What School Boards Need to Know About Post-Quantum Cryptography

Post-quantum cryptography is a governance issue before it is a technical one. Boards oversee institutions that hold student records, health information and decades of archived data.

Harvest-now-decrypt-later is a risk where adversaries obtain encrypted data protected by vulnerable cryptography and retain it for possible future decryption. It is not proof that all long-lived confidential data is already exposed. No publicly known cryptographically relevant quantum computer currently exists; this discussion does not predict an arrival date.

RSA relies on factoring, while other threatened public-key systems rely on discrete logarithms, including elliptic curves. Shor's algorithm poses a conditional future threat to these systems on sufficiently capable hardware. It does not break all encryption; symmetric encryption is a different case. Post-quantum cryptography runs on classical systems, with standardized key establishment and signature methods.

This framework proposes three starting questions. Which sensitive information needs long-term confidentiality, and how is it protected? What migration plans and dependencies do our vendors identify? Who owns cryptographic risk in our organisation? Priorities should reflect risk and vendor-led migration planning, not a universal ten-year threshold.

Early discussions may help boards plan and budget for migration; they do not guarantee a particular outcome.