What ANSSI Asks for the Post-Quantum Migration, and When

Post-quantum cryptography is no longer a research topic. NIST standardized the algorithms in 2024, ANSSI, the French national cybersecurity agency, has set its doctrine, and the European Union has published a common timeline. For an organization in Europe, the migration itself is settled. What remains open is the order.

This article gathers what ANSSI recommends, the dates that matter, and what is reasonable to do this year.

Why now, when no quantum computer can break anything yet

The threat comes in two steps. An attacker can copy today data encrypted with RSA or elliptic curves, and decrypt it later, the day a large enough quantum computer exists. Security people call it "harvest now, decrypt later".

Data that must stay confidential for ten years, a medical record, a contract, an industrial plan, is therefore already exposed if it travels today encrypted with classical algorithms. The migration timeline is read from the lifetime of your data, not from the arrival date of the quantum computer.

The dates that matter

• Now. ANSSI asks organizations to start a cryptographic inventory, beginning with critical uses.
• End of 2026. First milestone of the coordinated roadmap of the EU Member States, published in June 2025, with inventories, dependency maps and awareness.
• 2027. ANSSI aims at post-quantum requirements for products entering qualification.
• 11 December 2027. Every obligation of the Cyber Resilience Act applies to products with digital elements.
• End of 2030. High-risk uses migrated under the European roadmap; quantum-vulnerable public-key mechanisms should no longer be used on their own.
• After 2030. According to ANSSI, it will not be reasonable to buy products without post-quantum cryptography.
• End of 2035. Medium-risk uses migrated.

Hybridization, in practice

Post-quantum algorithms are young. Until they have the decades of scrutiny RSA and elliptic curves have had, ANSSI strongly insists on hybridization, which combines a classical algorithm and a post-quantum one so that the protection holds as long as either one holds.

• For key exchange. ML-KEM (FIPS 203) is combined with a classical ECDH exchange, and both secrets are derived into a single key.
• For signatures. A post-quantum signature comes with a classical one.
• One exception. Hash-based signatures such as SLH-DSA (FIPS 205) do not systematically need hybridization according to ANSSI, since their security rests on well-understood assumptions.
• Where it is mandatory. Hybridization is required for restricted or classified data and regulated systems; elsewhere it is a strong recommendation, and the practice public buyers and large accounts will follow.

ANSSI also recommends that products be able to change parameter sets without being rewritten. That is crypto-agility. Your messages and keys must be able to evolve without breaking what was already encrypted.

Three projects to start this year

• The inventory. Which applications encrypt or sign what, with which algorithms, and how long each piece of data must stay confidential or authentic. ANSSI asks for that duration to be written down explicitly.
• Long-lived data first. Archives, backups, sensitive documents exchanged with partners are what "harvest now, decrypt later" targets. They are also the simplest to protect, since they go through a message format rather than a real-time protocol.
• Purchasing. Ask every vendor for its post-quantum roadmap, and plan renewals so that every purchase after 2030 has it.

A post-quantum migration is planned from the lifetime of your data, not from the arrival date of the quantum computer.

What Feranor PQC Suite does

Feranor PQC Suite answers the second project, protecting today the files and messages that must stay secret for a long time. It encrypts and signs hybrid by default, ML-KEM-1024 with ECDH P-384 for key exchange, SLH-DSA co-signed with ECDSA P-384 for signatures, under an ANSSI profile applied to everything it reads and everything it writes.

It only uses standard formats, CMS messages and PKCS#8 keys, and leaves the primitives to OpenSSL 3.5, with no homemade cryptography. It also takes your archives encrypted with RSA or ECDH and re-encrypts them to post-quantum recipients. It is declared to ANSSI as a means of cryptology (declaration no. 34734727).