The Post-Quantum Era: What Legal Perspectives Are Emerging?
Cryptography, often defined as “the science of secrecy,” involves using methods to transform information to ensure its confidentiality and integrity during transmission or storage. Historically, cryptography has relied primarily on mathematical algorithms that use keys to encrypt and decrypt data. However, the advent of quantum computers threatens to make these methods obsolete. These machines, with their ability to solve complex mathematical problems at unprecedented speeds, could potentially break the current cryptographic systems.
It is in this context that post-quantum cryptography has emerged. Unlike quantum cryptography, which uses the principles of quantum mechanics to secure communications (such as quantum key distribution), post-quantum cryptography relies on mathematical algorithms designed to resist attacks by quantum computers. These algorithms, based on complex mathematical problems such as lattice-based cryptography or error-correcting codes, are independent of physical principles and aim to ensure long-term security even in the quantum era.
The Challenge of Post-Quantum Cryptography for Cybersecurity: A Priority for France and the European Union
France has recognized the challenges of post-quantum cryptography early on. The National Agency for the Security of Information Systems (ANSSI) has published guidelines to assist in the transition to these new technologies. These recommendations are part of the National Quantum Plan, which includes significant investments in quantum technologies, including post-quantum cryptography. In 2021, France announced an investment of more than one billion euros in the development of quantum computing, highlighting the strategic importance of this technology for national security. ANSSI advocates for a hybrid approach to the transition, combining current systems with post-quantum solutions to ensure continuous security throughout the migration process.
The European Union shares this strategic vision. In 2024, the European Commission published a recommendation to coordinate the transition to post-quantum cryptography among member states. This roadmap encourages EU countries and private actors to adopt a harmonized approach, progressively integrating these new technologies into critical infrastructures. The goal is to strengthen Europe’s digital sovereignty by ensuring that its security systems remain inviolable, even in the face of quantum threats.
Public-Private Collaboration: A Driver for the Development of Post-Quantum Cryptography
The transition to post-quantum cryptography requires close collaboration between the public and private sectors. In France, this collaboration is demonstrated by initiatives like the RESQUE (Quantum Resilience) consortium, coordinated by Thales, which brings together major cybersecurity players, including ANSSI and Inria. This consortium aims to develop, within three years, a post-quantum encryption solution capable of protecting communications, infrastructures, and networks of local authorities and companies against potential attacks orchestrated by quantum computers.
Such collaboration is essential to accelerate the development and deployment of post-quantum cryptography technologies. Technology companies, in partnership with research institutions and public authorities, play a key role in experimenting with and implementing these new solutions. The results of these collaborations will not only secure critical infrastructures but also pave the way for broader adoption of these technologies worldwide.
The Legal Perspectives of Integrating Post-Quantum Cryptography
Since post-quantum cryptography is still in development, it is challenging to regulate it precisely at this stage. Nonetheless, initiatives are beginning to emerge, offering a glimpse of future directions. In the United States, for example, the government has taken steps by publishing post-quantum cryptography standards. In 2022, President Joe Biden signed the Quantum Computing Cybersecurity Preparedness Act, a law that mandates federal agencies to transition to using post-quantum technologies. This legislation marks a significant step in adapting government infrastructures to the post-quantum era, ensuring enhanced security against future threats. The European Union, for its part, has also issued recommendations on post-quantum cryptography. These recommendations aim to encourage a harmonized approach among member states, ensuring that the transition to these new technologies occurs in a coordinated and secure manner. The goal is to protect the EU’s digital infrastructures and services against future quantum attacks while preserving the Union’s digital sovereignty.
Integrating post-quantum cryptography poses significant legal challenges. Regulators will need to adapt existing legal and regulatory frameworks to oversee the use of these new technologies. This includes updating laws on data protection, cybersecurity, and privacy to account for the specific requirements of post-quantum cryptography. A proactive approach is necessary to anticipate the challenges and opportunities this emerging technology presents.
Additionally, it will be crucial to establish international standards to ensure the interoperability and security of post-quantum cryptography systems globally. International collaboration will be essential to harmonize these standards and ensure that post-quantum cryptography systems are adopted consistently and securely worldwide. The post-quantum era, though still in development, is already shaping up to be a major turning point for global cybersecurity and will require an adapted legal framework.