Post-Quantum Migration Deadlines Protect the Pipe | Elacity
Germany, Singapore and the UK set post-quantum migration deadlines last week. They upgrade the connection; a file copied before the switch keeps its old lock for good.
Post-Quantum Migration Got Its Deadlines. They Protect the Pipe, Not Your Files.
Anything you upload has to stay secret for as long as it stays valuable. For a contract, a medical file, or a song you plan to license for twenty years, that can be longer than experts expect today's public-key encryption to hold, and last week's wave of post-quantum migration deadlines will not change that for the copies that matter most.
In four days, Germany published its national guideline for the EU post-quantum roadmap, with high-risk systems migrated by the end of 2030 and the switch largely done by 2035. Singapore set 2031 for critical infrastructure and 2035 for other exposed organisations. The UK's NCSC told organisations to start moving TLS to post-quantum settings now.
That is real progress. It is also aimed at institutions: their networks, their servers, their migration plans. Our earlier explainer on post-quantum migration made the case for sealing the data, not the pipe. The new dates make that concrete: the 2030, 2031 and 2035 deadlines secure connections, not the files that were already copied. Your files are a separate question.
The Failure of Migrating the Pipe
The threat these deadlines answer is simple. Singapore's advisory says attackers are already expected to be stealing encrypted data today so they can decrypt it once quantum computers mature, and cites expert estimates that a capable machine could arrive within five to ten years.
Europol's harvest now, decrypt later report is specific about what is worth hoarding: data that keeps its value for years, naming health records and intellectual property. It also finds that TLS, SSH and OpenPGP, the protocols much of the internet runs on, are susceptible, with risk varying by configuration.
Here is the gap. The fixes now on the calendar mostly upgrade the connection. RFC 10024 standardises hybrid post-quantum key agreement for TLS 1.3, and the NCSC says protecting data in transit will be high priority for many organisations. Once your file arrives, the platform decrypts it and stores it under keys it chose, on a schedule it sets.
Two consequences follow. A copy harvested before an organisation migrates keeps its old encryption forever, because upgrading the server does nothing to an archive an attacker already holds. And the date your work becomes safe is whatever date your provider finishes, which you neither see nor control.
In fairness, Europol rates the risk to most private individuals as low to medium, since most personal data loses value quickly. That caveat is exactly the problem for anyone turning their work into an asset. Property is supposed to keep its value. A dataset, a film, or a model you license for a decade is the long-lived data the report warns about.
The Elacity Solution: Seal the File, Not Just the Connection
Elacity starts from the other end. With Elacity dDRM, you package your data, work, or IP into a Wealth Capsule: an encrypted, programmable, royalty-bearing on-chain good that humans and AI agents pay to use. The protection travels with the file instead of depending on whichever network it crosses.
Underneath runs the Elacity runtime/home (ElastOS), the open-source runtime that gives you a computer you own. Your machine is the source of truth; the cloud is a guest that only ever sees sealed content.
1. Post-quantum-hybrid sealing, today
Wealth Capsules are sealed with post-quantum-hybrid cryptography now, not on a 2035 roadmap. Hybrid means a classical and a post-quantum algorithm both guard the key, so breaking one is not enough. It is the same kind of pairing the NCSC recommends for TLS. An archive harvested this year captures ciphertext built to survive the machine it is waiting for.
2. Encrypted everywhere except the moment of use
The content never sits in the clear on a server waiting for its owner to migrate. It stays encrypted at rest and in transit, and opens only inside a sealed sandbox for the moment of use. The player gets the experience, pixels or a stream or a working copy, and never the key.
3. No whole key to harvest
Ciphertext is only half of a harvest; the other half is the key. The key that unlocks a Wealth Capsule is split across an owned 2-of-3 quorum of independent machines, and each one re-checks your on-chain rights before releasing its share. No single operator, Elacity included, holds a whole key to steal, store, or hand over. That makes it trust-minimised rather than trustless: a colluding quorum could in principle rebuild a key, and we say so. For the longer argument, see why only sealing survives harvest now, decrypt later and who holds the key in decentralised DRM.
What to Do Before Any Deadline
- Ask where your most valuable files live and whose keys protect them at rest, not only whether the site uses HTTPS.
- Treat anything you expect to license for years as long-lived data, the category Europol says is worth hoarding.
- Prefer formats that carry their own encryption, so your protection does not wait on a provider's migration plan.
The deadlines are for systems, and they are years away. Your work can carry a lock that is finished today. More from the engineering side lives in Protocol Engineering.
Get ElastOS