G7 Sets 2034 Deadline For Finance To Adopt Quantum-safe Systems

Financial businesses and public entities should have fully transitioned to post-quantum cryptography (PQC) by 2034 at the latest, according to the G7.

In a new document published on January 13, the G7 Cyber Expert Group (CEG) set a recommended roadmap for financial entities to test, migrate and fully transition to quantum-resistant cryptographic systems in order to anticipate the risk of potential quantum-enabled cyber-attacks in the future that would break current cryptographic systems.

The CEG is a group of cybersecurity experts that advise finance ministers of G7 member states and central bank governors on cybersecurity matters of importance for the security and resilience of the financial system.

The roadmap, developed by a dedicated CEG task force of experts from financial authorities and industry across G7 jurisdictions, is designed to inform senior leaders on the types of activities that may help organizations transition to PQC.

It is not intended to be prescriptive and does not set guidance or regulatory expectations.

It sets up six recommended phase to transition to PQC, with related recommended timelines:

Additionally, the G7 advised organizations transitioning to PQC systems to build their plan on a risk and standards-based approach – preferably by integrating it into existing governance and risk management frameworks and technology strategies – and to remain flexible in their migration plans and allow for recalibration over time.

“Organizations may also benefit from incorporating a goal of cryptographic agility in their transition plans to adapt new cryptographic solutions for emerging threats and vulnerabilities,” the G7 experts wrote.

Crypto agility is the ability to quickly swap out cryptographic algorithms without disrupting systems, for example, by creating an abstract layer between the applications and the cryptography libraries that isolates security functions from the rest of the codebase.

This way, organizations can update or replace encryption methods (like switching from RSA to a post-quantum algorithm) with minimal downtime, simply by modifying the underlying library rather than rewriting entire applications.

Source: InfoSecurity Magazine