Abstract
Post-quantum cryptography isn’t just lab code—it’s already protecting internet traffic, mainframes and cloud keys. This article samples high-impact deployments and summarises the new rules (NSA, BSI, NCSC & more) that make PQC a deadline-driven requirement.
Key Points at a Glance
- 2 %+ of global TLS 1.3 already uses a hybrid Kyber key exchange via Cloudflare.
- Chrome 116+ negotiates post-quantum handshakes by default.
- IBM z16 ships with lattice-based signatures and KEMs baked into firmware & boot.
- AWS KMS offers ML-DSA (Dilithium) keys in FIPS-validated HSMs.
- Hard deadlines: NSA & BSI → 2030 for critical systems, NCSC UK → 2035 for full cut-over.
Live Deployments You Can Learn From
Cloudflare & the Public Web
Since early 2024 Cloudflare enables a hybrid X25519 + Kyber-768 key exchange on every edge. Adoption climbed past 2 % of all TLS 1.3 connections within months—proof that PQC can run at internet scale without breaking legacy clients.
Google: Browser + Backend Control
With Chrome 116 the hybrid handshake is on by default; if the server supports it, users get quantum-resistant key exchange seamlessly. Internally, Google completed a PQC upgrade for inter-service RPCs back in 2022, showing what’s possible when you own both endpoints.
IBM z16: Mainframe Meets Lattices
The z16 (2022) integrates Kyber KEM and Dilithium signatures in secure boot, firmware signing and Crypto Express HSMs—delivering quantum-safe guarantees to risk-averse sectors such as banking.
AWS: Cloud Key Management
AWS KMS now lets customers generate ML-DSA (Dilithium) keys stored in FIPS 140-3 Level-3 HSMs. The shift means developers can sign artefacts—or rotate server certificates—using PQC via an SDK call, no specialist crypto coding required.
Regulators Turn Up the Heat
United States — NSA CNSA 2.0
Germany & EU — BSI Joint Call
In Nov 2024 the BSI and 17 EU states urged that all sensitive workloads migrate to PQC by end-2030. The statement backs EU funding for pilot projects and stresses adoption of NIST-approved algorithms. A detailed EU-wide roadmap being prepared under the NIS Cooperation Group (co-chaired by Germany) will specify interim milestones such as completing pilot deployments by 2026 and large-scale roll-outs from 2027.
United Kingdom — NCSC Roadmap
- 2028: crypto inventory & migration plan complete.
- 2031: critical systems switched to PQC.
- 2035: enterprise-wide PQC finished—no excuses.
Why This Matters for You
- Major vendors now ship PQC—no need to build from scratch.
- Regulators have turned dates into hard requirements; procurement contracts will soon follow.
- Early adoption = negotiation leverage and a strong security marketing story.
Next Step
Need a concrete action plan? Our final part gives a phased roadmap and cost-savvy tips for SMBs.
Read Part 3 →