AI and the Future of Cryptography

1. The baseline: two interacting but distinct changes

The title “AI and the future of cryptography” can imply that AI will soon replace or break cryptographic algorithms. The cited evidence does not establish that prediction. It supports a more careful framing: AI is changing the security properties and operational context of software and data systems, while quantum computing is the explicitly documented future threat driving post-quantum cryptography (PQC) migration. These developments may interact, but they should not be treated as the same problem.12

NIST describes AI security and resilience as an active research area in which challenges and potential solutions are changing rapidly. AI systems inherit familiar confidentiality, integrity, availability, software, and hardware risks, while also exposing a more complex attack surface that includes machine-learning-specific attacks and abuses enabled by AI systems. At the same time, AI may give defenders new tools for addressing vulnerabilities and may enhance the capabilities of attackers targeting information-technology and operational-technology environments.1

The quantum baseline is different. NIST states that quantum computing remains in its infancy, that researchers face major technical hurdles, and that the ultimate capability of quantum computers is an open question. Nevertheless, advanced quantum computers remain a strong possibility and could have a major impact on present-day encryption. This is why the appropriate posture is neither certainty that a cryptographically relevant quantum computer (CRQC) is imminent nor complacency that migration can wait indefinitely.3

2. What is established today

Traditional public-key cryptography includes algorithms based on integer factorization, finite-field discrete logarithms, and elliptic-curve discrete logarithms. RFC 9794 uses “postquantum” for asymmetric algorithms designed to be secure against attacks using quantum computers as well as classical computers. It also cautions that post-quantum algorithms are not guaranteed never to be compromised: as with all cryptography, new classical or quantum attacks may be found.4

NIST’s multiyear, international standardization effort evaluated candidate algorithms through public analysis and successive rounds of review. NIST released its first three finalized PQC standards in 2024. The principal standards are FIPS 203, ML-KEM for key establishment, FIPS 204, ML-DSA for digital signatures, and FIPS 205, SLH-DSA for stateless hash-based digital signatures. NIST expects these three standards to provide the foundation for most deployments, while continuing work on additional candidates and possible backups.5

The operational implication is immediate rather than predictive. NIST says organizations should begin applying the standards now and identify systems that use vulnerable algorithms so those systems can be replaced or updated. The cited migration material also states that, under the transition timeline in NIST IR 8547, quantum-vulnerable algorithms will be deprecated and ultimately removed from NIST standards by 2035, with high-risk systems transitioning earlier.35

3. Credible AI drivers and alternative outcomes

An evidence-led scenario analysis should separate drivers from outcomes. The evidence supports several drivers: AI capabilities may improve the speed or scale of defensive analysis; AI may increase the capability of adversaries; AI systems themselves may be attacked or misused; and cryptographic migration will require analysis across large, heterogeneous technology estates. None of these drivers proves that AI will discover a practical break in a particular cryptographic algorithm. They do justify planning for faster-changing attack, discovery, testing, and response cycles.12

Three broad outcomes are therefore plausible. In a defensive-acceleration scenario, AI helps teams discover cryptographic dependencies, analyze code and configurations, test implementations, and prioritize remediation. In an adversarial-acceleration scenario, attackers use AI to scale reconnaissance, exploit development, social engineering, or attacks against AI-enabled and conventional systems. In a mixed scenario, both sides improve while assurance, governance, and implementation quality become the limiting factors. The cited evidence supports the direction of these scenarios, but not their timing, probability, or relative magnitude.1

4. Dependencies and uncertainties that change the decision

The urgency of a cryptographic decision depends on more than the date of a future technology event. Relevant dependencies include the confidentiality lifetime of data, the operational lifetime of products that cannot be updated or replaced, exposure of stored ciphertext to later decryption, signing systems embedded in long-lived products, supplier and protocol support, and the organization’s ability to test and deploy replacements. RFC 9794 specifically identifies stored data that may later be decrypted by an attacker with a CRQC and long-lived signing products as risks.4

There are also technical uncertainties. The quantum computing field may or may not overcome its major hurdles, and the evidence does not quantify when a CRQC might appear. PQC algorithms have different performance and implementation characteristics from traditional algorithms. ETSI notes concerns about the maturity of cryptanalysis for some families, the possibility of implementation mistakes, and the continuing development of side-channel protections. RFC 9794 likewise emphasizes that post-quantum status describes intended security properties, not an unconditional guarantee.64

AI adds a separate assurance dependency. NIST says existing frameworks and guidance do not yet comprehensively address all concerns involving evasion, model extraction, membership inference, availability, other machine-learning attacks, the complex AI attack surface, or abuses enabled by AI. Organizations using AI to support cryptographic analysis should therefore treat its outputs as inputs to controlled engineering and review processes, not as automatic proof of security.1

5. Hybrid cryptography: useful transition mechanism, not a default guarantee

Hybrid schemes combine post-quantum and traditional components. ETSI identifies two common motivations: hybrid security, where a construction is intended to remain secure if at least one component remains secure, and hybrid interoperability, where traditional and post-quantum-aware clients can coexist during a gradual migration. This can be valuable in large or public systems where all clients cannot be updated simultaneously.6

Hybrid deployment has costs and conditions. ETSI reports that pairing a PQC algorithm with a traditional elliptic-curve algorithm can reduce bandwidth, computation, and latency overheads in some cases, but protocol, implementation, and key-management complexity increases. Hybrid schemes must be designed carefully; ad hoc constructions can introduce weaknesses, and a hybrid-interoperability design may not provide the same security guarantees as a hybrid-security design. Negotiation also needs protection against downgrade attacks.6

This makes hybridization a design and assurance decision, not a checkbox. Teams should identify whether the objective is security, interoperability, or both; specify the security guarantee if a component fails; examine negotiation and downgrade behavior; test performance and failure modes; and ensure that certificates, key management, libraries, devices, and suppliers support the intended protocol. A pure PQC mode may be appropriate in some contexts, while a carefully engineered hybrid mode may be appropriate in others.6

6. Actions enterprises can take now

The first action is to establish a cryptographic inventory. Identify applications, protocols, libraries, certificates, devices, services, suppliers, and data flows that use public-key encryption, key establishment, signatures, or other cryptographic functions. Record algorithm dependencies, ownership, update and replacement paths, data-retention requirements, product end dates, and whether a system can support a staged or hybrid transition. NIST’s migration guidance specifically points to finding and prioritizing vulnerable systems and to alerting technology teams and vendors.35

Next, prioritize by consequence and time. Give early attention to data that must remain confidential for many years, systems with long replacement cycles, systems that cannot be updated, critical services, externally exposed trust relationships, and signing mechanisms whose validity extends across a product’s operational life. This approach does not require predicting the arrival date of a CRQC; it uses the consequences of delay and the practical duration of migration as decision variables.435

Create a current profile and a target profile for cryptographic readiness. NIST CSF 2.0 defines a current profile as the outcomes an organization is achieving or attempting to achieve, and a target profile as the desired outcomes selected and prioritized for its risk-management objectives. The framework describes comparing current and target profiles, analyzing gaps, and creating an action plan. A cryptography-focused profile can make assumptions, ownership, dependencies, risk tolerance, legal and contractual requirements, and progress visible to executives and delivery teams.2

1. Inventory cryptographic use and classify data, services, products, and suppliers by sensitivity, longevity, criticality, and replaceability.
2. Map dependencies and identify where traditional algorithms, certificates, protocols, firmware, libraries, or hardware constrain migration.
3. Define target states for key establishment, authentication, signatures, certificates, key management, and operational monitoring, using approved standards and documented exceptions.
4. Run controlled pilots that measure interoperability, bandwidth, computation, latency, failure handling, downgrade resistance, and operational support.
5. Engage vendors and partners early, require credible transition information, and record unsupported or end-of-life dependencies as risks.
6. Use AI, where appropriate, to assist discovery or analysis only within governed workflows that include validation, access control, auditability, and human approval.
7. Review signals regularly and update the plan as standards, implementations, threat intelligence, supplier support, and organizational priorities change.

7. Decision signals and governance

A useful monitoring set combines technical, organizational, and external signals. Technical signals include successful PQC or hybrid tests, measurable performance effects, implementation vulnerabilities, downgrade findings, and the availability of supported libraries, devices, certificates, and protocols. Organizational signals include inventory coverage, systems without an upgrade path, supplier commitments, data-retention changes, and progress against target profiles. External signals include changes in standards, newly identified attacks on algorithms or implementations, developments in quantum computing, and evidence that AI-enabled threats or defenses are changing operational risk.2

Governance should connect these signals to risk decisions. NIST CSF 2.0 places organizational context, stakeholder expectations, legal and contractual requirements, risk priorities, constraints, assumptions, and risk tolerance within the Govern function. The same logic applies to AI-assisted cryptographic work: define who may use AI, which data may be exposed to it, what testing is required, how outputs are reviewed, and who accepts residual risk. NIST’s AI RMF is intended for voluntary use to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI systems.2

8. Limits of this analysis

The evidence supports preparation, standards-based migration, and risk governance. It does not provide a probability distribution for a CRQC, a quantified estimate of AI’s future cryptanalytic capability, or a universal algorithm and protocol choice for every enterprise. It also does not establish that every hybrid design is safer than a nonhybrid design, or that every AI use in security produces net benefit. Decisions must be validated against the organization’s systems, requirements, implementation quality, and supplier environment.3164

Conclusion

The future of cryptography under AI is best managed as an evidence-led set of scenarios, not as a single prediction. AI can increase both defensive capacity and attacker capability, while AI systems introduce security and resilience risks that remain an active research area. Quantum computing supplies the clearest documented rationale for cryptographic migration: its ultimate capability and timing are uncertain, but the consequences for current encryption could be significant, and finalized PQC standards are available now. Enterprises should build visibility, prioritize long-lived and critical dependencies, test carefully designed migration and hybrid options, govern AI-assisted work, and use monitored signals to adapt their plans.1352