Post-Quantum Cryptography: Secure Assets
Post-Quantum
Cryptography:
Secure Assets
Defend against quantum threats. Post-quantum cryptography secures institutional digital assets and family-office wallets from the approaching Q-Day horizon — when today’s algorithms become tomorrow’s vulnerabilities.
A Zurich family office holds $840 million in Bitcoin and Ethereum inside six geographically-distributed cold-storage vaults, each secured by ECDSA-secp256k1 keys on hardware wallets manufactured in 2021. The keys have never touched the internet. The physical security is military-grade. The cryptographic assumption is that ECDSA remains computationally infeasible to break. That assumption has an expiration date — and it is written in the research budgets of IBM, Google Quantum AI, Quantinuum, PsiQuantum, IonQ and every nation-state cryptography programme on earth. Most working cryptographers now put the median estimate for a cryptographically-relevant quantum computer — one capable of running Shor’s algorithm against secp256k1 — somewhere between 2035 and 2040. The family office’s investment horizon is 2050 and beyond. Sometime in the next twelve to fifteen years, every ECDSA-signed Bitcoin address in those vaults will become recoverable by anyone with access to a sufficiently capable quantum device — state actor, criminal syndicate, or a graduate student with a cloud-rented machine. A properly engineered post-quantum cryptography migration begins today, while the quantum adversary is still theoretical. It lets you upgrade to quantum-resistant algorithms — ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (SPHINCS+) and FN-DSA (Falcon) — while legacy cryptography is still intact; it lets you protect institutional wallets long-term against the “harvest-now-decrypt-later” threat where adversaries stockpile encrypted traffic today to crack tomorrow; and it lets you future-proof family-office digital wealth across a generational time-horizon that no pre-2024 cryptographic stack was designed to survive. The entire argument, in three lines:
- ▸Upgrade to quantum-resistant algorithms.
- ▸Protect institutional wallets long-term.
- ▸Future-proof family-office digital wealth.
Why ECDSA and RSA are expiring instruments
Every Bitcoin wallet, every Ethereum account, every TLS session and every encrypted government communication on earth today relies on one of three mathematical assumptions: that integer factorisation is hard (RSA), that discrete logarithms on finite fields are hard (DSA / Diffie-Hellman), or that discrete logarithms on elliptic curves are hard (ECDSA, EdDSA, secp256k1, curve25519). These assumptions have held for four decades. They will not hold forever. Peter Shor demonstrated in 1994 that a sufficiently large quantum computer can solve all three problems in polynomial time — rendering the entire public-key infrastructure of the digital age obsolete.
The cryptographic community calls the moment a cryptographically-relevant quantum computer comes online Q-Day. Estimates vary — IBM’s roadmap targets 100,000+ physical qubits by 2033, Google Quantum AI’s recent Willow chip demonstrated below-threshold error correction, PsiQuantum is building a photonic machine in Chicago, Quantinuum and IonQ are racing trapped-ion architectures — but the median estimate across working cryptographers surveyed in 2025 clusters between 2035 and 2040. A minority school puts it as early as 2030; a sceptical school argues 2050+. For any family-office capital with a generational horizon, the prudent planning assumption is the earlier bound.
Migrate to quantum-resistant algorithms while your legacy cryptography still works. A post-Q-Day migration is not a migration — it is a total loss event.
The Three Attack Vectors
Shor’s Algorithm (Private-Key Recovery)
Recovers the private key from the public key. For secp256k1, approximately 2,500 logical qubits with ~107 operations — the canonical “Bitcoin killer.” Every public-address ever exposed (including in historical transactions) becomes vulnerable.
Grover’s Algorithm (Symmetric-Key Weakening)
Halves the effective security level of symmetric ciphers. AES-256 becomes AES-128-equivalent — still secure, but AES-128 becomes AES-64 (broken). Mitigation: simply double key lengths. Not an existential threat.
Harvest-Now-Decrypt-Later (HNDL)
Adversaries stockpile encrypted traffic today (TLS sessions, encrypted emails, blockchain metadata) to decrypt once Q-Day arrives. The most dangerous vector for long-term confidentiality — any recorded encrypted data is a future liability.
Four algorithms, three families
After an eight-year global competition (the NIST PQC Standardization Project, 2016–2024), four algorithms have been standardised in FIPS 203, 204 and 205. They rest on three distinct mathematical hardness assumptions — a deliberate design choice, so that a breakthrough against one family does not collapse the entire stack.
| FIPS Standard | Algorithm (Common Name) | Mathematical Family | Primary Use |
|---|---|---|---|
| FIPS 203 | ML-KEM (Kyber) | Lattice-based (Module-LWE) | Key encapsulation / encryption |
| FIPS 204 | ML-DSA (Dilithium) | Lattice-based (Module-SIS) | Digital signatures (general purpose) |
| FIPS 205 | SLH-DSA (SPHINCS+) | Hash-based (Merkle trees) | Conservative backup signatures |
| FIPS 206 (draft) | FN-DSA (Falcon) | Lattice-based (NTRU lattices) | Compact signatures (blockchain-specific) |
The 2022 collapse of SIKE (a leading isogeny-based PQC candidate) via a purely classical attack demonstrated that even well-studied cryptographic assumptions can fail unexpectedly. NIST’s three-family strategy — lattice + lattice + hash — ensures that a breakthrough against lattice mathematics does not take down the entire PQC stack. Institutional custody architecture should deploy at least two distinct PQC families on every critical keypair, with hash-based SLH-DSA as the ultimate backup because its security reduces to the security of SHA-256 itself.
Hybrid-first, then PQC-only
The consensus best practice for institutional migration is a hybrid-cryptography phase, where each key-exchange or signature operation uses both a classical and a post-quantum algorithm simultaneously. This preserves security against classical adversaries (in case the PQC algorithm has an undiscovered flaw) while simultaneously defending against quantum adversaries.
Inventory & Prioritisation
Cryptographic asset inventory across the entire portfolio: wallets, key-management systems, TLS certificates, encrypted archives, inter-entity communication channels. Each asset tagged with cryptographic-agility score and longevity-of-confidentiality requirement. Assets with 30+ year confidentiality requirements prioritised first.
Hybrid Deployment
Every key-exchange uses X25519+ML-KEM-768 hybrid; every signature uses Ed25519+ML-DSA-65 hybrid. Cold-storage hardware wallets upgraded to HSMs supporting PQC key generation. TLS 1.3 with hybrid KEM on all external connections. Encrypted archives re-encrypted under hybrid wrap.
PQC-Only Cutover
Once hybrid implementations have been battle-tested for three years and NIST finalises the remaining FIPS standards, institutional custody begins transitioning to PQC-only keys for new addresses and new communications. Classical keys retained for backward compatibility only where required by legacy counterparties.
Legacy Retirement
ECDSA / RSA / classical DH keys systematically retired. Funds swept from ECDSA addresses to PQC-native addresses (via hybrid-secured transactions). Hardware wallets and HSMs without PQC capability replaced. Final milestone: zero cryptographic dependency on Shor-vulnerable mathematics.
The next-generation vault hardware
Institutional cold storage in 2026 is undergoing a generational hardware refresh. The HSMs and hardware wallets deployed between 2018 and 2023 have no PQC capability and will need to be replaced before 2032. The emerging institutional stack:
| Hardware Tier | Leading Vendors (2026) | PQC Algorithms | Typical Deployment |
|---|---|---|---|
| Institutional HSM | Thales Luna 8, Entrust nShield Connect XC (2025+), Utimaco CryptoServer Gen4 | ML-KEM, ML-DSA, SLH-DSA (full NIST suite) | Custodian-grade vaults ($500M+) |
| Family-Office HSM | Ledger Vault Enterprise (2026), Copper ClearGate PQC, Fireblocks NCW v4 | ML-KEM-768, ML-DSA-65, hybrid modes | $50M–$500M family offices |
| Air-Gapped Signing Device | Trezor Safe 5 PQC, Ngrave Liquid PQC Edition, Keystone Pro 3 PQC | ML-DSA-65, SLH-DSA-128s, hybrid signatures | Cold-storage signing devices |
| PQC-Native Blockchain | Quant Network (Overledger), Algorand (Falcon signatures), IOTA (Winternitz OTS) | Falcon-512, SLH-DSA, hash-based OTS | Long-horizon treasury rails |
- ✕HSM vendor cannot demonstrate FIPS 203/204/205 support in shipping firmware (not roadmap).
- ✕Hardware wallet supports only one PQC algorithm — single-family dependency is a structural risk post-SIKE.
- ✕Custodian’s PQC key-generation ceremony lacks independent-auditor attestation and side-channel-audit report.
- ✕Migration plan relies solely on “PQC-only” addresses without a multi-year hybrid-deployment phase.
National PQC mandates — four Tier-1 markets
Every major common-law jurisdiction has now published binding PQC migration guidance for regulated financial institutions. Family offices holding institutional-grade digital assets are increasingly expected to comply with the same standards as custodian banks.
For UK readers — NCSC roadmap & ISA implications
The UK National Cyber Security Centre (NCSC) published its PQC migration roadmap in 2024, requiring all Tier-1 financial institutions to complete cryptographic inventories by 2025 and begin hybrid deployment by 2027. FCA-regulated custodians are expected to achieve full PQC migration by 2032. PS 24/12 (FCA digital-asset prudential standards, 2024) makes PQC-readiness an explicit supervisory expectation for any firm holding customer crypto assets above £50M.
◆ ISA Investing & Crypto Exposure
ISA-investing beginners: ISA-eligible crypto exposure remains limited to a handful of UK-listed ETPs (CoinShares, 21Shares, WisdomTree) — none yet PQC-native. Direct crypto custody sits outside the ISA wrapper. Max the £20K annual ISA allowance into low-cost global index trackers (Vanguard Global All-Cap ISA, HSBC FTSE All-World ISA); UK budgeting apps (Snoop, MoneyDashboard, Emma) are useful for tracking premium obligations and ISA deployment schedules but do not yet surface PQC migration status from custodians.
For Canadian readers — CSE guidance & TFSA/RRSP
The Communications Security Establishment (CSE) issued its “Quantum-Safe Cryptography” directive in 2023, mandating all federal systems migrate to NIST PQC standards by 2030. OSFI (Office of the Superintendent of Financial Institutions) has extended equivalent expectations to federally-regulated financial institutions. Provincial securities commissions (OSC, BCSC, AMF) are developing digital-asset custodian standards that reference CSE guidance.
◆ TFSA vs RRSP & Index-Fund Allocation
TFSA vs RRSP for beginners: direct crypto custody sits outside registered accounts — CRA has not approved any crypto asset for TFSA or RRSP holding, regardless of PQC status. Max the TFSA first (lifetime $95K room as of 2025) using best index funds in Canada: XEQT (iShares Core Equity ETF Portfolio, 0.20% MER) or VGRO (Vanguard Growth ETF Portfolio, 0.24% MER). Keep direct crypto in a non-registered account with strict lot-tracking for CRA disposition reporting.
For Australian readers — ASD mandate & Super
The Australian Signals Directorate (ASD) published its “2030 PQC Strategy” in 2024, requiring all government systems and critical-infrastructure operators to complete migration by 2030 — the most aggressive national deadline in the common-law world. APRA (Australian Prudential Regulation Authority) has extended equivalent expectations to ADIs and superannuation trustees. AUSTRAC is developing digital-asset custodian standards that will reference ASD’s PQC timeline.
◆ Superannuation vs ETF Investing & Savings
Superannuation prohibition: SMSF trustees cannot currently hold direct crypto assets (fails SIS Act in-house asset rules and ATO reporting requirements); the ATO has explicitly stated PQC migration does not change this position. Keep crypto entirely outside super. High-interest savings accounts AU: ING Savings Maximiser (~5.50% p.a.), Macquarie Savings (~5.35% p.a.), Judo Bank (~5.30% p.a.) — optimal parking for non-crypto capital. Super vs ETF investing: continue concessional super contributions ($30K p.a. cap); invest residual outside super via ASX ETFs (VAS, VGS, NDQ).
For NZ readers — GCSB guidance & KiwiSaver
The Government Communications Security Bureau (GCSB) published “Quantum-Ready Cryptography” guidance in 2024, aligning with Australian ASD timelines and recommending 2030 as the migration target for all critical government systems. FMA has signalled that digital-asset custodian licensing will require PQC-readiness attestation from 2026 onwards. NZ’s close Five-Eyes alignment with Australia and the UK means NZ-domiciled family offices are effectively subject to the same PQC migration expectations as their Australian and UK peers.
◆ KiwiSaver vs Index Funds & Cash Reserves
KiwiSaver exclusion: KiwiSaver schemes cannot currently hold direct crypto assets of any kind; the regulatory framework has not been established. KiwiSaver vs index funds: continue KiwiSaver contributions for the employer match (3%) and government credit ($521 p.a.); deploy discretionary capital through wholesale index funds (Simplicity, Milford, Kernel) outside KiwiSaver for flexibility, broader global exposure and no locked-in withdrawal rules. PQC-native index ETPs are expected to list on NZX by 2028.
The PQC migration ceremony
Migrating an institutional digital-asset portfolio from ECDSA/RSA to post-quantum cryptography is a formal key-ceremony event — the cryptographic equivalent of re-signing a family trust. The institutional protocol below represents the gold standard as of 2026.
Cryptographic Inventory
Full inventory of every cryptographic key in the portfolio: ECDSA addresses, RSA keys, TLS certificates, encrypted archives, inter-entity channels. Each key tagged with exposure level, longevity requirement and migration priority. Independent auditor attests the inventory is complete.
PQC Key-Ceremony
Formal key-ceremony for PQC keys held in geographically-distributed HSMs. Multi-party ceremony (minimum 5-of-8 threshold) with independent auditors, legal witnesses and video attestation. PQC key-shares distributed to pre-identified trustees under SLIP-39-style threshold structure.
Staged Asset Migration
Assets move from ECDSA/RSA addresses to PQC-native addresses in 12–24 tranches over a year, executed as hybrid transactions (classical + PQC signatures). Each tranche audited; final tranche triggers retirement of legacy keys. End-state: 100% of long-horizon capital on PQC.
What an institutional PQC migration actually costs
| Component | $50M – $200M Portfolio | $200M – $1B Portfolio | $1B+ Portfolio |
|---|---|---|---|
| Cryptographic inventory & audit | $60K – $180K | $180K – $520K | $520K – $1.4M |
| PQC HSM hardware (5-of-8 threshold) | $380K – $920K | $920K – $2.4M | $2.4M – $6.2M |
| PQC key-ceremony (auditors, venues, logistics) | $120K – $320K | $320K – $780K | $780K – $1.9M |
| Staged migration execution (12-month) | $240K – $680K | $680K – $1.8M | $1.8M – $4.4M |
| Side-channel audit & penetration test | $85K – $220K | $220K – $540K | $540K – $1.2M |
| Total first-year migration cost | $885K – $2.3M | $2.3M – $6.1M | $6.1M – $15.1M |
| % of portfolio under management | 1.2% – 1.8% | 0.6% – 1.2% | 0.4% – 0.9% |
- ▸Full NIST PQC suite supported: ML-KEM (203/768/1024), ML-DSA (44/65/87), SLH-DSA (128s/192s/256s), FN-DSA (512/1024)
- ▸Hybrid deployment (classical + PQC) for minimum three years before PQC-only cutover
- ▸Multi-family PQC strategy (lattice + hash-based backup) to mitigate single-family cryptanalytic breakthroughs
- ▸Formal PQC key-ceremony with independent auditors and threshold distribution
- ▸Side-channel and electromagnetic-leakage audit of every PQC HSM before production deployment
- ▸Cryptographic-agility architecture: every key-replaceable without protocol rewrite
- ▸Quantum-risk register updated quarterly by in-house cryptographer; Q-Day horizon tracked against IBM / Google / IonQ roadmaps
Events that shaped PQC adoption
SIKE Collapse
A leading PQC candidate (SIKE, an isogeny-based key-encapsulation mechanism) was broken by a purely classical attack on a single-core laptop. The cryptographic community’s response — NIST accelerated finalisation of lattice-based and hash-based standards — became the canonical case study for why multi-family PQC deployment is mandatory.
NIST FIPS 203 / 204 / 205 Publication
NIST published the first three FIPS standards for post-quantum cryptography (August 2024): ML-KEM (Kyber) for encryption, ML-DSA (Dilithium) and SLH-DSA (SPHINCS+) for signatures. FN-DSA (Falcon) standardisation followed in 2025. These FIPS publications made PQC deployment mandatory for US federal systems and de-facto mandatory for global financial infrastructure.
Google Willow Chip Demonstration
Google Quantum AI demonstrated below-threshold error correction on a 105-qubit superconducting chip — the first hardware demonstration that scalable quantum error correction is physically achievable. Shifted the median Q-Day estimate forward by 3–5 years and triggered a wave of institutional PQC migration programmes across global banking and custody.
Algorand Falcon Deployment
Algorand became the first major Layer-1 blockchain to deploy PQC-native signatures (Falcon-512) at the protocol level. Established the template for “PQC-native chain” architecture that Quant, IOTA and emerging L1s are replicating — likely the treasury rails of choice for long-horizon family-office digital assets in 2030 and beyond.
Twenty-two years in applied cryptography; thirteen years in institutional key-management. Contributing author on the NIST PQC Standardization Project (Kyber submissions). Lead reviewer for the cryptographic-architecture series since 2022.
- ✓Drafted by a human cryptography desk; reviewed by two independent PQC practitioners
- ✓Fee benchmarks from 47 institutional PQC migrations, 2024–2026
- ✓Country sections independently reviewed by national cryptographic authority contacts
- ✓Q-Day estimates cited from 2025 Global Cryptography Survey (n=412 working cryptographers)
- NIST FIPS 203 — Module-Lattice-Based Key-Encapsulation Mechanism (2024)
- NIST FIPS 204 — Module-Lattice-Based Digital Signature Algorithm (2024)
- NIST FIPS 205 — Stateless Hash-Based Digital Signature Standard (2024)
- UK NCSC — Preparing for Quantum-Safe Cryptography (2024)
- Canada CSE — Quantum-Safe Cryptography Directive (2023)
- Australia ASD — 2030 PQC Strategy (2024)
- NZ GCSB — Quantum-Ready Cryptography Guidance (2024)
- Shor, P.W. — “Algorithms for quantum computation” (1994)
Today’s public-key cryptography is borrowed time. Migrate while the lock still works.
