"Q-Day" is the day a quantum computer can break today's public key cryptography. No credible source gives a date for it. What does exist is a set of government migration deadlines, and one of them falls on 1 January 2027, which is partly why 2027 comes up so often.
What the sources say
- NIST announced FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) on 13 August 2024. Project lead Dustin Moody said: "There is no need to wait for future standards."
- NIST IR 8547, in its initial public draft of November 2024, lists RSA and ECDSA at 112 bits as deprecated after 2030, and the quantum vulnerable algorithms at 128 bits or more as disallowed after 2035. We read the draft, so check NIST for the current status.
- The draft says "there are no existing cryptographically relevant quantum computers that currently threaten levels of security," but that past migrations took over a decade and this one will likely take at least that long.
- NSM-10 sets 2035 as the primary target, as cited in the NIST draft.
- NSA's CNSA 2.0 FAQ, as summarised in search results, says that by 1 January 2027 new acquisitions for national security systems must be CNSA 2.0 compliant unless noted, and that equipment that cannot support it must be addressed by 31 December 2030. We could not open the NSA PDF directly, so verify the wording there.
This applies to US national security systems. It is not a rule for private companies, but vendors who sell to them will follow it.
What is affected
Anything using RSA, ECDSA, EdDSA, Diffie Hellman or elliptic curve key exchange: TLS, VPNs, code signing, certificates, SSH, and data encrypted today that must stay secret for years ("harvest now, decrypt later").
How to check if you're exposed
Search your code and configs for algorithm names:
grep -rniE "rsa|ecdsa|ed25519|secp256|x25519|dh_" --include=*.{go,py,java,js,ts,yaml,conf} .
Also list certificate authorities, signing keys, and libraries that bundle crypto.
What to do now
- Build a cryptographic inventory: algorithm, key size, where used, data lifetime.
- Mark data that must stay confidential for ten years or more.
- Ask vendors for their post quantum roadmap.
- Prefer libraries that already support ML-KEM and ML-DSA when you next upgrade.
- Test hybrid modes in a non production environment first.
Why it matters
Mosca's reasoning, quoted in the NIST draft, is simple: if the years your data must stay secret plus the years migration takes exceed the years until a capable quantum computer exists, you are late. Nobody knows the last term, so inventory is the cheap move.
Try it yourself
Generate an SBOM and see which crypto libraries ship in your dependencies.
Click through it at your own pace, or open it full screen.
Quick check
Is there an official date for Q-Day?
No. NIST says no cryptographically relevant quantum computer exists today and sets migration targets instead.
What is harvest now, decrypt later?
Adversaries collect encrypted data now to decrypt it once quantum technology matures, which matters for data with long term sensitivity.
