Adversaries are collecting encrypted federal data today to decrypt tomorrow, and the deadline to stop them just got closer. With NIST's final IR 8547 out only days before recording, Brian and Sean go hosts-only to unpack what the post-quantum transition means for federal agencies. Sean walks through the deadlines set by NSM-10, Executive Order 14412, OMB M-26-15, and CNSA 2.0, from high-impact systems that must use quantum-resistant key exchange by 2030 to network gear that must be refreshed or retired by the same year. The good news is that much of the work is a configuration change, not a purchase, because many vendors are already run post-quantum cryptography by default.
Then they get practical about what can break. Larger keys can spill across two packets, vendor implementations don't always interoperate, and failed handshakes surface as dropped sessions, which is why Sean argues the truth is always in the packets. He shares takeaways from the GIST360 breakfast briefing with CBP's Dr. Edward Mays and Cloudflare's Jeremy Corey, explains why crypto agility is the hidden payoff, and closes with a clear Monday-morning priority. Protect internet-facing applications and remote access first, because that traffic is the most likely to be harvested now and decrypted later.
Resources Mentioned in This Episode
Federal PQC Guidance and Deadlines
• NIST IR 8547, Transition to Post-Quantum Cryptography Standards (final, October 2026)
• OMB M-26-15, Execution of the Migration to Post-Quantum Cryptography
• Executive Order 14412 and the accelerated deadlines for high-impact systems
• National Security Memorandum 10 (NSM-10) on quantum computing and vulnerable cryptographic systems
• NSA Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)
• NIST Post-Quantum Cryptography project and FIPS 203, 204, and 205
• CISA Post-Quantum Cryptography Initiative
The Migration Timeline Discussed
• Software and firmware signing, PQC exclusively by 2030
• Traditional networking equipment, PQC preferred in 2026 and exclusive by 2030
• High-impact systems, quantum-resistant key establishment by end of 2030 and digital signatures by 2031
• Operating systems, PQC preferred in 2027 and exclusive by 2033
• Web browsers, servers, and cloud services, PQC exclusive by 2033
• Federal system deadline for full migration, 2035
Industry Perspectives
• Cloudflare, running post-quantum cryptography by default
• CBP's push toward quantum readiness (MeriTalk)
From the GIST360 PQC Breakfast Briefing
• Dr. Edward Mays, Deputy Assistant Commissioner, U.S. Customs and Border Protection
• Jeremy Corey, Public Sector Solutions Engineer, Cloudflare
• Recap Blog
• Use commercial services that already support PQC for public-facing apps and remote users
• Key exchange is mature, while digital signatures, authentication, and private DNS are still catching up
• Crypto agility is the long-term payoff of the migration
The Monday-Morning Takeaways (Sean Applegate)
• Share NIST IR 8547 with the team and make sure everyone reads it
• Confirm the inventory covers internet-facing systems and internet-heavy users
• Turn on PQC for public-facing apps at the CDN, WAF, or application delivery layer
• Turn on PQC for zero trust remote access and VPNs
The Hosts and Show
• Swish