Post-Quantum Cryptography Transition Advisory (CISA/G7 Call to Action)

Technical Analysis

This advisory addresses the long-term cryptographic risk posed by cryptanalytically-relevant quantum computers (CRQC), which could break widely deployed public-key algorithms such as RSA, ECC (ECDSA/ECDH), and Diffie-Hellman via Shor's algorithm, undermining TLS, VPNs, code-signing, and PKI-based authentication. The recommended mitigation path involves migrating to NIST-standardized PQC algorithms (e.g., ML-KEM/CRYSTALS-Kyber for key encapsulation and ML-DSA/CRYSTALS-Dilithium or SLH-DSA for digital signatures) and adopting crypto-agility practices to support hybrid classical/PQC schemes during transition. There is no specific CVE, malware, or active exploitation associated with this release; it is a forward-looking risk-reduction and policy framework. For AI agent systems, the impact is indirect but significant: agent frameworks, API authentication (e.g., OAuth tokens, TLS-secured API keys), RAG pipeline data stores, and inter-agent communication channels all rely on current public-key cryptography, meaning organizations running agentic infrastructure should begin inventorying cryptographic dependencies and planning PQC/hybrid TLS adoption to avoid future 'harvest-now-decrypt-later' exposure of credentials and sensitive agent-processed data.

Affected Systems

Broadly applicable to any systems relying on classical public-key cryptography including TLS/SSL implementations, VPNs, PKI/certificate authorities, code-signing infrastructure, authentication protocols (OAuth, SSH), and encrypted data-at-rest/in-transit systems used by government, critical infrastructure, and private-sector organizations, including cloud and AI/agent hosting environments.

Indicators of Compromise

• Not applicable – this is a policy/advisory document, not an active threat with technical indicators.

Remediation Steps

1. 1

   Inventory Cryptographic Assets

   Identify all systems, applications, and data flows (including AI agent and API infrastructure) that rely on RSA, ECC, or Diffie-Hellman-based cryptography.

2. 2

   Develop a PQC Migration Roadmap

   Create a national or organizational strategy aligned with NIST PQC standards (ML-KEM, ML-DSA, SLH-DSA) and CISA/G7 recommended timelines.

3. 3

   Adopt Crypto-Agility

   Design systems to support hybrid classical/post-quantum cryptographic schemes to enable smooth transition without service disruption.

4. 4

   Prioritize High-Value/Long-Life Data

   Protect data with long confidentiality requirements first to mitigate 'harvest-now-decrypt-later' attacks.

5. 5

   Engage in Public-Private Partnerships

   Collaborate with vendors, standards bodies, and government initiatives to align procurement and R&D efforts with PQC adoption.

6. 6

   Update Procurement Requirements

   Incorporate PQC readiness and crypto-agility requirements into vendor and third-party procurement processes, including AI/agent platform providers.