G7 Cyber Working Group and ANSSI Issue Joint Call to Action for Post-Quantum Cryptography Migration
Under France's 2026 G7 presidency, French cybersecurity agency ANSSI has taken the lead of the G7 cybersecurity working group. This collaborative group brings together national cybersecurity agencies and incident response centers from across the G7 member nations, joined by the European Commission and ENISA as invited participants. Building upon initial efforts from the 2025 Canadian presidency, the working group has expanded technical reflections on transitioning away from legacy public-key infrastructure toward post-quantum cryptography (PQC). During the previous year, a formal declaration laid the groundwork by proposing practical recommendations to guide organizations through adopting quantum-resistant algorithms. Now, the international coalition is escalating its message directly to public and private decision-makers, emphasizing the mounting urgency posed by quantum computing capabilities. Long story short, the collective message warns that waiting for viable quantum threats to emerge in production is too late, framing the cryptographic overhaul as an immediate national security priority. The working group's published call to action demands coordinated planning across both government entities and enterprise technical leadership. The core takeaway from the initiative remains clear: transitioning to quantum-safe architectures requires proactive modernization roadmaps today rather than reactive patching down the line.
Commentary
Migrating off legacy asymmetric algorithms like RSA and classic elliptic curves (such as `secp256r1` or `ed25519`) is notoriously painful. The real danger driving calls to action like this is the 'Harvest Now, Decrypt Later' (HNDL) paradigm, where adversaries intercept and store encrypted TLS, VPN, and SSH traffic today, waiting for cryptanalytically relevant quantum computers to break key exchanges retrospectively. Engineering teams need to start with crypto-agility and discovery. This means inventorying where asymmetric keys are baked in: TLS termination points, code-signing pipelines, SSH `authorized_keys`, VPN tunnels (IPsec/WireGuard/OpenVPN), and internal PKIs (`x509` certs). Evaluating hybrid key exchange algorithms (such as X25519 combined with ML-KEM / Kyber) in staging environments allows teams to baseline network overhead, as PQC public keys and ciphertexts are significantly larger in byte size and can lead to packet fragmentation or performance regressions.
The Quote to Remember
“la transition vers la cryptographie post-quantique est un enjeu sécuritaire majeur, qui exige un effort collectif et coordonné. Les organisations, qu’elles soient publiques ou privées, doivent anticiper et agir dès aujourd’hui.”