The quantum threat
When will quantum computers break RSA and elliptic-curve cryptography?
Nobody knows the date, and it does not need to be known to act. Shor’s algorithm breaks RSA, Diffie-Hellman and elliptic-curve cryptography on a large, fault-tolerant quantum computer, which does not exist today. What matters is Mosca’s inequality: if data must stay secret for x years and migration takes y years, the data is already at risk when x + y exceeds the time until such a machine exists. Standards bodies have set dates accordingly: NIST’s draft transition plan deprecates RSA and elliptic-curve algorithms at the 112-bit security level after 2030 and disallows quantum-vulnerable public-key algorithms after 2035.
What is “harvest now, decrypt later”?
It is the practice of recording encrypted traffic today in order to decrypt it once a quantum computer is available. It turns the quantum threat into a present problem for any data that must remain confidential for years: health records, industrial designs, defense traffic, long-term keys. Key exchange is the exposed part, which is why hybrid post-quantum key exchange is being deployed first. Signatures are different: a forged signature is only useful once the quantum computer exists, but long-lived trust anchors such as firmware-signing keys must be replaced before then.
Which post-quantum algorithms has NIST standardized?
In August 2024 NIST published three post-quantum standards: FIPS 203 (ML-KEM, a key-encapsulation mechanism derived from CRYSTALS-Kyber), FIPS 204 (ML-DSA, a signature scheme derived from CRYSTALS-Dilithium) and FIPS 205 (SLH-DSA, a hash-based signature scheme derived from SPHINCS+). ML-KEM and ML-DSA rest on lattice problems (Module Learning With Errors). In March 2025 NIST selected HQC, a code-based scheme, as a second key-encapsulation mechanism, and a signature standard derived from Falcon (FN-DSA) is in preparation.
AI and cryptanalysis
Can AI break post-quantum cryptography?
Not today. No published AI-based attack comes close to breaking ML-KEM or ML-DSA at their standardized parameters. What exists is a growing line of machine-learning attacks on Learning With Errors (SALSA, PICANTE, VERDE, FRESCA) that recover secrets in weaker settings, such as sparse binary or ternary secrets. The open question is not whether a neural network will break Kyber directly, but whether AI systems can search the space of attack strategies faster and more broadly than human cryptanalysts, and find combinations that lower the concrete security of a scheme below its claimed level. That is the question our research note sets out.
Is ML-KEM secure against machine-learning attacks?
At its standardized parameters, yes, as far as published research shows. The machine-learning attacks on LWE published since 2022 target settings that ML-KEM does not use, such as sparse secrets, and remain far below its security level. Concrete security is estimated with tools such as the Lattice Estimator, which models the best known attacks. An attack strategy that improves on those models would lower the estimate, and that is exactly what AI-driven search tests.
How can AI be used for cryptanalysis?
In three ways, in increasing order of ambition. As a statistical tool: models trained to recover secrets from samples, as in the SALSA line of work. As an assistant that automates known attacks: choosing parameters, running lattice reduction, reading estimator output. And as a search engine over attack programs: an evolutionary system in which a language model proposes candidate attack strategies, an objective evaluator scores their cost in security bits, and the best candidates are kept and recombined. The third approach, inspired by AlphaEvolve, is the one Agades Technologies develops with AgadesEvolve.
What is the Lattice Estimator?
The Lattice Estimator is an open-source tool that estimates the concrete security of Learning With Errors and related lattice problems against the best known attacks, such as primal, dual and hybrid lattice-reduction attacks. It returns the cost of each attack in bits. It grew out of the LWE estimator of Albrecht, Player and Scott (2015) and is widely used to choose and check parameters for lattice-based schemes. In AgadesEvolve it is the objective evaluator: a candidate attack strategy is better if it lowers the estimated cost.
Can AI find vulnerabilities in cryptographic implementations?
Yes, and this is closer to practical use than breaking the mathematics. Most real-world cryptographic failures come from implementations and deployments: weak or reused keys, deprecated protocol versions, missing certificate validation, side channels. AI systems can read binaries, configurations and protocol traces at scale, locate the cryptographic code paths, and propose and test hypotheses. What makes a finding trustworthy is an oracle: in cryptanalysis it is the Lattice Estimator; in software it is the target system itself, which confirms or refutes the finding. See vulnerability discovery as a search over programs.
Migration
When do organizations have to migrate to post-quantum cryptography?
The reference dates are 2030 and 2035. NIST’s draft transition plan (IR 8547) deprecates RSA and elliptic-curve algorithms at the 112-bit security level after 2030 and disallows quantum-vulnerable public-key algorithms after 2035. The EU coordinated roadmap asks Member States to start the transition by the end of 2026, to migrate high-risk use cases, including critical infrastructure, by the end of 2030, and as much as feasible by 2035. In regulated sectors, NIS2 and DORA already require policies on the use of cryptography.
What is a cryptographic bill of materials (CBOM)?
A CBOM is an inventory of the cryptography in a system: algorithms, key sizes, protocols, certificates, libraries, and where each one is used. It extends the software bill of materials (SBOM) to cryptographic assets and is supported by the CycloneDX standard since version 1.6. A CBOM is the starting point of any migration: without it, an organization cannot know which systems depend on RSA or elliptic curves, or prioritize them. The hard part is building it, because cryptography is often buried in firmware, third-party libraries and configuration files. How we build one for device fleets.
How can AI help migrate to post-quantum cryptography?
Mainly by building and maintaining the inventory at scale. An agentic AI system can drive analysis tools over firmware images, configurations, certificates and network captures, identify the cryptographic assets, classify them as quantum-vulnerable or not, and prioritize them against the 2030 deadline by data lifetime, device lifetime and exposure. The output is a CBOM with evidence for each finding, and a migration plan. People keep the decisions; the AI removes the manual reading that makes inventories slow and incomplete. SecAgent is Agades’ pipeline for this, from firmware and binaries to a CBOM and a migration plan.
What is crypto-agility?
Crypto-agility is the ability to change cryptographic algorithms, keys and parameters without redesigning or replacing the system. It matters because the post-quantum transition will not be the last one: parameters will be revised and some schemes may weaken. For device fleets, it means that algorithms can be updated over the air, that update signatures are verified with keys that can themselves be rotated, and that protocols negotiate algorithms rather than hard-code them.
IoT and telecom
Why is post-quantum migration harder for IoT?
Because IoT devices are long-lived, numerous and constrained. A device deployed today may still be in the field after 2035; fleets count thousands to millions of units across vendors and firmware generations; and many devices have little memory, little bandwidth and update channels that were not designed to change algorithms. Post-quantum keys and signatures are also larger: an ML-KEM-768 public key is 1,184 bytes and an ML-DSA-65 signature 3,309 bytes, against 32 bytes for an X25519 key share and 64 bytes for an ECDSA P-256 signature. Post-quantum migration for IoT fleets covers the full approach.
Can a SIM card be used to inventory a device’s cryptography?
No. A SIM (UICC or eUICC) is a secure element, isolated by design. It exchanges APDU commands with the device and can request a few services through the SIM Toolkit, but it cannot read the device’s application processor, operating system or firmware, which is where TLS stacks, update signatures and device certificates live. An inventory of an IoT fleet starts from the outside (network scans, endpoints, handshakes and certificates), then moves to traffic captures and firmware analysis.
Is mobile network authentication vulnerable to quantum computers?
Mostly not. SIM-based authentication and air-interface encryption use symmetric algorithms (MILENAGE, TUAK, AES, SNOW 3G, ZUC), which quantum computers weaken only moderately; 256-bit keys address that. The quantum-vulnerable parts of mobile networks are public-key: the 5G subscriber-identifier concealment (SUCI, based on elliptic-curve ECIES), the PKI behind remote SIM provisioning, and the TLS and IPsec links between network functions and back-end platforms.
Which sectors are most exposed?
Sectors with long-lived devices and long-lived secrets: telecom and IoT; energy, where smart meters and substations use protocols such as DLMS/COSEM and IEC 62351 that rely on RSA or elliptic-curve cryptography and certificates; health, with connected medical devices certified for long lifecycles; industry, aerospace and defense. In these sectors, devices deployed today will still be operating when quantum-vulnerable algorithms are disallowed.
About Agades Technologies
What does Agades Technologies do?
Agades Technologies builds AI systems for cryptographic security. AgadesEvolve is an evolutionary search engine for post-quantum cryptanalysis: a language model proposes attack programs, the Lattice Estimator scores them, the best survive and recombine. SecAgent is a program-analysis pipeline that takes firmware and binaries to a cryptographic bill of materials and a post-quantum migration plan. Agades works with security teams on post-quantum engagements and develops Agades PQC Gym, an open benchmark for attack strategies on LWE and MLWE.
Sources
- NIST, FIPS 203, FIPS 204 and FIPS 205, August 2024.
- NIST, IR 8547, Transition to post-quantum cryptography standards, initial public draft, November 2024.
- NIS Cooperation Group, A coordinated implementation roadmap for the transition to post-quantum cryptography, June 2025.
- M. Mosca, Cybersecurity in an era with quantum computers: will we be ready?, IEEE Security & Privacy, 2018.
- E. Wenger et al., SALSA: attacking lattice cryptography with transformers, NeurIPS 2022; C. Li et al., SALSA PICANTE, ACM CCS 2023; C. Li et al., SALSA VERDE, NeurIPS 2023; S. Stevens et al., SALSA FRESCA, 2024.
- M. Albrecht, R. Player, S. Scott, On the concrete hardness of Learning with Errors, Journal of Mathematical Cryptology, 2015; Lattice Estimator.
- Google DeepMind, AlphaEvolve, 2025.
- OWASP CycloneDX, CBOM support since specification 1.6, 2024.
- ETSI TS 102 223 (card application toolkit); 3GPP TS 31.111 (USIM application toolkit); 3GPP TS 33.501 (5G security, SUCI); ISO/IEC 7816-4 (APDU).