The Network Is Already Quantum-Safe. The Backups Are Not.
Introduction
Post-quantum cryptography has already arrived at the network layer, largely without anyone noticing. Browsers and TLS libraries now negotiate hybrid key exchange by default, combining classical curve cryptography with the new NIST lattice-based standard. No one in IT had to act for that to happen. Storage tells a different story. Data written to an archive today may need to remain confidential and verifiable for ten, twenty, or thirty years, and the key hierarchies protecting it were built for a world in which RSA was assumed unbreakable indefinitely.
Key Takeaways
- Network-layer post-quantum migration is happening automatically through software updates; storage migration is not, and it is bound by retention periods measured in decades.
- The quantum threat to stored data sits in three places: key-encryption keys, signatures on backup catalogs and archived documents, and replication traffic exposed to "harvest now, decrypt later."
- Envelope encryption allows a fast fix by rewrapping only the key layer, but only if every vendor in the chain (key management, backup software, firmware, drives, HSMs, cloud APIs) supports post-quantum key sizes.
- Migration speed is set by the slowest vendor in that chain, most of whom currently answer post-quantum questions with a slide deck rather than a delivery date.
The EU's coordinated roadmap and Germany's BSI have both set concrete end dates for classical public-key cryptography: 2031 for key agreement, 2030 for high-protection use cases, and 2035 for signatures. Switzerland's FINMA reported in July 2026 that most surveyed financial institutions still lack a clear migration plan, and it now expects a post-quantum roadmap by mid-2027, built on an inventory that explicitly covers encryption of data at rest. Set retention obligations next to that timeline and the arithmetic gets uncomfortable: a record written into an archive this quarter needs to outlive the classical algorithm protecting it today by roughly a decade.
The real exposure does not sit in the encrypted payload. AES-256 loses some strength to Grover's algorithm but keeps an adequate margin. The risk sits in the key-encryption keys originally exchanged via RSA or ECC, in the signatures that give backup catalogs, WORM retention proofs, and archived documents their evidentiary value, and in replication traffic that can be recorded now and decrypted later. Clean envelope encryption offers a shortcut: only the key layer needs rewrapping with a hybrid scheme, a few kilobytes instead of rewriting a half-exabyte archive. That shortcut only works if the key management server, appliance, and drive firmware across the chain can all handle the larger post-quantum key sizes. Where envelope encryption is absent, migration means reading back and rewriting the entire archive, a process that can take months for a mid-sized dataset.
Four practical levers do most of the work: rewrap key hierarchies with hybrid algorithms wherever envelope encryption allows it, since it is the cheapest move; renew the evidentiary layer with archive timestamps and hash-based long-term signatures; tie any unavoidable full re-encryption to a media refresh that is happening anyway; and delete data that has outlived its retention requirement, since anything held past that point is pure quantum risk with no offsetting value.
👉 Read the full article on Computer Weekly:
https://www.computerweekly.com/de/meinung/Das-Netzwerk-ist-quantensicher-die-Backups-aber-noch-nicht
Published on: computerweekly.com
Author: Antonio Paolo Mecci
Conclusion
The network solved its part of the post-quantum problem through routine patching. Storage will not solve itself the same way, because the constraint is coordination across key management vendors, appliance makers, drive firmware, and cloud APIs, each moving at its own pace. Organizations that put hybrid-scheme commitments and delivery dates into vendor contracts now will be the ones testing successful restores when the first rewrapped keys arrive, rather than discovering the gap during an actual recovery.
