France to Stop Certifying Encryption Without Quantum Protection

France is accelerating its transition to post-quantum encryption. The National Cybersecurity Agency (ANSSI) announced on Tuesday that it will stop certifying information security tools that lack resistance to attacks using quantum computers.

Timeline for the transition

Speaking at the France Quantum conference, ANSSI chief of staff Samih Souissi said the agency will stop issuing such certificates starting in 2027. In addition, businesses have been advised to switch exclusively to quantum-resistant products by 2030.

Why it matters

ANSSI certification is mandatory for the use of products in France's government institutions and at critical infrastructure facilities. This turns the agency's new policy into a de facto mechanism for pushing outdated cryptographic systems out of the most sensitive areas of use.

As a result, ANSSI's decision will affect not only makers of security tools but also government agencies and operators of critical facilities, who will have to plan ahead for the transition to new encryption algorithms.

The threat context

Concerns about post-quantum encryption stem from the potential ability of future quantum computers to break modern cryptographic algorithms that are considered secure today. Although practically usable quantum computers of that scale have not yet been built, regulators around the world are preparing the infrastructure for this transition well in advance, in order to avoid a situation in which stockpiled encrypted data becomes vulnerable retroactively.

France's move is one of the first cases in which a national regulator has set a specific deadline for ending the certification of products without post-quantum protection, setting a benchmark for other countries and organizations working on similar transition strategies.

Source: Schneier on Security