EU Coordinated Roadmap for the Transition to Post-Quantum Cryptography

Description

Maps a project’s cryptographic inventory to the EU coordinated post-quantum transition roadmap: governance and inventory from 2026, high-risk use cases migrated by 2030, all systems by 2035, with hybrid classical+PQC constructions encouraged during the transition.

Rationale

The EU coordinated roadmap sets a common transition timeline across member states. Expressing a project’s Shor-broken inventory against the 2030/2035 milestones produces audit evidence aligned with the EU’s hybrid-friendly posture.

Benefits

Organisations operating in the EU get migration evidence aligned to the coordinated roadmap milestones, supporting planning and supervisory reporting.

Checkpoints

EU PQC Roadmap — Cryptographic Inventory Established

ID

eu_pqc_roadmap/crypto_inventory_established

Severity

high

Category

cryptography/post_quantum

Optional

false

Tags

crypto, eu-pqc, inventory, pqc

Description

Checks that a cryptographic inventory (a CBOM) has been established for the project, the EU roadmap’s 2026 governance-and-inventory milestone.

Rationale

The EU roadmap’s first milestone is governance and a cryptographic inventory by 2026; subsequent migration of high-risk (2030) and all (2035) systems depends on it.

Verification

Xygeni passes the checkpoint when a non-empty cryptographic inventory is available — ingested from a CBOM supplied with --cbom or produced on demand by the crypto-asset detector — and fails when none was produced.

Remediation

Generate and maintain a cryptographic bill of materials for the project, satisfying the EU 2026 inventory milestone and enabling assessment against the 2030/2035 deadlines.

EU PQC Roadmap — No Quantum-Vulnerable Cryptography

ID

eu_pqc_roadmap/no_quantum_vulnerable_crypto

Severity

high

Category

cryptography/post_quantum

Optional

false

Tags

crypto, eu-pqc, pqc, quantum

Description

Checks the project’s cryptographic inventory for quantum-vulnerable (Shor-broken) public-key cryptography and evaluates it against the EU PQC roadmap milestones: high-risk use cases migrated by 2030, all systems by 2035.

Rationale

The EU coordinated roadmap expects classical public-key cryptography to be progressively retired, with hybrid constructions encouraged in the interim. Surfacing the inventory against these milestones aligns findings with EU supervisory expectations.

Verification

Xygeni assembles the cryptographic inventory (from a CBOM supplied with --cbom or the crypto-asset detector), classifies quantum risk, and fails the checkpoint when Shor-broken algorithms remain past 2035, reports partial before it, and passes when none remain.

Remediation

Migrate quantum-vulnerable public-key algorithms to the NIST-standardised post-quantum schemes (ML-KEM, ML-DSA, SLH-DSA), prioritising high-risk and long-lived confidential data; hybrid classical+PQC constructions are an acceptable transition step under the EU roadmap.