Skip to content
Menu

Privacy and compliance · Guide

India’s post-quantum roadmap starts with a cryptographic inventory.

A Department of Science and Technology task force wants critical information infrastructure on post-quantum cryptography by 2029, and other enterprises by 20331. Both tracks begin with an inventory of cryptographic assets, and the report would make vendor CBOMs mandatory in procurement from FY 2027-281.

Written by
NetScale IT Services
Published
Sources checked
Read
11 minutes
On this page

The facts

What does India’s post-quantum roadmap ask for, and by when?

In an Indian bank or telecom operator, RSA and elliptic-curve keys sit in TLS certificates, VPN tunnels, HSMs and signed software. Shor’s algorithm, run on a large enough quantum computer, undermines both1. Symmetric encryption needs larger keys and revised parameters1.

In February 2026, a task force constituted by the Department of Science and Technology (DST) under the National Quantum Mission proposed India’s timeline1. Critical information infrastructure (CII) is to reach full post-quantum cryptography (PQC) adoption by 2029, and other enterprises by 20331. The first milestone on both tracks includes an inventory of cryptographic assets1.

Table 1. India’s three post-quantum milestones, from the DST task force report of February 2026
MilestoneCII, byOther enterprises, byWhat the report lists
1. Build foundations20272028Inventory cryptographic assets and assess quantum risk; begin PQC or hybrid signatures for critical systems; mandate vendor CBOM submissions from FY 2027-281.
2. Migrate high-priority systems20282030Enforce “no new classical-only deployments”; upgrade PKI, HSMs, key management systems and libraries to PQC-ready versions1.
3. Full PQC adoption20292033Enterprise-wide PQC or hybrid adoption, PQC-only trust chains and quantum-safe digital signatures throughout1.

The report gives defence, power and telecom as examples of CII sectors on the faster track1. An organisation that fits more than one of its adopter personas should let the highest-risk one guide its priorities1.

These are recommendations, not a notified rule: the roadmap calls itself a reference for regulators “to give specific and binding mandates for organisations”1. The task force wants it sent to regulators such as SEBI, RBI and CERC “to initiate sector-specific guidance”1. Its testing framework “is not a regulatory mandate” either: it lets regulators set sector timelines and enforcement1.

PostQuantum.com reported on 15 May 2026 that a 140-page final edition kept the draft’s core timelines2. The Data Security Council of India, which led the migration sub-group, lists that edition as Quantum-Safe Ecosystem in India, dated 13 May 20263. Its summary gives the same targets: CII by 2029 and enterprises by 20333.

The facts

Which standards and dates does the roadmap build on?

NIST published three post-quantum standards on 13 August 2024456. FIPS 203 specifies ML-KEM, a key-encapsulation mechanism for agreeing a shared key, in three parameter sets: ML-KEM-512, ML-KEM-768 and ML-KEM-10244. FIPS 204 specifies the ML-DSA signature algorithm, and FIPS 205 the hash-based SLH-DSA56.

NIST’s transition plan, IR 8547, proposes when today’s public-key algorithms retire7. Schemes at 112 bits of security strength, such as RSA and ECDSA, are “deprecated after 2030”7. Every listed RSA, elliptic-curve and Diffie-Hellman scheme is “disallowed after 2035”, whatever its strength7. The plan was still an initial public draft when we checked on 8 October 20267.

IR 8547 ties 2035 to the US National Security Memorandum 10, which sets it as the primary target for moving federal systems to PQC7. The DST report also gives 2035 as the completion year for the US, UK, EU and Canada1. NIST adds that, historically, moving from a standard to full use in information systems can take 10 to 20 years7.

The facts

What do CERT-In and the testing framework already ask of vendors?

CERT-In’s Technical Guidelines on SBOM, QBOM and CBOM, AIBOM and HBOM, version 2.0 of 9 July 2025, define the cryptographic bill of materials (CBOM)8. A CBOM is “an inventory of cryptographic assets”: algorithms, keys, protocols, certificates and dependencies, with metadata such as usage and expiry dates8.

The guidelines say government, public sector and essential services organisations shall require a CBOM in related procurements, and that suppliers must provide one8. Organisations must keep it current, in a standard format such as SPDX or CycloneDX8. The best practices add a review at least quarterly8. For vendors, the guidelines call for tiered PQC contract terms, including quarterly migration progress reports and proof-of-concept demonstrations before renewal8.

CERT-In’s advisory of 26 April 2026 asks organisations to track bills of materials for “Quantum Computing & Cryptography requirements”9. Its blueprint of 25 May 2026 repeats the call for QBOM and CBOM alongside SBOM and AIBOM10. CERT-In also published a white paper, Transitioning to Quantum Cyber Readiness, in July 202511.

For testing, the DST report sets four assurance levels1. Level 3 covers enterprise infrastructure such as banking, telecom and healthcare1. Tier-1 and Tier-2 testing labs are targeted for December 2026, and TEC’s existing approval framework continues until the new set-up is operational1. The report also asks TEC to publish an Indian list of cryptography-dependent products, to be communicated as a future compliance requirement for vendors1.

What it means

Why does 2027 matter if your deadline is 2033?

Because what you buy in 2027 will still be running at the milestones. A CII operator is to enforce “no new classical-only deployments” by 2028, and an enterprise by 20301. A VPN gateway or HSM bought next year on a five-year contract outlives either date. The report wants organisations to start requesting CBOMs in FY 2026-27, the current financial year, and to mandate them through procurement from FY 2027-281.

The other exposure is the data itself. In a “harvest now, decrypt later” attack, an adversary stores encrypted traffic today and decrypts it once a quantum computer can17. The DST report names financial records and healthcare information among the data with a long shelf life1.

IR 8547 gives a simple test, Mosca’s theorem7. If data must stay secret for X years and migration takes Y years, start before X plus Y exceeds Z7. Z is the expected time until a cryptographically relevant quantum computer is built7. X and Y are the numbers you can find out for your own systems, so rank by them.

Key exchange in TLS and VPNs protects confidentiality, so it carries the harvest-now risk today7. Authentication can move later: its algorithms and keys only have to be secure at the moment it is performed7. The exception is a device whose signature check cannot be updated after manufacture7. If it may still be in use when such computers arrive, NIST says it should be designed to require quantum-resistant signatures7.

What it means

Where do RSA and elliptic-curve keys sit in your estate?

Start with these six places. The “What to record” column draws on CERT-In’s minimum CBOM elements8.

Table 2. Where public-key cryptography usually sits, what to record and what to ask the vendor
WhereWhat to recordWhat to ask the vendor
Load balancers, WAFs, reverse proxies and API gatewaysTLS versions, key-exchange groups offered, certificate key type and expiryWhich release offers hybrid ML-KEM key exchange, and when
VPN gateways and site-to-site tunnelsModel, firmware and the IKE or TLS groups in useThe PQC plan for IPsec and remote access, by firmware version
Internal certificate authorities and device certificatesSignature algorithm, key size, validity and what trusts each rootWhether the PKI product will issue ML-DSA or hybrid certificates
HSMs and key management systemsModel, firmware, the keys held and the data they protectWhether ML-KEM and ML-DSA arrive by firmware update or need new hardware
Code and firmware signingSigning keys, algorithms and the devices that verify themWhether devices in the field can accept a new signature algorithm
Applications and core platformsThe cryptographic libraries and versions they linkA CBOM for the product, in SPDX or CycloneDX8

What to check this month:

  1. Export every certificate from your certificate authorities, load balancers and cloud certificate stores, with key type, key size, issuer and expiry.
  2. Scan your internet-facing hosts and record the TLS version and key-exchange group each one negotiates. Flag the ones that cannot offer X25519MLKEM768.
  3. Find managed Chrome browsers that have post-quantum key agreement turned off by policy. Google said Chrome 131 would offer a hybrid ML-KEM key share12. The PostQuantumKeyAgreementEnabled policy is supported only up to Chrome 14613. Where a device breaks with it on, Chromium’s advice is to ask that device’s vendor for a fix13.
  4. Record the OpenSSL version on every server and appliance you can query. OpenSSL 3.5.0 offers X25519MLKEM768 and X25519 as its default TLS key shares14.
  5. Check OpenSSH versions on servers and jump hosts. Version 10.0 made mlkem768x25519-sha256 the ssh client’s default key agreement, and 10.1 warns when a connection negotiates a non-post-quantum one1516.
  6. List each HSM and key management system with its firmware, the keys it holds and the data those keys protect.
  7. Write down, for each system, how many years its data must stay confidential and how long replacing its cryptography would take. Sort by the sum.
  8. Keep the inventory in CycloneDX or SPDX, so you can compare it with the CBOMs vendors send, and review it each quarter8.

Our view

Should you buy quantum-safe products now, or wait?

Our view: take the inventory now, and buy with care. It is part of the first milestone on both tracks1, and it tells you which of next year’s purchases are exposed.

From your next RFP, put four questions to every vendor of a PKI, HSM, VPN, firewall, load balancer or core platform:

  • Which NIST standard does the product implement, FIPS 203 or FIPS 204, and at which parameter set?
  • Does it support hybrid key exchange today, and if not, in which release?
  • Can its algorithms be changed by configuration or firmware, without new hardware?
  • Will you supply a CBOM in SPDX or CycloneDX, and update it with each release?

Prefer hybrid key exchange where vendors already ship it, such as X25519MLKEM768 in TLS. NIST says hybrids are typically designed to stay secure if at least one component algorithm is secure, and expects them to be temporary7.

Do not buy a product because its datasheet says “quantum-safe”. Ask which standard, which parameter set and who tested it. Until India’s new Tier-1 and Tier-2 labs are operational, check the vendor’s documentation and whether TEC’s existing framework has approved the product1.

The counter-view is that the Indian dates are too tight, and NIST’s own plan is still a draft7. Prateek Tripathi of the Observer Research Foundation wrote that India’s 2033 deadline may be “a bit too aggressive and optimistic”17. Most nations, he noted, chose 203517. That argues for buying carefully, and the inventory is worth doing either way.

This advice applies less if your data stays sensitive for a year or two and none of your systems is CII. In that case, let the inventory follow your next certificate renewal cycle rather than lead it.

Limits

What is for your regulator, and what is out of scope?

Whether your systems count as CII, and which milestones bind you, is for your regulator. Applicability is for your counsel. We worked from the February 2026 report, not the May final edition.

Quantum key distribution (QKD) is out of scope. The report calls PQC the broadest route for most organisations, and QKD a strategic, high-assurance option for specific uses1.

Where we fit

Can NetScale run the inventory with you?

A cryptographic inventory is architecture work: where your network, identity and cloud depend on RSA and elliptic-curve keys, and which vendor holds each fix. Our security architecture review is where we would start it, with findings ranked by risk for your ISO 27001 risk register. The review is free, and the written findings are yours whether we work together or not. NetScale is not a PQC testing laboratory and does not certify products as quantum-safe.

Questions readers ask

Is post-quantum cryptography mandatory in India?

The national roadmap is not a mandate. The DST task force report of February 2026 recommends milestones from 2027 to 20331. It leaves binding mandates to sector regulators such as RBI, SEBI and CERC1. CERT-In’s guidelines already say government, public sector and essential services organisations shall require a CBOM in procurement8. Applicability is for your counsel.

What is a CBOM, and who will ask us for one?

A cryptographic bill of materials is an inventory of cryptographic assets: algorithms, keys, protocols, certificates and their dependencies8. CERT-In asks for it in a format such as SPDX or CycloneDX8. The DST report wants buyers to request vendor CBOMs from FY 2026-27 and mandate them from FY 2027-281. A customer in a critical sector may write one into your next contract.

When do Indian banks have to move to post-quantum cryptography?

It depends on whether the system is critical information infrastructure. CII is to lay foundations by 2027, migrate high-priority systems by 2028 and finish by 2029; other enterprises by 2028, 2030 and 20331. The task force’s short-term actions include PQC pilots in sectors such as banking and finance, and sending the report to RBI for sector guidance1. Watch RBI’s notifications.

Is ML-KEM ready to use today?

Yes, for key exchange. NIST published ML-KEM as FIPS 203 on 13 August 20244. OpenSSL 3.5.0 offers X25519MLKEM768 as a default TLS key share, and OpenSSH 10.0 uses mlkem768x25519-sha256 by default1415. Both pair ML-KEM with X25519 in a hybrid, which is the mode we would turn on first.

Will a quantum computer break AES and our encrypted backups?

Not in the way it would break RSA. The DST report says Shor’s algorithm undermines RSA and elliptic-curve cryptography1. Grover’s algorithm speeds up attacks on symmetric encryption and hashes, which calls for larger keys1. Check how backup keys are wrapped, though: if RSA protects the AES key, the backup inherits RSA’s exposure.

References

  1. 1Department of Science and Technology, Government of India (Internet Archive copy of the DST PDF). Implementation of Quantum Safe Ecosystem in India: Report of the Task Force. February 2026; archived 26 September 2026. web.archive.org (opens in a new tab)Checked
  2. 2PostQuantum.com (Marin Ivezic). India Finalizes Quantum-Safe Roadmap: CII Migration by 2029, Testing Labs by 2026. 15 May 2026. postquantum.com (opens in a new tab)
  3. 3Data Security Council of India (DSCI). Quantum-Safe Ecosystem in India. 13 May 2026. dsci.in (opens in a new tab)
  4. 4National Institute of Standards and Technology (NIST), Computer Security Resource Center. FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard. 13 August 2024. csrc.nist.gov (opens in a new tab)
  5. 5National Institute of Standards and Technology (NIST), Computer Security Resource Center. FIPS 204, Module-Lattice-Based Digital Signature Standard. 13 August 2024. csrc.nist.gov (opens in a new tab)
  6. 6National Institute of Standards and Technology (NIST), Computer Security Resource Center. FIPS 205, Stateless Hash-Based Digital Signature Standard. 13 August 2024. csrc.nist.gov (opens in a new tab)
  7. 7National Institute of Standards and Technology (NIST). Transition to Post-Quantum Cryptography Standards (NIST IR 8547, Initial Public Draft). 12 November 2024. nvlpubs.nist.gov (opens in a new tab)Checked
  8. 8Indian Computer Emergency Response Team (CERT-In), Ministry of Electronics and Information Technology. Technical Guidelines on | SBOM | QBOM & CBOM | AIBOM | HBOM | Version 2.0. 9 July 2025. cert-in.org.in (opens in a new tab)
  9. 9Indian Computer Emergency Response Team (CERT-In). Defending Against Frontier AI Driven Cyber Risks (CERT-In Advisory CIAD-2026-0020). 26 April 2026. cert-in.org.in (opens in a new tab)
  10. 10Indian Computer Emergency Response Team (CERT-In). Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure (Version 1.0). 25 May 2026. cert-in.org.in (opens in a new tab)
  11. 11Press Information Bureau, Government of India. CERT-In: India’s Frontline Defender against Cyber Threats. 23 January 2026. static.pib.gov.in (opens in a new tab)
  12. 12Google Online Security Blog. A new path for Kyber on the web. 13 September 2024. security.googleblog.com (opens in a new tab)
  13. 13The Chromium Projects, Chromium source code. Enable post-quantum key agreement for TLS (PostQuantumKeyAgreementEnabled policy definition). Main branch, read October 2026. chromium.googlesource.com (opens in a new tab)
  14. 14OpenSSL Library. OpenSSL 3.5 Series Release Notes. OpenSSL 3.5.0 released 8 April 2025. openssl-library.org (opens in a new tab)
  15. 15OpenSSH. OpenSSH 10.0 release notes. 9 April 2025. openssh.com (opens in a new tab)
  16. 16OpenSSH. OpenSSH 10.1 release notes. 6 October 2025. openssh.com (opens in a new tab)
  17. 17Observer Research Foundation (Prateek Tripathi). India’s Post-Quantum Cryptography Migration Roadmap. 23 March 2026. orfonline.org (opens in a new tab)

Changes

  • First published.

Written by NetScale IT Services. How these guides are written

  1. Security operations10 minutes

    How to meet CERT-In’s 12-hour patch window.

  2. Infrastructure and networks11 minutes

    Windows 10 ESU, Server 2016 and SQL Server 2016: the dates to 2027.