Intel® Core™ Ultra Processors
Learn More about Intel
Post-Quantum Cryptography (PQC)
Navigate the transition to post-quantum cryptography
Post-quantum cryptography (PQC) protects sensitive data and infrastructure against classical and quantum computing attacks. The challenge organizations face goes beyond upgrading a single device. Dell provides a phased, infrastructure-wide approach to upgrade cryptographic foundations across your environment—from endpoints and servers to storage and cloud.
Post-quantum transition starts with end-to-end visibility
Managing PQC migration requires clarity across every layer of your technology stack. Modern enterprise environments span hardware, firmware, software, silicon, networking, and broad supply chains. Each carries distinct cryptographic dependencies. Dell helps you identify and secure risks across your environment to build cyber resilience today while preparing for future quantum risks.
A phased, infrastructure-wide approach
Phased delivery
PQC will arrive across products and infrastructure layers through software, firmware, and next-generation hardware advancements.
Hybrid cryptographic coexistence
Classical and post-quantum algorithms operate side-by-side to strengthen protections without disrupting existing environments.
Cryptographic agility by design
Dell is architecting systems to support algorithm changes over time, eliminating full system redesigns as standards and guidance evolve.
A six-layer model for quantum resilience
Dell embeds post-quantum cryptography into six dependent layers for defense-in-depth across the entire technology stack. By eliminating single points of cryptographic failure, this architecture ensures every layer reinforces the integrity of the next.
1. Hardware supply chain and platform integration
Dell works with silicon and component providers to align quantum-resistant trust foundations at the hardware level.
2. Secure manufacturing and code signing
Dell ships The National Institute of Standards and Technology (NIST) SP 800-208 PQC signature algorithms on select platforms to secure firmware signing and prevent attackers from forging update signatures to compromise platform trust. This is the layer that answers "Trust Now, Forge Later", where the risk is a forged firmware update signature rather than decrypted data.
3. Platform root of trust
Dell advances secure boot and firmware verification across the platform trust chain to support post-quantum validation models.
4. Platform software and cryptographic services
Dell is migrating toward PQC-capable libraries and services aligned with the latest validation requirements, supporting ML-KEM and ML-DSA while separately tracking FIPS 140-3 module validations.
5. Secure system communications
Dell embeds cryptographic agility into communication layers, including Transport Layer Security (TLS), identity, and enterprise integration services.
6. Customer workload and data security
Dell extends protection to customer data-at-rest, replication, backup, and key management through hybrid post-quantum deployment models.
Post-quantum migration roadmap
-
Phase 1: Strengthen security hygiene
Establish strong baseline controls, including least privilege, multi-factor authentication (MFA), patch management, and robust classical algorithms such as AES-256 and SHA-384 or higher. -
Phase 2: Inventory cryptographic dependencies
Build a comprehensive cryptographic Bill of Materials (CBOM) to identify where and how public-key cryptography powers applications, devices, and workflows. -
Phase 3: Analyze, prioritize, and plan
Evaluate cryptographic assets and dependencies, prioritized by business criticality, data sensitivity, and required lifespan. -
Phase 4: Migrate with cryptographic agility
Align adoption with technology refresh cycles rather than creating a separate program. Pilot in controlled environments to test performance, interoperability, and manageability. Select platforms supporting in-place algorithm updates and treat hybrid classical-PQC modes as a temporary transition bridge.
Aligned with evolving standards and guidance
PQC continues to evolve through new standards, procurement requirements, and validation pathways. The Dell portfolio directly aligns with these frameworks to maintain continuous compliance.
NIST PQC standards
NIST published three initial post-quantum standards in August 2024: ML-KEM for key establishment (FIPS 203), ML-DSA for digital signatures (FIPS 204), and SLH-DSA for signatures (FIPS 205).
- Phased deployment: Dell is integrating these algorithms across the infrastructure portfolio on a rolling schedule.
- Architecture protection: System design accommodates newly approved algorithms without requiring hardware redesigns.
CNSA 2.0 compliance
Commercial National Security Algorithm (CNSA 2.0) sets official, enforceable government requirements for higher security settings than standard NIST baselines.
- Mandated parameter sets: Systems implement ML-KEM-1024, ML-DSA-87, AES-256, and SHA-384/512, alongside NIST SP 800-208 stateful hash-based signatures for firmware signing.
- Direct engineering: Dell builds hardware directly to these specifications.
- Pure PQC path: CNSA 2.0 eliminates hybrid mode requirements, providing national security customers a direct migration path to pure post-quantum cryptography.
FIPS 140-3 validation
Algorithm support and certified compliance follow separate validation lifecycles.
- Independent tracks: Dell manages algorithm implementation and Federal Information Processing Standards (FIPS) 140-3 module testing on distinct operational tracks.
- In-process validation: Infrastructure can run ML-KEM today while module certifications complete formal testing.
- Audit transparency: Dell provides explicit certificate numbers for compliance audits. When evaluating any vendor, request the certificate number, not the algorithm name.
Regulatory deadlines driving PQC adoption
Compliance timelines depend on the systems used by your organization. Data with a long confidentiality life may currently be at risk. To prevent future decryption of harvested data, migration to PQC should start immediately across frameworks established by NIST.
National security systems
Applies to defense, intelligence, and classified networks.
- January 1, 2027: New system purchases should support post-quantum algorithms (2026 Executive Order; CNSA 2.0).
- December 31, 2030: Systems that cannot support post-quantum updates must be retired or replaced (CNSA 2.0; Committee on National Security Systems Policy 15 [CNSSP 15]).
- December 31, 2031: Post-quantum algorithms are required for all deployments unless granted an official waiver (CNSA 2.0). Pure post-quantum is the objective; hybrid modes are not required.
Federal civilian agencies
Applies to non-defense government departments and civilian contractors.
- December 31, 2030: High-priority systems must use post-quantum key exchange (Executive Order 14412 [EO 14412]; Office of Management and Budget [OMB] Memorandum M-26-15).
- December 31, 2031: High-priority systems must use post-quantum digital signatures (OMB M-26-15).
- December 31, 2035: Civilian agency systems complete full migration (EO 14412; OMB M-26-15). Hybrid architectures and cryptographic agility are explicitly accommodated during transition.
Commercial systems
Applies to private-sector businesses, enterprise infrastructure, and commercial tech.
- 2030: NIST IR 8547 deprecates classical algorithms like RSA and ECC. Organizations may keep deprecated methods active, but leadership assumes operational risk.
- 2035: Regulatory frameworks formally disallow classical algorithms across commercial compliance environments (NIST IR 8547).
- Immediate step: Upgrade baseline encryption to AES-256 and SHA-384 to exceed current minimums and protect long-term data.
Protection across the Dell portfolio
Dell embeds post-quantum cryptography across PCs, servers, storage, networking, and data protection platforms. Protections advance across every infrastructure layer, prioritized by risk, architectural dependency, and implementation readiness.
Related insights
Viewing of 7
/ 7
Platform Integrity: Quantum-Resistant Firmware and Ransomware Resilience
Off-host BIOS checks. Post-quantum crypto. Halcyon on the box. See why Dell beats HP when compromise is assumed.
Post-Quantum Readiness Gains New Urgency Across Federal Agencies
PQC is no longer a future challenge – it's a federal cybersecurity priority that requires action today.
What the New PQC Executive Order Means for Organizations
Dell provides insights on the recent EO and what customers should prioritize for PQC readiness.
PQC and Storage: Why “Ready” Is the Wrong Question
There’s a growing tension in cybersecurity conversations leading to a deceptively simple question: Is your storage PQC Ready?
Dell’s Layered Approach to PQC Readiness
PQC isn’t a simple upgrade. Discover why storage security demands a layered approach—from silicon to software—to address quantum-era risks.
Building a Quantum-Ready Foundation with Advanced BIOS Security
Take a step towards quantum resistance with the latest release of the Dell Trusted Device App.
Quantum Resilience, Built In
Is your fleet on track to meet PQC mandates? Learn how Dell’s latest PC security upgrades counter emerging quantum threats and ensure compliance.
Questions
The instinct is to start by upgrading encryption. But the real first move is discovery. You can't protect (or prioritize) cryptography you can't see, so the foundation is a complete inventory of where and how cryptography protects your data. From there, the path splits. Symmetric encryption holds up well: upgrading to AES-256 keeps it quantum-resistant, since even a quantum attacker only halves its effective strength. Asymmetric encryption is the real exposure. RSA and ECC can't be rescued by larger keys, quantum computing breaks them outright, so they must be replaced with post-quantum algorithms. The urgency comes from data that persists. Adversaries are already harvesting encrypted long-lived data today, positioned to decrypt it the moment quantum capability arrives. For that data, the clock is already running.
The risk is not limited to the arrival of a future quantum computers that can break encryption. Organizations need to think now about long-standing data, digital trust, and the time required to migrate complex environments in a phased, manageable way.
Trust Now, Forge Later refers to the risk that future quantum capabilities could undermine digital signatures used in firmware validation, secure boot, software updates, and certificate chains. If signatures can be forged, trusted mechanisms can become attack surfaces.
Harvest Now, Decrypt Later refers to the risk that adversaries capture encrypted data today with the expectation of decrypting it once quantum computers mature. This is especially important for long-lived data such as backups, archives, compliance records, and intellectual property.
Dell’s point of view is that customers should move beyond simplistic “PQC ready” claims and focus instead on a phased, full-stack transition across the trust chain, with flexibility to adapt as standards and product capabilities evolve.
Not always. Many PQC capabilities can be delivered through software and firmware updates on existing platforms, though some protections, including certain hardware-rooted capabilities, may require next-generation systems.
Dell is engineering PQC implementations to minimize performance impact. In some cases, cryptographic processing can be offloaded to hardware to reduce CPU overhead while maintaining stronger protection.
Hybrid cryptographic modes allow classical and PQC algorithms to coexist, helping organizations modernize without requiring every connected system to transition at the same time.
Organizations should ask whether a vendor's PQC strategy accounts for how their solution integrates with the broader environment, including dependencies on firmware, software, silicon, networking, and other components it connects to. A strong claim addresses more than the vendor's own product in isolation; it considers the cryptographic implications across every integration point in the customer's infrastructure.
Quantum risk affects both confidentiality and trust. If digital signatures can eventually be forged, firmware validation and trusted software updates can become attack surfaces as well.
Usually not, and waiting is often the more expensive choice. Dell is building platforms so most of the post-quantum transition arrives as software and firmware updates on hardware you buy today, rather than as a replacement cycle. Where a capability genuinely depends on new silicon, we will tell you, rather than implying an update will cover it. The practical risk is not buying too early. It is buying infrastructure with no published post-quantum path, from a supplier who has not told you which parts will need new hardware.
Yes, Dell participates in the NIST NCCoE Migration to Post-Quantum Cryptography project, OASIS KMIP, SAFECode, the Trusted Computing Group, and the FIDO Alliance PQC study group.
Intel® Core™ Ultra Processors
Learn More about Intel