Post-quantum cryptography, in plain language.
What Curaçao's businesses and government need to know about quantum computing and the locks that protect our data, and what to do about it now.
Why this matters now
The algorithms that protect data today, such as RSA and elliptic-curve cryptography (ECC), can be broken by a sufficiently capable quantum computer. No such computer exists yet. Two facts still make the move urgent.
Harvest now, decrypt later
Encrypted data can be intercepted and stored today, then decrypted once a capable quantum computer exists. Any data that must stay confidential for years is already exposed.
Migration takes years
Changing an organization's cryptography touches vendors, protocols, hardware and staff training. Waiting for quantum computers to arrive before starting is not a workable plan.
Where the standards stand
In August 2024 the US National Institute of Standards and Technology (NIST) finalized its first three post-quantum cryptography standards. In 2025 NIST selected a further algorithm, HQC, as a backup for key exchange.
FIPS 203ML-KEMKey exchange
FIPS 204ML-DSADigital signatures
FIPS 205SLH-DSASignatures on a different mathematical basis
Reference points from elsewhere:
- United States. The NSA's CNSA 2.0 guidance sets phased requirements for national security systems, with broad adoption expected through the early 2030s.
- European Union and the Netherlands. EU member states, including the Netherlands through NCSC-NL, have published coordinated roadmaps for public sector and critical infrastructure migration.
- Vendors. Browsers, cloud platforms and HSM providers have begun shipping post-quantum options, so the building blocks exist ahead of most organizations' readiness to use them.
Why this is a Curaçao issue
Curaçao's financial sector, supervised by the Centrale Bank van Curaçao en Sint Maarten (CBCS), depends heavily on correspondent banks in the United States and the Netherlands. As those banks move to post-quantum standards on their own timelines, local banks and trust companies will need compatible infrastructure to keep those relationships.
The same applies to payment processors, e-commerce and e-gaming platforms that rely on international card networks and cloud infrastructure.
Curaçao's constitutional ties with the Netherlands also make Dutch national guidance from NCSC-NL and AIVD a directly relevant and freely available resource.
What organizations can do now
- Build a cryptographic inventoryKnow which systems, vendors and data flows rely on which algorithms.
- Ask your vendorsRequest each vendor's and cloud provider's post-quantum roadmap and timeline.
- Start with long-lived dataPrioritize systems that hold sensitive data for many years, where harvest-now-decrypt-later risk is highest.
- Favor crypto-agilityChoose systems that can swap algorithms without a full rebuild.
- Assign ownershipGive someone clear responsibility for the migration question, even if today that means tracking vendor timelines.
Coming soon. The foundation is preparing a readiness self-assessment checklist and a curated list of free, vendor-neutral resources from NIST, ETSI and NCSC-NL.
Questions people ask
Can a quantum computer read my data today?
No. No quantum computer today can break the cryptography in everyday use. The concern is data recorded now and decrypted later, and the years it takes to move to new algorithms.
When will a capable quantum computer exist?
Nobody knows. That uncertainty is why governments and vendors are planning the migration now, rather than waiting for a date.
Does this replace encryption?
No. Post-quantum cryptography is new encryption and signature algorithms that run on today's computers and are designed to resist quantum attacks.
Do I need to be a cryptography expert?
No. The first steps are organizational: know what you use, ask your vendors, and give someone ownership. The foundation's public events need no technical background.
Where do I start in my organization?
With a cryptographic inventory. The Quantum Safe Training during Quantum Week walks through a first Cryptographic Baseline Assessment.
Resources
- NIST Post-Quantum CryptographyThe US standards project behind FIPS 203, 204 and 205.csrc.nist.gov
- NCSC-NLDutch National Cyber Security Centre guidance.ncsc.nl
- ETSIEuropean standards work on quantum-safe cryptography.etsi.org
- DownloadsFoundation publications and slides. [PLACEHOLDER]