Post-Quantum Cryptography and Ireland's Quantum-Safe Future

1. The Quantum Threat: Timeline and Technical Reality

Why Classical Cryptography Fails Against Quantum Adversaries

Modern public-key cryptography rests on two computational hardness assumptions: the Integer Factorisation Problem (IFP) underlying RSA, and the Discrete Logarithm Problem (DLP) underlying ECDSA and ECDH — the algorithms securing most TLS, SSH, and blockchain infrastructure.

In 1994, Peter Shor published a quantum algorithm demonstrating that a sufficiently powerful quantum computer could solve both IFP and DLP in polynomial time — O((log N)³). The implication is stark: any public-key infrastructure built on RSA, ECC, or Diffie-Hellman is theoretically vulnerable to a cryptographically relevant quantum computer (CRQC).

Current State of Quantum Hardware (2024–2026)

Google's Willow processor achieved a landmark in December 2024: below-threshold quantum error correction — logical error rates decreasing as code distance increases. This removes a fundamental barrier to fault-tolerant quantum computing. While still many years from a CRQC, this milestone materially shortens the timeline estimate.

2. NIST FIPS 203/204/205: The New Post-Quantum Standards

FIPS 203 — ML-KEM (Key Exchange)

Formerly CRYSTALS-Kyber, ML-KEM is the primary standard for key encapsulation and key exchange, replacing ECDH and RSA key exchange in TLS, SSH, and other protocols. Security rests on the hardness of the Module Learning With Errors (MLWE) problem.

FIPS 204 — ML-DSA (Digital Signatures)

Formerly CRYSTALS-Dilithium, ML-DSA replaces ECDSA and RSA signatures in code signing, certificate authorities, and authentication. Uses a Fiat-Shamir with Aborts signature scheme over module lattices.

FIPS 205 — SLH-DSA (Hash-Based Signatures)

Formerly SPHINCS+, SLH-DSA provides a hash-based alternative whose security rests solely on hash function properties (SHA-256, SHAKE). Recommended alongside ML-DSA for cryptographic diversity — if lattice assumptions are broken, SLH-DSA remains secure.

3. EU Regulatory Landscape

NIS2 Directive (Transposed into Irish Law 2024)

Requires "state of the art" cryptography for essential and important entities. Per ENISA guidance, state of the art now includes post-quantum cryptography for systems handling long-lived sensitive data. Irish operators in energy, transport, finance, health, digital infrastructure, and public administration are directly affected.

DORA (Financial Services, January 2025)

Requires financial entities to document cryptographic dependencies, assess cryptographic agility, and include quantum risk in ICT risk frameworks. The Central Bank of Ireland has reinforced these requirements under its Prudential Regulations framework.

EU Quantum Flagship (€1 Billion Programme)

The EU's decade-long quantum investment programme drives PQC adoption as critical infrastructure. Ireland participates through Tyndall National Institute, TCD, UCD, and ICHEC. EuroQCI will deploy QKD across all 27 member states by 2027.

4. Practical Deployment Guide for Irish Organisations

Step 1: Cryptographic Inventory

The prerequisite for migration — catalogue every asymmetric cryptographic operation in your systems. Key questions: which algorithm, what key size, what purpose, what data lifetime?

# Scan TLS cipher suites (free tool)
testssl.sh --cipher-per-proto your-server.ie

# Check certificate key type and size
openssl s_client -connect your-server.ie:443 | \
  openssl x509 -noout -text | grep "Public Key"

Step 2: Deploy Hybrid TLS Immediately

Hybrid key exchange (X25519 + ML-KEM-768) adds quantum protection with zero downside — classical security is maintained. Google Chrome defaults to this since Chrome 124.

# Nginx configuration for hybrid TLS
ssl_protocols TLSv1.3;
ssl_ecdh_curve X25519MLKEM768:x25519:secp256r1:secp384r1;

Step 3: Priority Migration Order

5. The Irish Quantum Ecosystem

Tyndall National Institute (Cork) — Europe's largest microelectronics research centre. Quantum photonics and semiconductor research for quantum hardware supply chains.

Trinity College Dublin — Quantum materials and devices; participation in EU Quantum Flagship QuantERA networks.

University College Dublin — Quantum algorithms and theoretical foundations; Horizon Europe quantum research partnerships.

ICHEC — Access to EuroHPC quantum simulators for Irish researchers and companies; Ireland's gateway to EU quantum computing access programmes.

NCSC Ireland — Published Quantum Threat Advisory 2023; recommends all public sector bodies begin cryptographic inventory processes immediately.

6. CRYSTALS, SPHINCS+, and the Academic Foundations

The NIST standards emerged from foundational academic research spanning three decades:

• Regev (2005): Introduced LWE problem; proved quantum hardness under worst-case lattice assumptions. 2018 Gödel Prize.
• Lyubashevsky, Peikert, Regev (2013): Ring-LWE enabling NTT acceleration. Made practical performance possible.
• CRYSTALS suite (2017/2018): Kyber and Dilithium submitted to NIST competition; designed by Ducas, Kiltz, Lyubashevsky, Schwabe, Stehlé et al.
• Gidney & Ekerå (2021): Concrete CRQC resource requirements — ~20M physical qubits for RSA-2048. Definitive threat quantification.

7. Roadmap for Ireland: 2025–2030