Forecasts for when quantum computers can break current cryptosystems are moving closer, while the process of replacing security technology could take years.

Q-Day is the term for the day quantum computers are powerful enough to break widely used public key cryptography systems, including RSA and elliptic curve cryptography (ECC). According to experts, when that scenario occurs, data protection mechanisms, electronic transactions and digital signatures may face great risks.

At the conference of the CYSEEX Information Security Alliance, held on October 21 in Hanoi, Mr. Vu Ngoc Son, Head of Technology Research - National Cyber ​​Security Association (NCA), warned that organizations may not have much time left if Q-Day appears earlier than expected. While some countries aim to complete the transition to post-quantum cryptography by 2030-2035, some predict that quantum computers capable of breaking traditional cryptography could appear as early as 2028-2030.

"The problem is, if Q-Day comes earlier than the transition completion stage, that gap will create risks," Mr. Son said.

There is currently no specific forecast on when Q-Day may occur. However, some major organizations around the world have prepared for this milestone. In June, Google warned that quantum computers could be capable of attacking some encryption systems by 2029, 6-15 years earlier than previously predicted. In 2024, the US National Institute of Standards and Technology (NIST) published the first post-quantum cryptography standards, creating a basis for organizations to begin the transition.

However, according to experts, risks do not only appear the day quantum computers are powerful enough. With an attack method called "Harvest Now, Decrypt Later" (collect now, decrypt later), attackers can store encrypted data to wait for quantum technology to develop and then find a way to decrypt it.

This is especially worrying for information that needs to be kept confidential for a long time, such as financial records, identification data, research information or sensitive data of agencies and businesses. Data stolen today could still be targeted in the future, even if attackers cannot currently decrypt it.

Therefore, according to Mr. Son, organizations should not wait until Q-Day is determined to start preparing. Cryptography is present in many layers of digital infrastructure, from secure connections to authentication and digital signatures. Replacement is not simply updating one piece of software but can involve many systems, equipment and operating processes.

The solution being developed is post-quantum cryptography (PQC), which uses algorithms designed to defend against attacks based on quantum computers, and can be deployed on conventional computers. NIST issued the first three PQC standards in August 2024, including one key establishment standard and two digital signature standards.

However, having a new standard does not mean that organizations can immediately convert. They need to determine what algorithms the systems are using, assess the level of risk, test compatibility, and replace each part without disrupting service.

According to Mr. Son, during the transition period, one approach is to use a hybrid model, combining traditional cryptography with post-quantum algorithms. This approach helps the system gradually add resilience to quantum risks, while maintaining compatibility with existing infrastructure.

Another requirement is "crypto-agility", which means changing the algorithm or cryptographic mechanism without having to redesign the entire application. According to Mr. Son, if the system is built too rigidly, each change in standards can lead to greater costs and implementation time.

In Vietnam, experts from NCA said that drafts of three national standards for post-quantum cryptography have been developed. Wide-scale deployment will also depend on technical standards, compatibility between systems and the transformation roadmap of each field.

According to Mr. Nguyen Quang Hoang, Director of Misa Information Security, preparation time is an important factor because the conversion cannot be done overnight. Enterprises can research and test key generation and signatures using post-quantum algorithms in a test environment, but cannot independently deploy commercially if other components in the chain are not compatible.

"It's not possible for just one business to transform," he said, emphasizing the need for coordination between units in the process of implementing post-quantum cryptography.

According to Misa's representative, businesses may be technologically ready but cannot put the solution into operation without common standards and synchronization from relevant parties. Therefore, the transition process needs a coordinated roadmap between management agencies, authentication infrastructure providers and organizations that are using digital signatures.

Mr. Pham Trung Thanh, security consultant at Vietnam National Cyber ​​Security Technology Joint Stock Company (NCS), recommends that businesses start with foundational measures such as building regulations for safe use of devices, accounts and data; Inventory IT assets and narrow the attack surface. These steps help organizations clearly understand their systems before deciding to invest in specialized solutions.

At the event, a CYSEEX representative said that in 2027, the alliance sets directions including "Autonomous AI", "Active Defense" and "Quantum Safety". In particular, the alliance plans to expand the application of AI agents towards controlled automation, ensuring that all actions are monitored, traced and high-risk decisions are still approved by humans. Attack-defense drills, incident response and online fraud prevention will also be maintained.

With quantum safety, CYSEEX aims to test post-quantum cryptography in suitable systems, while focusing on inventorying encryption systems and building a transition roadmap before quantum computers are capable of threatening current security mechanisms.

Liu Quy