Post-quantum cryptography (PQC)

The PQC transition cannot happen if trusted products are not available on the market. Therefore, ANSSI is now working to ensure the availability of a range of ANSSI-certified/qualified PQC solutions for organisations.

Security Assessments:

ANSSI is involved in developing the framework for the assessment of security products so that they may integrate PQC. Accordingly, the Agency supports cybersecurity solution evaluation centres (ITSEFs) in the development of their abilities pertaining to the evaluation of PQC algorithms, hybrid mechanisms, and the security of their implementations. ANSSI’s National Certification Centre (CCN) has initiated its first assessment pilot projects and has updated its cryptographic approval doctrine. In addition, the Agency aims to set up PQC obligations for qualification, starting from 2027.

ANSSI recently issued the first two certifications of products including Euclidean lattice-based post-quantum cryptography algorithms in France. The solutions of Thales and Samsung have been granted ANSSI’s security visa, following evaluations conducted by the CEA-Leti Evaluation Centre.

For more information on PQC product certification, see:

• Assessment centres for the PQC scope

ANSSI’s guides and frameworks

ANSSI is currently updating its various guides and frameworks to integrate PQC – in particular, its guide on cryptographic mechanisms (Annex B1 of the RGS) and its IPsecDR framework.

PQC offer monitoring

ANSSI is involved in monitoring the supply of post-quantum cryptography. At the end of 2024, ANSSI published the results of a survey conducted among developers of cybersecurity products integrating cryptography. This has contributed to identifying technical and organisational obstacles to the post-quantum transition.

Financial support schemes

ANSSI was involved in the launch of the latest (Opens a new window) (Opens in a new window)call for projects "Development of critical innovative technologies", initiated by the General Secretariat for Investment (SGPI), which provides financial support for the development of transition assistance tools.

In addition, ANSSI contributes to making the European PQC-related calls for projects of the Digital Europe and Horizon Europe programmes more visible and legible across the ecosystem of cybersecurity solution providers. These activities are carried out via the French Cyber Coordination Centre (NCC-FR), hosted by ANSSI.

ANSSI's objective is to support regulated organisations (considered as ANSSI’s "beneficiaries") in their transition towards PQC.

In order to establish an inventory of the beneficiaries' practices, ANSSI conducted a market study with some fifty ministries and strategic companies. At the same time, it conducted a survey on support and consulting services in PQC, among some thirty service providers likely to support the post-quantum transition of organisations.

ANSSI’s recommendations to prepare for the post-quantum transition

ANSSI advises public and private organisations, regardless of their sector, to include the quantum threat in their risk analysis and to begin an initial inventory process immediately in order to gain a clear understanding of their use of cryptography. Use cases identified as critical should be the first to be addressed as part of a post-quantum transition strategy.

According to ANSSI, it would not be reasonable to purchase products which do not incorporate PQC after 2030. PQC considerations must be factored into the information system renewal cycle so that the transition can be anticipated, managed, and potentially carried out at a lower cost.

Regulatory framework

The scope currently regulated with regard to cryptography covers classified defence data or data marked as “Restricted,” critical national infrastructure (SAIV in French), as well as product certifications and qualifications (ANSSI security visas). For these areas, regulations and standards will be updated to incorporate PQC. Beyond the abovementioned scope, there are currently no plans for dedicated regulations.