{"id":23456,"date":"2026-08-21T11:08:15","date_gmt":"2026-08-21T05:23:15","guid":{"rendered":"https:\/\/eng.dragonmedia.com.np\/?p=23456"},"modified":"2026-08-21T11:09:30","modified_gmt":"2026-08-21T05:24:30","slug":"internet-security-is-changing-before-quantum-computers-arrive-why-the-world-is-moving-toward-the-post-quantum-era","status":"publish","type":"post","link":"https:\/\/eng.dragonmedia.com.np\/?p=23456","title":{"rendered":"Internet Security Is Changing Before Quantum Computers Arrive: Why the World Is Moving Toward the Post-Quantum Era<\/strong>"},"content":{"rendered":"

Adrian Mercer<\/strong><\/p>\n

When you transfer money through mobile banking, shop online, submit personal information on a government website, send an email or log in to social media, a mathematical security system works behind the scenes to protect your information. Much of the modern digital world depends on this system of encryption, or cryptography.<\/p>\n

But the world is now preparing for a technological shift that could eventually weaken many of the digital security systems considered safe today. That technology is quantum computing.<\/p>\n

Quantum computers are not currently breaking into bank accounts. A large, reliable quantum computer with that level of capability has not yet been built. However, major technology powers and cybersecurity institutions, including those in the United States and the United Kingdom, have already begun preparing to move from existing encryption systems toward post-quantum cryptography, designed to withstand attacks from future quantum computers.<\/p>\n

This is not an ordinary software update. It could become one of the largest security transformations since the creation of the internet.<\/p>\n

Why are quantum computers different?<\/p>\n

Today\u2019s computers process information in bits. A bit exists as either 0 or 1. Quantum computers, however, use quantum bits, or qubits, which can exploit special properties of quantum physics to perform certain kinds of complex calculations in fundamentally different ways from conventional computers.
\n\"\"
\nThis does not mean quantum computers will be faster than today\u2019s supercomputers at every task. There is little reason to use a quantum computer simply to write an email, watch a film or perform routine calculations.<\/p>\n

But for certain highly complex mathematical problems, a sufficiently large and fault-tolerant quantum computer could achieve extraordinary capabilities.<\/p>\n

This is where the cybersecurity challenge begins.<\/p>\n

Public-key security systems such as RSA and elliptic curve cryptography are widely used today in internet communications, banking, digital signatures, government systems and secure communications. Their security depends on mathematical problems that are extremely difficult for conventional computers to solve.<\/p>\n

In 1994, mathematician Peter Shor developed what became known as Shor\u2019s algorithm, showing that a sufficiently powerful quantum computer could solve the underlying mathematical problems behind several widely used public-key cryptographic systems far more efficiently.<\/p>\n

The danger, therefore, is not simply that a quantum computer might \u201chack\u201d a website. Once sufficiently powerful systems become available, some of the mathematical foundations that protect digital identity, secure communications and public-key encryption could be challenged.<\/p>\n

Will all encryption become insecure at once?<\/p>\n

No.<\/p>\n

The most significant quantum threat is expected to affect public-key systems such as RSA and elliptic curve cryptography. These technologies are extensively used to establish secure connections, issue digital certificates and verify digital signatures.<\/p>\n

Quantum computing affects symmetric encryption systems such as AES differently. Grover\u2019s algorithm can accelerate certain search processes, but symmetric cryptography can remain comparatively resilient when sufficiently large encryption keys are used.<\/p>\n

That is why the immediate global priority is replacing vulnerable forms of public-key cryptography.<\/p>\n

The \u201charvest now, decrypt later\u201d threat<\/p>\n

One of the most serious risks does not begin in the future. It begins today.<\/p>\n

In cybersecurity, this is known as \u201charvest now, decrypt later.\u201d It refers to the possibility that an intelligence service, criminal organisation or hostile cyber group could collect encrypted sensitive information today and store it for future decryption.<\/p>\n

They may not currently possess the technology needed to read that information. But if sufficiently powerful quantum computers become available a decade from now, they may attempt to decrypt data collected years earlier.<\/p>\n

The details of an ordinary online purchase may have little value ten years later. But diplomatic communications, military plans, biometric information, national security records, confidential technological designs, research material, long-term commercial secrets and intelligence data can remain sensitive for decades.<\/p>\n

The important question, therefore, is not simply when a powerful quantum computer will arrive. It is also how long information stolen today needs to remain confidential.<\/p>\n

What is the new security system?<\/p>\n

Because of this risk, the US National Institute of Standards and Technology, or NIST, began a global process in 2016 to identify encryption methods capable of resisting quantum attacks.<\/p>\n

After years of testing, NIST formally released its first three major post-quantum cryptographic standards in 2024.<\/p>\n

ML-KEM is designed to establish shared encryption keys securely. It is based on a system previously known as CRYSTALS-Kyber.<\/p>\n

ML-DSA was developed for digital signatures and was previously known as CRYSTALS-Dilithium.<\/p>\n

SLH-DSA is another digital signature system, based on hash-based cryptographic techniques.<\/p>\n

NIST has also continued evaluating additional alternatives. In 2025, a key-establishment algorithm known as HQC was selected for future standardisation, while further digital signature methods remained under evaluation into 2026.<\/p>\n

This means post-quantum security is no longer merely a theoretical subject confined to research laboratories. Standards now exist, and the transition into real-world systems has begun.<\/p>\n

Why is 2035 important?<\/p>\n

The United Kingdom\u2019s National Cyber Security Centre has advised large organisations to identify where legacy cryptography is used across their digital infrastructure and develop initial migration plans by 2028.<\/p>\n

By 2031, highly sensitive and critical systems are expected to be prioritised for migration, with the goal of completing most post-quantum transitions by 2035.<\/p>\n

The United States has also been working toward a long-term transition of national security systems to quantum-resistant technologies by 2035.<\/p>\n

The reason is straightforward: designing new algorithms is only one part of the challenge.<\/p>\n

Encryption is not limited to websites. It is embedded in servers, mobile applications, routers, smart cards, digital certificates, hardware security modules, software updates, industrial control systems, telecommunications infrastructure, satellite communications and millions of connected devices.<\/p>\n

Large organisations may not even have a complete picture of what cryptographic technology is being used across all their systems.<\/p>\n

A transition lasting a decade is therefore not unusual.<\/p>\n

How far has quantum computing progressed?<\/p>\n

Quantum computing is advancing rapidly, but no quantum computer built so far is capable of practically breaking the major encryption systems that currently protect the internet.<\/p>\n

Qubits are extremely sensitive. Environmental interference, temperature fluctuations and other disturbances can introduce errors. Building a useful large-scale quantum computer therefore requires far more than simply increasing the number of physical qubits. Effective error correction and stable computation over long periods are also necessary.<\/p>\n

Companies including IBM have published roadmaps for developing large and fault-tolerant quantum systems. But commercial targets should not be interpreted as precise scientific predictions.<\/p>\n

No one can yet state with certainty the year in which a quantum computer capable of breaking today\u2019s major cryptographic systems will become available.<\/p>\n

Cybersecurity planning, however, does not begin after a threat becomes operational. That is why the world is changing its systems now.<\/p>\n

Why does this matter for Nepal?<\/p>\n

Nepal is becoming increasingly dependent on digital systems. Banks and financial institutions, mobile banking, digital payments, passports, national identity cards, taxation systems, government records, telecommunications, citizen databases, health records and public services increasingly rely on digital infrastructure.<\/p>\n

Many of these systems use international software, hardware, digital certificates and cryptographic technologies.<\/p>\n

Nepal therefore cannot remain isolated from the post-quantum transition simply because it does not build its own quantum computers.<\/p>\n

As global browsers, cloud services, operating systems, banking equipment, security hardware and network infrastructure move toward post-quantum technologies, systems used in Nepal will also have to change.<\/p>\n

But that does not mean security will improve automatically.<\/p>\n

The government, Nepal Rastra Bank, banks and financial institutions, telecommunications providers, security agencies and major digital service providers can begin by creating an inventory of the cryptographic technologies currently used in their systems.<\/p>\n

The first priority should be identifying information that must remain confidential for many years.<\/p>\n

Institutions should then determine which systems depend on RSA or elliptic curve cryptography, how digital certificates are managed, whether existing security hardware can support new algorithms, and whether software suppliers have post-quantum migration plans.<\/p>\n

This process is often referred to as creating a cryptographic inventory.<\/p>\n

Another important concept is cryptographic agility. Systems should be designed so that if an algorithm becomes weak, it can be replaced without rebuilding the entire infrastructure.<\/p>\n

Why should we neither rush nor delay?<\/p>\n

Post-quantum cryptography is new, and it is not without challenges.<\/p>\n

The keys and signatures used in some new algorithms can be larger than those used in existing systems. Performance issues may arise in certain devices, and poor implementation can introduce entirely new security weaknesses.<\/p>\n

Replacing all existing cryptography overnight would therefore not be a sensible solution.<\/p>\n

During the transition, hybrid systems that use both conventional and post-quantum cryptography may be adopted. This can provide an additional layer of protection if unexpected weaknesses are later discovered in a new algorithm.<\/p>\n

But waiting without preparation could be even more dangerous.<\/p>\n

Historically, NIST has noted that integrating new cryptographic standards across global information systems can take between 10 and 20 years. Even though the timing of the quantum threat remains uncertain, there is a strong case for beginning the transition now.<\/p>\n

The real lesson of the quantum era<\/p>\n

Discussions about quantum computing often focus on its extraordinary computing potential, drug development, discovery of new materials, complex scientific simulations and possible links with artificial intelligence.<\/p>\n

But its first major global impact may not come from quantum computers entering ordinary households.<\/p>\n

It may come from forcing the world to redesign the security architecture of the internet.<\/p>\n

We are now living through an unusual transition period.<\/p>\n

Existing encryption still works. A quantum computer capable of breaking it does not yet exist. Yet governments, technology companies and cybersecurity institutions are already preparing to replace parts of the existing security infrastructure rather than waiting for such a machine to arrive.<\/p>\n

The reason is simple.<\/p>\n

In digital security, one of the costliest mistakes is to begin preparing only after the threat has already arrived.<\/p>\n

The quantum era has not fully arrived. But the work of rebuilding the internet\u2019s locks for that era has already begun.<\/p>\n

\n\t\t\t
\n\t\t\t <\/div><\/div>\n\t\t