On June 17, the French cybersecurity agency (ANSSI) announced that, starting in 2027, it will stop certifying security products that lack post-quantum encryption capabilities, and it urged businesses to purchase only quantum-safe products by 2030. Because ANSSI certification is a mandatory requirement for French government bodies and critical infrastructure operators, this effectively sets a retirement deadline for legacy encryption systems.
ANSSI Director Souissi’s remarks at the French quantum conference: governance, industry planning and sovereignty
ANSSI Director Samih Souissi said at the French quantum conference that this policy change involves not only the technical dimension: “This is not just a technical issue. It is about governance, industry planning, regulation, and sovereignty.”
Souissi noted that the 2027 certification stop deadline and the 2030 procurement recommendation are intended to give the industry enough time to prepare for the transition, while also mitigating the systemic threat posed by quantum computing to current encryption-protected systems.
Threat assessment by IBM’s Jerry Chow and Qperfect
At the French quantum conference, IBM executive Jerry Chow said that the threat of quantum computing to existing cryptographic technologies may emerge in the mid-2030s, aligning with ANSSI’s 2027–2030 policy timetable framework.
Qperfect warned that the elliptic-curve digital signature algorithm (ECDSA) — widely used in blockchains — may be one of the earliest systems to be broken by quantum computers.
Industry responses from OVHcloud and Capgemini
Capgemini’s Chief Innovation Officer Pascal Brill told Reuters that as banks and public-sector departments assess what must change, demand is growing: “This market is getting very big, and the scale will be extremely large.”
OVHcloud’s head of quantum business, Fanny Bouton, added that companies face a dual compliance burden—both to meet ANSSI’s certification requirements and to simultaneously satisfy the relevant standards of the European Commission and the U.S. NIST (National Institute of Standards and Technology): “As a French and European company, we face greater constraints.”
Frequently Asked Questions
What is the mandatory significance of ANSSI certification for French institutions?
According to Reuters, when encryption technologies are used in French government agencies and critical infrastructure, ANSSI certification is required. Therefore, ANSSI’s decision to end certification by 2027 effectively sets a hard deadline for French government entities and critical infrastructure operators to switch to quantum-safe products, rather than merely providing advisory guidance.
What threat does a “harvest now, decrypt later” attack pose?
According to reports, “harvest now, decrypt later” refers to attackers collecting and storing encrypted data now, then cracking today’s encryption protections once quantum computers become sufficiently powerful. IBM’s Jerry Chow said this threat may become real in the mid-2030s, and it is one of the main drivers behind ANSSI’s decision to set the 2027 certification cutoff in advance.
What does ECDSA and the quantum-safety issue mean for cryptocurrency?
According to Qperfect’s warning at the French quantum conference, ECDSA may be one of the earliest cryptographic standards to be broken by quantum computers, and it is the digital signature standard widely adopted in mainstream blockchains such as Bitcoin and Ethereum. AI systems such as Anthropic’s Claude Mythos have also mentioned this in related research. ANSSI’s policy adjustment in France and the global trend toward quantum-safe migration directly affect the blockchain industry’s long-term security architecture.
