Title page 1

Contents 3

Highlights 2

Letter 6

Background 10

Overview of Cryptography 11

Overview of Quantum Computing 14

Federal Roles and Responsibilities for Adopting Cryptography and Supporting Quantum Computing 15

Quantum Computers Pose Significant Threats to Cryptography on Federal Systems 17

Threat Actor Use of a Quantum Computer Would Have Devastating Impacts to Federal Systems 17

Estimates Vary on When a Cryptographically Relevant Quantum Computer Will Be Developed 21

Agencies Have Not Fully Implemented Preparatory Practices for Addressing Quantum Cyber Threats 25

Agencies Have Not Fully Developed Prioritized Inventories of Systems with Vulnerable Cryptography 27

Agencies Have Not Fully Identified Funding Needed to Transition to Post-Quantum Cryptography 34

Agencies Have Not Tested Post-Quantum Cryptography 36

Conclusions 38

Recommendations for Executive Action 39

Agency Comments and Our Evaluation 39

Appendix I: Objectives, Scope, and Methodology 42

Appendix II: Summary of China's Efforts to Prioritize Quantum Information Science Development 50

Appendix III: Summary of National Quantum Computing Cybersecurity Strategy 53

Appendix IV: Comments from the Department of Homeland Security 56

Appendix V: Comments from the Social Security Administration 58

Appendix VI: GAO Contact and Staff Acknowledgments 59

Table 1. Examples of Several Techniques Threat Actors with a Cryptographically Relevant Quantum Computer Could Use to Compromise Systems... 18

Table 2. Examples of Techniques That Threat Actors Could Use Now to Acquire Data to Later Be Decrypted by a Cryptographically Relevant... 19

Table 3. GAO Evaluation Framework of Post-Quantum Cryptography (PQC) Transition Preparatory Practices and Associated Activities 26

Table 4. GAO Evaluation Framework of Post-Quantum Cryptography (PQC) Transition Preparatory Practices and Associated Activities 44

Figure 1. A Simple Illustration of a Public-Key Cryptography Method Used to Protect Data 12

Figure 2. Units for Processing Information Used in Classical Computing Versus Quantum Computing 14

Figure 3. Thirty-Two Quantum Experts' Predicted Timeline for the Development of a Cryptographically Relevant Quantum Computer,... 22

Figure 4. Extent to Which the 24 Chief Financial Officers Act Agencies Addressed Preparatory Practices for Migrating to Quantum Computing 27

Figure 5. Ranked Number of Quantum Computing Patents Filed Prior to June 2023 51

Figure 6. Share of Global Quantum Computing Articles Published between 2011-2020 52

Figure 7. The Three Central Goals of the U.S. National Quantum Computing Cybersecurity Strategy 53

Figure 8. Central Goals Outlined in the Documents That Comprise the U.S. National Quantum Computing Cybersecurity Strategy 54