Skip to main content

Post-quantum product release dates

The decisions​

Which release has to carry a post-quantum signature or a root of trust, and what waits for a vendor.

Reading order​

  1. Where to start
  2. Dates
  3. Priority
  4. Signatures
  5. Long-lived roots
  6. Vendor plan
  7. Protect this first

The UK NCSC timelines, modified 3 August 2026, include long-lived hardware roots of trust in the 2028 plan row, and say commodity IT such as browsers, operating systems, and mobile devices picks up migration as vendors update those services. NIST IR 8547, October 2026, says that where a device cannot update its signature check later, and it will still be in use when a cryptanalytically relevant quantum computer exists, the device should be designed to require quantum-resistant signatures on the executable code.

Outcome​

A release date tied to one asset, and a vendor question if someone else owns the stack.

A weak answer​

"The platform will handle it."

A stronger answer​

"This product cannot update its firmware check. That release is on the 2028 root-of-trust work from the NCSC timelines. The laptops are on the vendor-update path."

Sources​

  • UK NCSC, Timelines for migration to post-quantum cryptography, modified 3 August 2026. Timelines
  • NIST IR 8547, Transition to Post-Quantum Cryptography Standards, October 2026. NIST IR 8547