing an engineering rather than a theoretical matter.
The FIPS 203, 204 and 205 standards NIST published in August 2024 provide the technical cornerstones for the transition of digital security infrastructure into the post-quantum age. ML-KEM, ML-DSA and SLH-DSA are algorithms with mathematical foundations resistant to quantum attack that will replace RSA, ECDSA and Diffie-Hellman. The HNDL threat establishes the critical urgency of that transition: the sum of the time required for the technical transition and the data confidentiality requirement may already exceed Q-Day. For organisations the conclusion is clear: producing a cryptographic inventory, calculating the HNDL risk window and beginning the PQC transition in high-priority systems constitute the most critical information security investment of this decade.
In the Turkish context, TOBB ETÜ's first domestic quantum computer work and TÜBİTAK BİLGEM UEKAE's quantum cryptography research show that the country is developing its capacity in this field. But it is essential that the national regulatory framework — through the BDDK, the BTK and the Information Security Guide — define PQC transition requirements, so that the public and private sectors can carry out that transition in a coordinated way. Making digital infrastructure quantum-ready is of existential importance for both national security and the digital economy.
References Anadolu Agency. (2024a, November 20). Türkiye's quantum leap: First computer to go live. https://www.aa.com.tr/en/economy/turkiye-set-to-launch-its-1st-quantum-computer/ 3399280 Anadolu Agency. (2024b). Türkiye eyes advances in quantum computing with plans for superconducting chip production. https://www.aa.com.tr/en/science-technology Citi Institute. (2026, January). The trillion-dollar security race is on: Quantum threat. Citigroup. https://www.citigroup.com/rcs/citigpa/storage/public/Citi_Institute_Quantum_Threat. pdf Cloud Security Alliance. (2024, August 15). NIST FIPS 203, 204, and 205: Finalized — An important step towards a quantum-safe future.
https://cloudsecurityalliance.org/blog/2024/08/15 Costa, D. B. C. (2025, September 3). Post-quantum financial infrastructure framework (PQFIF). SEC Written Input. https://www.sec.gov/files/cft-written-input-daniel-brunocorvelo-costa-090325.pdf DigiCert. (2024, November 26). Tracking the progress toward post-quantum cryptography. https://www.digicert.com/blog/the-progress-toward-post-quantum-cryptography DHS. (undated). Post-quantum cryptography. U.S. Department of Homeland Security. https://www.dhs.gov/quantum Federal Register. (2024, August 14). Announcing issuance of FIPS 203, FIPS 204, and FIPS 205. https://www.federalregister.gov/documents/2024/08/14/2024-17956 Fractal.ai. (2024, November 11). The looming threat of quantum computing to data security. https://fractal.ai/article/nists-post-quantum-cryptographic-standards Herdem Law. (2025, April 15). Türkiye's quantum leap: Establishing a new frontier in defense technology. https://herdemlaw.com/en-us/explore/turkiyes-quantum-leap IBM. (2025, November 12). IBM delivers new quantum processors, software, and algorithm breakthroughs. IBM Newsroom. https://newsroom.ibm.com/2025-11-12-ibm-deliversnew-quantum-processors Introtoquantum.org. (2025, June 24). The timelines: When can we expect useful quantum computers? https://introtoquantum.org/essentials/timelines/ ISACA. (2025). Post-quantum cryptography: A call to action.
https://www.isaca.org/resources/news-and-trends/industry-news/2025/post-quantumcryptography-a-call-to-action Jena, J. (2025). The quantum security deadline: Building crypto-agility against 'Harvest Now, Decrypt Later' threats. European Journal of Computer Science and Information Technology, 13(52), 35–52. https://eajournals.org/ejcsit/vol13-issue52-2025 Mastercard. (2025). Migration to post-quantum cryptography [White paper]. https://www.mastercard.com/content/dam/mccom/quantum-explainer-and-whitepaper Mosca, M., & Piani, M. (2024). Quantum threat timeline report 2024. Global Risk Institute (GRI).
NIST. (2024a). FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard. National Institute of Standards and Technology.
https://csrc.nist.gov/pubs/fips/203/final NIST. (2024b). FIPS 204: Module-Lattice-Based Digital Signature Standard. National Institute of Standards and Technology. https://csrc.nist.gov/pubs/fips/204/final NIST. (2024c). FIPS 205: Stateless Hash-Based Digital Signature Standard. National Institute of Standards and Technology. https://csrc.nist.gov/pubs/fips/205/final NIST CSRC. (2024, December 11). Post-quantum cryptography.
https://csrc.nist.gov/projects/post-quantum-cryptography NIST. (2024d). NIST IR 8547: Transition to post-quantum cryptography standards. National Institute of Standards and Technology.
PKI Consortium. (2025, January 15). NIST post-quantum cryptography update [Conference presentation]. PQC Conference, Austin. https://pkic.org/events/2025/pqc-conferenceaustin-us/ postquantum.com. (2025). IonQ's 2025 roadmap: Toward a cryptographically relevant quantum computer by 2028. https://postquantum.com/industry-news/ionqroadmapcrqc/ postquantum.com. (2025). IBM quantum computing roadmap.
https://postquantum.com/quantum-computing-companies/ibm/ QRAMM. (2024, December 24). NIST post-quantum cryptography standards: Complete guide to FIPS 203, 204, 205. https://qramm.org/learn/nist-pqc-standards.html Qryptonic. (2025, June 24). Congress sounds the alarm: Why 'steal now, decrypt later' demands board-level action today. https://qryptonic.substack.com/p/congress-sounds-the-alarmwhy-steal Quantumzeitgeist. (2024, November 22). Turkey unveils first domestic quantum computer for technological independence. https://quantumzeitgeist.com/turkey-unveils-firstdomestic-quantum-computer-for-technological-independence/ Quantum Security Defence. (2026, April 9). Harvest now decrypt later: The threat that is already in motion. https://quantumsecuritydefence.com/insights/hndl-in-motion/ Quantum Security Defence. (2026). NIST FIPS 203, 204, 205: What each standard requires. https://quantumsecuritydefence.com/insights/nist-fips-standards/ Sectigo. (2025, October 25). NIST's official 2024 post-quantum algorithms. https://www.sectigo.com/blog/who-are-nists-post-quantum-algorithm-winners Shaw, A. (2025). Quantum-safe code auditing: LLM-assisted static analysis and quantumaware risk scoring for post-quantum cryptography migration. arXiv preprint arXiv:2604.00560. https://arxiv.org/pdf/2604.00560 Shor, P. W. (1994). Algorithms for quantum computation: Discrete logarithms and factoring. Proceedings of 35th Annual Symposium on Foundations of Computer Science, 124– 134.
SpinQ. (2025). Quantum computing industry trends 2025: A year of breakthrough milestones. https://www.spinquanta.com/news-detail/quantum-computing-industry-trends-2025 techvorta.com. (2026, April 5). Quantum computing explained: Where the world's most powerful computers stand in 2026. https://techvorta.com/quantum-computingexplained-2026/ TÜBİTAK BİLGEM. (2023). Quantum technologies.
https://en.bilgem.tubitak.gov.tr/en/quantum-technologies/ Wikipedia. (2025). NIST Post-Quantum Cryptography Standardization. https://en.wikipedia.org/wiki/NIST_Post-Quantum_Cryptography_Standardization
