Discuss an engagement
MenuClose

Quantum security, dated and sourced.

What quantum computing changes for encryption, the deadlines now set in the United States and the Gulf, and the claims that do not hold up. Every line names its source and the date we checked it.

Post-quantum deadlines Quantum terms
Oil painting of two lighthouses on opposite headlands at night, a single beam of light running level from one lantern to the other across a dark strait.
71%

of human HTTPS requests to Cloudflare used post-quantum key exchange in the week to October 28, 20261

93 of 148

US and Gulf banks and financial regulators we reached negotiate post-quantum key exchange on their main website2

Dec 31, 2026

SAMA deadline for Saudi financial institutions’ cryptographic asset procedures3

2030

US deadline for post-quantum key establishment on the most sensitive federal systems4

Where things stand on October 30, 2026.

Six statements, each linked to the detail behind it and the sources it rests on.

  1. No public quantum computer can break today’s public-key encryption.

    Designs published since 2025 for breaking RSA-2048 or the elliptic curves behind most signatures need about 1,200 to 1,600 error-corrected qubits. The largest public demonstrations hold dozens. Estimates keep falling: 20 million physical qubits for RSA-2048 in 2019, under one million in 2025.5,6,7,8

    The detail

  2. The United States set 2030 and 2031 for its most sensitive federal systems.

    Executive Order 14412 requires post-quantum key establishment by December 31, 2030 and post-quantum signatures by December 31, 2031 for high value assets and high impact systems. A proposed rule for federal contractors is due by December 19, 2026.4

    The detail

  3. NIST will deprecate RSA and elliptic curves after 2030 and disallow them after 2035.

    NIST IR 8547, final on October 27, 2026, deprecates quantum-vulnerable public-key algorithms after 2030 and disallows them under NIST standards after 2035.9

    The detail

  4. In the Gulf, Saudi Arabia’s central bank set the only dated duties we found.

    SAMA circular 482021280 requires financial institutions to complete procedures for identifying and classifying all cryptographic assets by December 31, 2026 and an enterprise quantum risk assessment by March 31, 2027. Kuwait’s central bank requires a quantum readiness strategy with no date. We found no published post-quantum rule in Qatar, Bahrain or Oman.3,10

    The detail

  5. Browsers use post-quantum key exchange. Banks mostly get it from their CDN.

    71% of human HTTPS requests to Cloudflare used post-quantum key exchange in the week to October 28, 2026. Our test of 159 US and Gulf banks and regulators found 93 of 148 of those we reached negotiate it on their main website, all of them through a CDN or cloud edge.1,2

    The detail

  6. An AI model’s finding took a post-quantum candidate out of NIST’s process.

    On July 29, 2026, the HAWK team withdrew its signature scheme from NIST’s process after Anthropic announced that its AI model had found a mathematical vulnerability in it. The standards already in use, ML-KEM, ML-DSA and SLH-DSA, were not part of that round.11

    The detail

The reference.

Five pages built from one data set and one measurement. When a rule or an estimate changes, every page that cites it changes with it.

Are US and Gulf banks ready for post-quantum encryption?

Our test of the main websites of 159 US and Gulf banks and financial regulators: who negotiates post-quantum key exchange, who serves their front door, and what an outside test cannot see.

Measured October 29, 2026

Post-quantum deadlines, United States and the Gulf

Every dated duty and target we could trace, on a timeline to 2035 and in full tables, marked binding or guidance. Also as CSV.

34 entries

When could a quantum computer break encryption?

Published resource estimates, expert forecasts, the evidence on harvest now, decrypt later, and the headlines that did not hold up.

6 estimates

SAMA’s quantum circular, item by item

The four requirements of circular 482021280 for Saudi financial institutions, its two deadlines and what it leaves open.

Deadline December 31, 2026

Quantum security terms

From ML-KEM to quantum Wi-Fi: what each term means, whether it is a standard, a product, research or a claim to doubt, with Arabic forms.

22 terms

For your own inventory and plan, see our post-quantum readiness assessment.

What changed.

Rules, standards and evidence this section tracks, newest first.

  1. Removed the line on Bahrain’s NCSC deploying cryptographic discovery software across government ministries. Its only source was the supplier’s press release, and we found no Bahrain government announcement of it.12

    Previously: The NCSC announced on December 23, 2025 that it is deploying cryptographic discovery software across more than 60 ministry environments.

  2. Bendings tested post-quantum key exchange at 159 US and Gulf banks and financial regulators: 93 of 148 of those reached negotiate it.2

  3. NIST published IR 8547 in final: quantum-vulnerable public-key algorithms deprecated after 2030 and disallowed after 2035.9

  4. US federal agencies’ post-quantum migration plans fell due to OMB and the National Cyber Director, 120 days after M-26-15.13

  5. SAMA issued circular 482021280 on quantum computing risks, with deadlines of December 31, 2026 and March 31, 2027.3

  6. The US Treasury launched the Quantum-Readiness Task Force, a public-private initiative for the financial sector’s move to post-quantum cryptography, with three workstreams. The release sets no duties or dates.14

  7. The IETF published RFC 10024, hybrid ML-KEM key agreement for TLS 1.3.15

  8. The HAWK team withdrew its scheme from NIST’s additional signature process after Anthropic announced its AI model had found a vulnerability.11

  9. The PCI Security Standards Council’s FAQ 1491, dated July 2026, calls TLS cipher suites that use post-quantum cryptography for key exchange and end-point authentication “best practice”, with no date.16

  10. NIST updated its white paper on crypto agility as CSWP 39upd1, superseding the version of December 19, 2025.17

  11. OMB issued M-26-15, setting five migration phases from 2026 to 2035.13

  12. Executive Order 14412 set 2030 and 2031 for federal high value assets and high impact systems.4

  13. The OCC’s cybersecurity report said banks and service providers “should be aware of the risk implications” of quantum computing and should consider how to monitor developments in it. It set no deadline.18

  14. The IEEE 802.11 Working Group told the Wi-Fi Alliance about P802.11bt, its project to add post-quantum algorithms to Wi-Fi security, and asked to open a dialogue on it.19

What we are watching.

We check these every week. When one lands, it goes into the pages and the change log above, with the date.

16 items, dated ones first
What Expected Where we look
FAR Council proposed rule requiring federal contractors to meet post-quantum FIPS by 2030 December 19, 2026 Federal Register and regulations.gov, FAR cases
SAMA deadline for cryptographic asset procedures December 31, 2026 SAMA Rulebook circulars and FAQs
Repeat the bank measurement, from a Gulf vantage point and with mail servers January 29, 2027 Our own scan, rerun from a Gulf vantage point with mail servers included
CISA guidance on the minimum elements of a cryptographic bill of materials March 19, 2027 cisa.gov post-quantum resources
SAMA deadline for the enterprise quantum risk assessment March 31, 2027 SAMA Rulebook circulars and FAQs
NIST draft standards for HQC and FN-DSA (FIPS 206) Checked weekly NIST post-quantum publications page
The next revision of NIST SP 800-52, which IR 8547 says will cover hybrid key exchange in TLS Checked weekly NIST CSRC drafts for public comment
A final NIST SP 1800-38 on migration to post-quantum cryptography. Volumes B and C are still preliminary drafts of December 19, 2023 Checked weekly NIST CSRC publications search and the NCCoE migration to PQC project
Outputs of the US Treasury’s Quantum-Readiness Task Force for the financial sector Checked weekly Treasury press releases (home.treasury.gov)
A revision of Saudi Arabia’s National Cryptographic Standards with post-quantum algorithms Checked weekly nca.gov.sa documents
The post-quantum requirements and any dates in the published UAE National Encryption Policy v1.0 Checked weekly Cyber Security Council (csc.gov.ae) and the u.ae policy page
Post-quantum rules from the central banks of Qatar, Bahrain, Kuwait and Oman Checked weekly QCB, CBB Rulebook, CBK and CBO circulars; Oman MTCIT guidelines
IEEE P802.11bt, post-quantum Wi-Fi security Checked weekly IEEE 802.11 task group bt updates and ballots
Post-quantum share of human HTTPS traffic Checked weekly Cloudflare Radar, first review of each month
New resource estimates for breaking RSA-2048 or 256-bit elliptic curves Checked weekly arXiv quant-ph and cs.CR, IACR ePrint
Error-corrected quantum hardware milestones Checked weekly Google Quantum AI, IBM, Quantinuum, IonQ, Microsoft, AWS and DARPA QBI announcements

The data and earlier versions.

Everything in this section is one dataset. Each review is archived under its date, so a citation can point to the version it used.

Current version (JSON)
Reviewed October 30, 2026. It holds every statement, table row, term and source on these pages.
October 29, 2026
The section as it stood after that review.

Sources.

Primary sources unless marked. Each shows the date we last opened it and confirmed what we cite.

  1. 1
    Post-quantum encryption adoption, Cloudflare Radar Checked October 28, 2026.
  2. 2
    Post-quantum readiness at 159 US and Gulf banks and regulators, Bendings measurement, October 29, 2026 Checked October 30, 2026.
  3. 3
    Enhancement of Operational Resilience to Address Quantum Computing Risks, circular 482021280, SAMA, August 27, 2026 (English translation) Checked October 29, 2026.
  4. 4
    Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026 Checked October 29, 2026.
  5. 5
    How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits, Gidney and Ekerå, Quantum, 2021 Checked October 28, 2026.
  6. 6
    How to factor 2048 bit RSA integers with less than a million noisy qubits, Gidney, preprint, May 2025 Checked October 28, 2026.
  7. 7
    Elliptic-curve resource estimate for secp256k1, Babbush, Zalcman, Gidney and others, PRX Quantum, August 21, 2026 Checked October 28, 2026.
  8. 8
    Quantinuum Inc. prospectus, Form 424B4, SEC EDGAR, June 3, 2026 Checked October 28, 2026.
  9. 9
    NIST IR 8547, Transition to Post-Quantum Cryptography Standards, final, October 27, 2026 Checked October 30, 2026.
  10. 10
    Cyber and Operational Resilience Framework (CORF) v1.0, Central Bank of Kuwait, December 3, 2025 Checked October 29, 2026.
  11. 11
    Nine candidates advance to third round of additional digital signatures for PQC, NIST, May 14, 2026, updated July 29, 2026 Checked October 29, 2026.
  12. 12
    Baseline Cybersecurity Controls, NCSC-CP-D22-0001, National Cyber Security Center, Bahrain, January 2022 Checked October 30, 2026.
  13. 13
    OMB Memorandum M-26-15, Execution of the Migration to Post-Quantum Cryptography, June 24, 2026 Checked October 28, 2026.
  14. 14
    Treasury announces the Quantum-Readiness Task Force, US Department of the Treasury, August 24, 2026 Checked October 30, 2026.
  15. 15
    RFC 10024, Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3, IETF, August 2026 Checked October 29, 2026.
  16. 16
    FAQ 1491, which versions of TLS PCI DSS requires, PCI Security Standards Council, July 2026 Checked October 30, 2026.
  17. 17
    NIST CSWP 39upd1, Considerations for Achieving Crypto Agility: Strategies and Practices, December 19, 2025, updated June 29, 2026 Checked October 30, 2026.
  18. 18
    Cybersecurity and Financial System Resilience Report, Office of the Comptroller of the Currency, June 2026 Checked October 30, 2026.
  19. 19
    Liaison communication to the Wi-Fi Alliance regarding the PQC project, IEEE 802.11 Working Group, approved May 15, 2026 Checked October 29, 2026.

Discuss an engagement privately.

Write from your organization’s email address. Tell us what is in scope, your deadline and who can authorize testing. Leave sensitive details out of the first message.

Email engage@bendings.com What happens next