The post-quantum panic has a marketing problem
Every CISO deck now carries the same slide: a quantum computer will break RSA and ECDSA, and attackers are already running "harvest now, decrypt later": collecting encrypted traffic today to read once that machine exists. For TLS, archived email and any data that must stay secret for a decade, that threat is real. For authentication, it is mostly noise.
We made that argument on stage at Hacktivity 2026 in Budapest, in a joint slot with Yubico. This post is the written version: where the post-quantum risk actually sits in an authentication stack, why the passkey login itself is the least of your worries, and what your cryptographic inventory should flag before the EU's 2030 deadline.
The short version: don't panic about passkeys. Panic a little about your roots.
Why harvest now, decrypt later doesn't apply to your logins
Encryption and signatures fail on different clocks. Ciphertext recorded in 2026 can be decrypted the day a cryptographically relevant quantum computer exists, so the damage is retroactive. That is why migrating TLS to post-quantum key exchange is urgent.
Authentication works differently. A login signature is checked the moment it arrives, and the verifier decides there and then. A quantum computer in 2036 cannot log in to a session from 2026. Harvest now, decrypt later is real. Harvest now, log in later is not.
So for authentication, measure one thing: how long each public key must stay unforgeable. Mosca's inequality usually asks how long data must stay secret. Point it at trust anchors instead: if a key's lifetime plus your migration time exceeds the time to a quantum computer, you are exposed. A login challenge lives for seconds. A root certificate lives for decades.
Five layers of an authentication stack, scored
Risk follows lifetime and exposure, not the algorithm name. The layer vendors shout about scores lowest; the plumbing nobody puts on a slide scores highest.
| Layer | What a quantum computer breaks | Lifetime | Risk (out of 5) |
|---|---|---|---|
| Login assertions (passkeys) | Nothing retroactive | Seconds | 1 |
| Attestation roots | Proof that a key is genuine hardware | Often decades | 4 |
| Device-binding and smart-card certificates | The user's identity | Certificates 1 to 3 years, CA roots 10 to 20 | 4 to 5 |
| Firmware signing chains | The authenticator itself | Device life | 2 to 5 |
| FIDO Metadata Service | Every relying party's trust decisions | Root valid to 2046 | 3 |
Login assertions. Every WebAuthn login signs a fresh, origin-bound server challenge, usually with ES256. There is nothing to replay later. Registration runs over TLS, where hybrid post-quantum key exchange (X25519 plus ML-KEM-768) is already the default in Chrome, Edge, Firefox and Safari.
The twist. After Q-Day, your relying party's table of stored credential public keys becomes a password database. A leaked table would let an attacker derive private keys and sign valid logins for every user. Protect it like password hashes now: access control, breach monitoring and a re-enrolment plan.
Attestation roots. Attestation proves a credential lives in genuine hardware, and it chains to a vendor root certificate that is public by design. A quantum computer turns that public root into a private key, and AAGUID allowlists and "hardware keys only" policies stop meaning anything.
Device-binding certificates. PIV and smart-card certificates for certificate-based authentication, Windows logon and S/MIME are often RSA-2048 under CA roots valid for 10 to 20 years. Unlike passkeys, their public keys are published on purpose, in directories, address books and every signed email. No phishing, no device and no user interaction are needed to attack them once the maths breaks. Many security keys, including the YubiKey 5 Series, also carry a PIV smart-card applet, and certificates on that applet share this risk profile.
Firmware signing. Updatable authenticators (phones, laptops with TPMs, some security keys) are crypto-agile, but their code-signing root becomes a crown jewel. Fixed-firmware keys such as YubiKeys have no field update path to attack, so they migrate through fleet refresh. Plan that refresh like a project.
FIDO Metadata Service. One signed feed tells relying parties which authenticators exist, what they are certified for and which are compromised. In August 2026 its signing chain moved to GlobalSign Root R46, an RSA-4096 root valid until 2046. The rotation shows the root can move, but the new one is still classical.
Central Europe already ran the drill: ROCA, 2017
In 2017, researchers at Masaryk University in Brno found ROCA, a flaw in a widely used smart-card chip library that let an attacker compute an RSA private key from its public key. Estonia suspended the certificates on about 760,000 national ID cards overnight. Chips with the same flaw sat in identity documents in Slovakia, Poland, Austria and Bulgaria, and Slovakia replaced around 300,000 signing certificates.
Estonia coped because it could renew certificates remotely and suspend rather than revoke them. A quantum computer is ROCA for every RSA and ECC key, from every vendor, at once. There is no unaffected batch to fall back on.
That matters here because smart-card PKI is everywhere in the region. Latvian ID cards for holders aged 14 and over carry authentication and signing certificates by default. Poland's e-dowód carries an authentication certificate and a signature certificate. The Czech eObčanka holds an identification certificate fixed at manufacture that cannot be replaced, so a post-quantum migration there means a new card.
| eID or PIV smart card | Passkey | |
|---|---|---|
| Public key | Published: directories, and embedded in every signed document | Held only by the relying party |
| Key scope | One authentication key, thousands of services | One key per site, bound to its origin |
| A derived private key buys | Your identity everywhere, plus legally binding signatures | One account at one site |
| Signature lifetime | Years: qualified signatures must stay verifiable | Seconds |
| Migration | Reissue cards, often in person | Re-enrol a credential |
This is not "smart cards bad, passkeys good". Cards and qualified signatures exist for legal reasons that passkeys do not replace. The point is that in Central and Eastern Europe, the quantum migration burden sits on card PKI, so that is where planning and budget should go first.
Standards status and the EU PQC roadmap
The specifications are ready; the ecosystem is catching up. Here is what you can act on now and what to track.
Settled. W3C WebAuthn Level 3 became a Recommendation in August 2026, and it is algorithm-agnostic: a relying party simply lists the algorithms it accepts. RFC 9964 registered COSE identifiers for ML-DSA-44, ML-DSA-65 and ML-DSA-87. The action today is cheap: check that your server library does not hard-code ES256 or RS256.
Still open. FIDO conformance test cases for ML-DSA are still a proposal, and server libraries are waiting for them before shipping support. Composite (hybrid) certificate signatures are still an IETF draft. Post-quantum signing for attestation and metadata chains has not started in production.
Regulators have picked dates even though nobody knows Q-Day:
| By the end of | NIS Cooperation Group roadmap | NIST IR 8547 (draft) |
|---|---|---|
| 2026 | Member states start: inventories, dependency maps, awareness | |
| 2030 | High-risk use cases and critical infrastructure on PQC | Proposes deprecating 112-bit RSA and ECC, such as RSA-2048 |
| 2035 | Medium risk done, the rest as far as feasible | Proposes disallowing all RSA and ECC |
The NIS Cooperation Group roadmap is guidance to member states, not binding law, but auditors and procurement teams will cite it. Note the asymmetry in NIST's draft: P-256, which most passkeys use, is not deprecated in 2030, while RSA-2048, which most smart cards use, is.
What your cryptographic bill of materials (CBOM) should flag
Most CBOM tools scan code and TLS endpoints and record algorithm names. For authentication, that misses the two fields that drive risk: lifetime and exposure. Hardware authenticators rarely appear at all. Record these for every authentication asset:
| Field | Why it matters |
|---|---|
| Algorithm and key size | The obvious column, and the least useful on its own |
| Expiry of every trust anchor | Lifetime is the risk multiplier |
| Public key exposure | Published (PIV certificates, roots) or held only by the relying party |
| Migration path | Over the air, reissue, or replace hardware |
| Who controls the root | You, a vendor, or the FIDO Alliance |
| Fleet retirement date | When the last device you buy today leaves service |
Three flags are worth raising, and one is worth dropping:
- High risk: any RSA or ECC trust anchor valid past 2030, such as attestation roots, enterprise CAs and firmware signing roots.
- High risk: fixed cryptography that will still be in service past 2030. That is a procurement decision, not a patch, so write post-quantum roadmap questions into your tenders.
- Medium risk: published identity-binding keys such as PIV and S/MIME certificates. Plan reissue on post-quantum-capable cards, and treat government and national eID estates as high risk.
- Drop: per-login ES256 passkey assertions. Spend the budget elsewhere.
What this means for buying hardware keys
Anything you buy this year is classical and will still be in your fleet past 2030. Yubico expects PQC-ready keys in H1 2027. If a large rollout is due, look at the timing; if your users are being phished today, don't wait, because phishing kits defeat SMS and app codes now and quantum computers do not.
If you are planning a fleet rollout around that window, our Enterprise Procurement & Delivery service handles direct-to-employee delivery across the EEA, and our Identity Services team can help scope the migration. For model choice, see which YubiKey your business should buy and how the YubiKey 5 Series compares with YubiKey Bio. Making the case internally? Our guide for every decision maker covers it, and bulk orders are quoted on request.
Frequently asked questions
What is harvest now, decrypt later?
Attackers record encrypted traffic today and store it until a quantum computer can break the key exchange that protected it. It threatens data that must stay confidential for years, not real-time logins.
Are passkeys safe from quantum computers?
The login itself is: each assertion signs a fresh challenge that is worthless to replay. The real exposure is the stored public keys at the relying party, and how quickly you can re-enrol credentials once post-quantum authenticators ship.
What is Q-Day?
Q-Day is the day a cryptographically relevant quantum computer can break RSA and elliptic-curve cryptography. Nobody knows when it is, which is why regulators have set migration dates of 2030 and 2035 instead.
What is a CBOM?
A cryptographic bill of materials is an inventory of the cryptography your systems use. For authentication, it should record each trust anchor's lifetime and whether its public key is published, not just the algorithm.
What is crypto agility?
Crypto agility is the ability to swap algorithms without rebuilding systems. Updatable authenticators have it; fixed-firmware keys migrate by replacement instead.
When will post-quantum security keys be available?
Yubico expects PQC-ready keys in H1 2027. Server-side support depends on FIDO conformance tests for ML-DSA, which are still a proposal.
Does NIS2 require post-quantum cryptography?
Not directly. The NIS Cooperation Group roadmap is guidance, but it asks organisations to inventory now and move high-risk systems by 2030. NIS2's phishing-resistant MFA expectations apply today; see our guide to NIS2 Article 21 MFA requirements.
