Future Research Directions

1. The current baseline: standards exist, the threat date does not

Future research begins from an important distinction: the existence of a credible risk does not establish a date for the event that would trigger it. The mathematical problems underlying many asymmetric Internet algorithms—integer factorization and discrete logarithms over finite fields or elliptic curves—would be vulnerable to Shor’s algorithm on a sufficiently large general-purpose cryptographically relevant quantum computer. Current predictions vary on when, or if, such a machine will exist. The evidence therefore supports preparation, not a prediction of arrival.12

The present technical baseline is more concrete. In August 2024, NIST released three principal post-quantum cryptography standards: FIPS 203, the module-lattice-based ML-KEM key-encapsulation mechanism; FIPS 204, the module-lattice-based ML-DSA digital signature standard; and FIPS 205, the stateless hash-based SLH-DSA digital signature standard. NIST states that these standards are intended to provide the foundation for most deployments and can be put into use now.3

This baseline is not a claim that research has ended. NIST continues to evaluate security and performance, selected Falcon and HQC for ongoing standardization, and solicited additional digital-signature algorithms that could back up ML-DSA or address unique use cases. The practical implication is a standards-based starting point combined with continued attention to alternatives, assurance, and evolution.3

2. Credible drivers of future research

The first driver is exposure created by time. Long-lived confidential information can remain valuable after collection, creating a harvest-now-decrypt-later concern. Long-lived products create a related signing risk when they cannot be updated or replaced during their operational lifetime. These concerns make cryptographic inventory, data-lifetime analysis, and updateability central research and engineering questions rather than purely theoretical exercises.12

The second driver is assurance. Post-quantum algorithms have undergone substantial public evaluation, but the evidence also records practical attacks against the GeMSS, Rainbow, and SIKE candidates during the third round of NIST standardization. ETSI notes that post-quantum algorithms tend to be more complicated than traditional algorithms, that implementation mistakes can be difficult to detect, and that effective protection against side-channel attacks is still being developed.4

The third driver is deployment complexity. Replacing a primitive is not the same as migrating an enterprise. Protocol negotiation, certificate chains, key sizes, performance, hardware support, software dependencies, trust stores, archival validation, and rollback behavior can all affect the result. Research is consequently likely to remain focused on deployable constructions and evidence of behavior in real systems, not only on asymptotic security arguments.4

The fourth driver is the interaction between cryptography and broader security automation. NIST describes AI security and resilience as an area of active research in which challenges and potential solutions are changing rapidly. AI systems inherit common confidentiality, integrity, availability, software, and hardware risks, while also creating concerns such as evasion, model extraction, membership inference, availability attacks, and abuses enabled by AI systems.5

3. The most credible research directions

Cryptanalysis and algorithm diversity. Future work will continue testing standardized and candidate algorithms against new attacks, seeking confidence across different mathematical assumptions. NIST’s continuing evaluation and additional standardization work support this direction. Diversity matters because a backup or alternative can address a newly discovered weakness or a use case not well served by the principal standards; it should not be confused with a guarantee that any particular candidate will remain secure.34

Implementation assurance and side-channel resistance. A mathematically sound algorithm can still fail through coding errors, parameter mistakes, unsafe interfaces, weak randomness handling, or leakage from execution. The cited ETSI material specifically identifies implementation complexity and developing side-channel defenses as concerns. Research and engineering should therefore measure not only formal security claims but also constant-time behavior where relevant, fault handling, key management, validation, and the detectability of implementation errors.4

Hybrid protocols and transition architectures. Hybrid schemes generally combine traditional and post-quantum algorithms. Their attraction is transitional resilience: a well-designed hybrid can remain secure if at least one component is secure, thereby mitigating uncertainty about a post-quantum algorithm or its implementation. The cost is additional construction and interoperability work. Hybrid security can differ between key exchange, message encryption, and authentication, so the design must match the protection period and protocol behavior rather than applying one universal pattern.4

Certificate and trust-management research. RFC 9794 distinguishes post-quantum, traditional, PQ/T hybrid, mixed, and parallel PKI arrangements. A hybrid certificate chain is one way to achieve hybrid authentication, while a parallel PKI uses separate post-quantum and traditional chains together. Mixed chains may be useful for certificate lifetimes, rotation difficulty, or efficiency, but their security properties require case-by-case analysis. Research will therefore address chain construction, relying-party behavior, backward compatibility, nonseparability, revocation, and operational rotation.24

Migration measurement and cryptographic agility. An organization needs to know where algorithms are used, which data and signatures must remain valid, which systems can negotiate alternatives, and which components cannot be updated. NIST CSF 2.0 provides a governance structure in which mission, stakeholders, dependencies, legal and contractual requirements, risk tolerance, and assumptions inform operational decisions. Its current and target profiles provide a practical way to document the present posture, desired outcomes, gaps, and an action plan.6

AI security and resilience. AI is not a substitute for post-quantum migration, but it is a parallel research direction with possible interaction effects. NIST’s AI RMF is intended for voluntary use to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI systems. NIST also identifies secure and resilient AI as a trustworthiness characteristic and describes work on metrics, best practices, model vulnerabilities, and defense effectiveness. The future direction is therefore governed experimentation, not an assumption that AI will automatically improve defense.57

4. Alternative outcomes and dependencies

A useful scenario analysis keeps several outcomes open. In one outcome, quantum-computing progress remains slower than some estimates, while standards and migration practices mature gradually. In another, a relevant capability appears sooner than many enterprises can comfortably accommodate, making long-lived data and difficult-to-replace products especially exposed. A third outcome involves a weakness in a post-quantum algorithm or implementation, increasing the value of alternatives, hybrid designs, and disciplined rollback. The evidence supports these as planning scenarios, not probabilities.124

These outcomes depend on technical progress in quantum hardware, cryptanalysis, implementation quality, standardization, vendor support, protocol interoperability, and organizational execution. The cited evidence does not provide a quantum-computer forecast, a complete algorithm ranking, enterprise-specific deadlines, or a universal recommendation to use one migration architecture. Decisions must preserve those limitations and be revisited as standards, research findings, and deployment evidence change.143

5. Decision signals enterprises should monitor

• New cryptanalysis or implementation findings affecting standardized, candidate, or hybrid algorithms.
• Progress in NIST’s additional standardization work, including Falcon, HQC, and additional signature candidates.
• Evidence that protocol, certificate, hardware, or software suppliers support interoperable post-quantum and hybrid options.
• Measured performance, memory, bandwidth, latency, and operational effects in the organization’s own workloads.
• Changes in the expected confidentiality lifetime of data, product replacement cycles, contractual requirements, or regulatory obligations.
• Whether current and target risk profiles show that prioritized migration actions are reducing material gaps.
• AI-system threat research, testing results, and changes in the ability to measure or defend against model and data attacks.

These signals are more actionable than attempting to identify a single ‘quantum countdown.’ They connect external research to internal exposure, dependencies, and measurable readiness. A signal should have an owner, a review cadence, a threshold for escalation, and a documented consequence for architecture, procurement, testing, or funding.634

6. Actions enterprises can take now

1. Establish governance. Record the mission, critical services, stakeholder expectations, legal and contractual requirements, dependencies, risk tolerance, and assumptions that shape cryptographic decisions.
2. Build a current cryptographic profile. Identify algorithms, keys, certificates, protocols, libraries, modules, products, data stores, signing workflows, and suppliers, including systems that are difficult to update or replace.
3. Create a target profile and gap plan. Prioritize long-lived sensitive data, long-lived signatures, externally exposed services, high-dependency trust infrastructure, and systems with lengthy procurement or replacement cycles.
4. Use the 2024 NIST principal standards as the initial technical baseline where suitable, while tracking additional standards and documenting the rationale for any alternative or hybrid design.
5. Test transition paths in representative environments. Evaluate negotiation, certificate validation, trust-store behavior, performance, logging, failure handling, downgrade resistance, rollback, and interoperability with important relying parties.
6. Separate protection goals. Analyze key establishment, message confidentiality, and authentication independently; a hybrid decision for one does not automatically determine the right design for another.
7. Measure implementation assurance. Include code review, testing, side-channel considerations, module validation where applicable, key lifecycle controls, and evidence that operational teams can support the design.
8. Review on a defined cadence. Update current and target profiles when standards, threat intelligence, technology adoption, supplier support, or business objectives change.

These actions are deliberately useful under multiple futures. They do not require an enterprise to know when a cryptographically relevant quantum computer will appear. They create visibility, reduce avoidable delay, expose dependencies, and make later choices more reversible. They also fit the CSF 2.0 emphasis on governance, organizational context, risk strategy, profiles, gap analysis, and continuous improvement.6

7. What the evidence does not establish

The evidence does not establish that quantum computers will break present-day cryptography by a specified year, that any particular post-quantum candidate is permanently secure, or that hybrid cryptography is always superior to a direct post-quantum migration. It also does not establish that AI will resolve cryptographic migration or that the AI RMF is a mandatory control framework. These boundaries matter because overstatement can produce poor prioritization just as inaction can produce avoidable exposure.12473

The evidence set also contains documents with different dates and statuses: NIST CSF 2.0 is final and dated February 26, 2024; ETSI TR 103 966 V1.1.1 is final and dated October 2024; the NIST PQC overview is current and dated August 13, 2024; and RFC 9794 is informational and dated June 1, 2025. Those distinctions should be preserved when organizations use the material for policy, procurement, or assurance decisions.642

Conclusion

Future cryptographic security is not a forecast with one decisive date. It is a managed transition shaped by uncertain quantum-computing progress, long data and product lifetimes, algorithm and implementation assurance, protocol interoperability, and changing AI-related risks. The strongest evidence-led strategy is to use the current post-quantum standards as a practical baseline, continue watching algorithm and deployment research, and govern migration through current and target risk profiles. Enterprises that inventory cryptography, prioritize durable exposure, test hybrid and post-quantum paths, and monitor defined decision signals can act now while keeping their choices adaptable to multiple futures.31264