Critical sectors must have quantum-safe encryption, urges task force

A task force constituted under India's Department of Science and Technology (DST) — as part of the National Quantum Mission (NQM) — released a report titled ...

What Happened

A task force constituted under India's Department of Science and Technology (DST) — as part of the National Quantum Mission (NQM) — released a report titled "Implementation of Quantum Safe Ecosystem in India" in February 2026.
The report identifies defence, power, telecommunications, space, DRDO, ISRO, and ONGC as highest-priority Critical Information Infrastructure (CII) sectors that must begin post-quantum cryptography (PQC) migration immediately, with full adoption targeted by 2027–2029.
The task force, chaired by Dr. Rajkumar Upadhyay (CEO of C-DOT), warns that the "harvest now, decrypt later" (HNDL) threat is already active — adversaries may be collecting encrypted data today with the intent to decrypt it once quantum computers become sufficiently powerful.
The report recommends crypto-agile system design, mandatory cryptographic inventories, and integration of quantum-safe requirements into government procurement specifications.
India's nationwide full adoption target is set at 2033, with interim milestones for CII by 2029.

Static Topic Bridges

Post-Quantum Cryptography (PQC): What It Is and Why It Matters

Current public-key cryptographic systems — RSA, ECC (Elliptic Curve Cryptography), and Diffie-Hellman — derive their security from the computational difficulty of factoring large integers or solving discrete logarithm problems. A sufficiently powerful quantum computer running Shor's algorithm can break these in polynomial time, rendering today's encrypted communications vulnerable. Post-quantum cryptography (PQC) refers to classical (non-quantum) cryptographic algorithms designed to resist attacks from both classical and quantum computers. In August 2024, the US National Institute of Standards and Technology (NIST) finalised its first three PQC standards: FIPS 203 (ML-KEM, based on CRYSTALS-Kyber), FIPS 204 (ML-DSA, based on CRYSTALS-Dilithium), and FIPS 205 (SLH-DSA, based on SPHINCS+). These are lattice-based and hash-based algorithms that resist known quantum attacks.

Shor's algorithm: quantum algorithm that breaks RSA and ECC in polynomial time (developed 1994)
FIPS 203 (ML-KEM): key encapsulation mechanism; based on Module-Lattice mathematics
FIPS 204 (ML-DSA): digital signatures; based on Module-Lattice mathematics
FIPS 205 (SLH-DSA): digital signatures; hash-based; backup algorithm to ML-DSA
HQC (2025): NIST's fifth PQC algorithm; code-based; serves as backup to ML-KEM
Crypto-agility: system design that allows cryptographic algorithms to be swapped without full infrastructure rebuild

Connection to this news: India's DST task force report directly aligns with the NIST 2024 standards, recommending these algorithms as the migration target for Indian CII and government systems.

Harvest Now, Decrypt Later (HNDL) Attack

"Harvest now, decrypt later" (HNDL) is a long-term attack strategy in which an adversary intercepts and stores encrypted communications today — before quantum computers exist — with the intention of decrypting the stored data once a sufficiently powerful quantum computer becomes available. This is especially threatening for data with long-term sensitivity: classified defence communications, diplomatic cables, biometric databases, and financial records. The window of vulnerability is the period between now and Q-Day — the estimated moment when quantum computers can crack current encryption at scale. Estimates for Q-Day range from 2030 to 2035, though timelines are uncertain.

HNDL is not a future threat — data collection is happening now; decryption is deferred
Q-Day: projected by 2030–2035 (range; timelines uncertain due to pace of quantum hardware development)
Data most at risk: communications with classification periods exceeding 10 years (defence, diplomacy, health records)
Mitigation: immediate transition to PQC for new systems; layered hybrid (classical + PQC) for legacy systems
Hybrid cryptography: using both classical and PQC algorithms simultaneously during the transition period

Connection to this news: The task force's urgency on the HNDL threat is why the migration timeline cannot wait for Q-Day to arrive — encrypted data being transmitted today on vulnerable systems is potentially already being harvested.

National Quantum Mission (NQM) and India's Quantum Ecosystem

The National Quantum Mission (NQM) was approved by the Union Cabinet on 19 April 2023, with a total outlay of ₹6,003.65 crore over eight years (2023–24 to 2030–31). The mission covers four pillars: quantum computing, quantum communication, quantum sensing and metrology, and quantum materials and devices. NQM aims to develop intermediate-scale quantum computers (50–1000 physical qubits within eight years), establish a quantum communication network over 2,000 km, and build indigenous quantum encryption capabilities. The DST PQC Task Force report operates within the NQM framework, specifically targeting the cryptographic security pillar.

NQM approval: 19 April 2023
Outlay: ₹6,003.65 crore over 8 years
Nodal ministry: Department of Science and Technology (DST), Ministry of Science and Technology
Four pillars: quantum computing, quantum communication, quantum sensing/metrology, quantum materials/devices
Qubit target: 50 physical qubits (Year 3) → 1,000 physical qubits (Year 8)
Quantum communication target: secure network over 2,000 km
C-DOT: Centre for Development of Telematics; nodal agency for quantum-safe telecom implementation

Connection to this news: The DST task force report is a direct output of the NQM's quantum security pillar, translating the mission's strategic goals into sector-specific migration timelines and technical standards.

Critical Information Infrastructure (CII) Protection in India

Critical Information Infrastructure (CII) is defined under Section 70 of the Information Technology Act, 2000 as computer resources whose incapacitation or destruction would have a debilitating impact on national security, economy, public health, or safety. The National Critical Information Infrastructure Protection Centre (NCIIPC), under the National Technical Research Organisation (NTRO), is the nodal agency for CII protection. Sectors designated as CII in India include power and energy, banking and financial services, telecommunications, transport, government, space, and defence.

Legal basis for CII: Section 70, IT Act 2000
NCIIPC: National Critical Information Infrastructure Protection Centre; nodal body for CII protection
Parent organisation: National Technical Research Organisation (NTRO)
CII sectors: power/energy, banking/finance, telecom, transport, government systems, space, defence
IT Act 2000: primary legislation governing cybersecurity and CII in India
National Cyber Security Policy 2013: first comprehensive cybersecurity policy; CII protection is a core objective

Connection to this news: The sectors the task force identifies for urgent PQC migration — defence, power, telecom, space — precisely correspond to India's designated CII sectors, making the report a direct input to NCIIPC's mandate.

Key Facts & Data

Task force report title: "Implementation of Quantum Safe Ecosystem in India" (February 2026)
Nodal body: Department of Science and Technology (DST) under National Quantum Mission
Task force chair: Dr. Rajkumar Upadhyay, CEO of C-DOT
Priority sectors for immediate PQC migration: defence, power, telecom, space, DRDO, ISRO, ONGC
CII migration timeline: 2027–2029; full nationwide adoption: 2033
NIST PQC standards finalised: August 2024 (FIPS 203/ML-KEM, FIPS 204/ML-DSA, FIPS 205/SLH-DSA)
Q-Day estimated: 2030–2035
HNDL threat: data harvesting for future quantum decryption is actively ongoing
NQM approval: 19 April 2023; outlay ₹6,003.65 crore; 8-year horizon
CII legal definition: Section 70, IT Act 2000
NCIIPC: nodal CII protection body under NTRO