The real challenge begins before Q-Day
Munich/Berlin, 05 August 2026
Commentary on Quantum Computing Cryptography in the Identity Ecosystem
By Armin Reuter*
What still sounds like science fiction will soon become reality:
quantum computing is on the verge of transforming the technological landscape. By harnessing the fundamental laws of physics, it promises to deliver significant advantages in computing power, efficiency, and the ability to solve highly complex problems that were previously beyond reach. A transformative technological breakthrough. Yet in many respects, the quantum age has already begun, long before the first quantum computer for everyday tasks becomes available. Well before Q-Day – the point at which quantum computers become capable of breaking today's widely used cryptographic algorithms – we must begin preparing for the challenges ahead.
Especially, governments, public authorities, and companies need to ask themselves what happens if, in the near future, new methods emerge that can undermine today’s cryptographic schemes. There is a need for action, particularly in the critical area of identity management, including passports, ID cards, and other official identity documents, where trust in the security of identity credentials is pivotal. The public debate tends to focus on when quantum computers will break today's cryptography. But for identity systems, the more pressing question is what happens to documents issued now –passports, national IDs, and trust anchors – whose lifetimes may well extend beyond the point at which the cryptography protecting them ceases to be secure. Such documents often remain valid for many years, so today’s decisions have long-term implications. The quantum threat to secure identities is not a future problem waiting to emerge – it is already here. Through the so-called “harvest now, decrypt later” approach, adversaries could potentially already be collecting and archiving encrypted data, digital signatures, or identity information with the intent to decrypt it once sufficiently powerful quantum computers become available. For many types of data, this may be a manageable risk. However, when it comes to identities and sensitive personal information, there is no room for security gaps. Biometric features such as fingerprints or facial characteristics cannot be reset. The challenge of post-quantum migration reaches far beyond the question of which algorithms to adopt. Post-quantum cryptography is far more than a technical upgrade. In identity management in particular, a high level of security depends on a complex interplay of secure chips, issuance and personalization systems, certification authorities, border control systems, and international trust infrastructures. For this reason, migration to quantum-safe solutions must be viewed as a fundamental, long-term transformation of security infrastructure rather than another IT project to be managed and closed. Instead, it should be treated as a structured risk-management process in which adjustments are explicitly reflected in governance and security assessments, and in which different time horizons – from short-term dependencies to long-term system transitions – must be evaluated separately and reviewed regularly. In addition, many components of today’s identity systems were developed for classical cryptographic methods. Post-quantum algorithms place higher demands on hardware and infrastructure, meaning their introduction will not happen overnight – with all the complexity, inconsistency and interoperability challenges that entails. It is precisely this coexistence period, not the eventual post-quantum end state, that poses the greatest and most immediate challenge, particularly for globally interoperable identity systems. Preparing for the quantum age is therefore primarily a matter of adaptability. Success will not come to those who rush to replace individual technologies as quickly as possible, but to those who proactively evolve their systems and address risks early on. The focus lies on maintaining secure, interoperable, and trustworthy identity ecosystems throughout the transition. This transition will be the real test: a prolonged coexistence of classical and quantum-resistant systems, requiring sustained governance, coordinated standards, and long-term commitment across the entire identity ecosystem. Further information on this topic can be found in Veridos’ white paper “The Quantum Risk in Identity Ecosystems”. *Armin Reuter is Director of Innovation Projects at Veridos. | ||
Veridos GmbH
Veridos, a joint venture by Giesecke+Devrient and Bundesdruckerei, is a leading global provider of integrated identity solutions. Governments and public authorities in more than 100 countries rely on the company's unique, comprehensive product portfolio. Veridos offers complete solutions and comprehensive services that are perfectly tailored to each customer's identification requirements. The portfolio ranges from paper, security printing and electrochip components, data capture, identity management systems, personalization and issuance of ID documents to mobile ID and border control solutions, including eGates. The company offers the highest quality identity documents, including passports, ID cards and driver's licenses, and even the production facilities that enable governments to produce them themselves. For more information about Veridos, please visit www.veridos.com. | ||
Press contact
Giesecke+Devrient |
