Skip to content

Solutions · Government

The secret lasts 25 years. The encryption may not.

U.S. classified information can stay classified for up to 25 years. Data recorded in transit today can be read once a large enough quantum computer exists. AgilePQ licenses SLiM to the makers of the field devices that carry it. It has no public-key step for that machine to break.

Talk to AgilePQSee the arithmetic
FIELD RADIOSENSORRELAY202620312036204120462051x = 25 YEARS

01The threat

The adversary does not need to break the encryption today. Only to keep a copy.

CISA, NSA and NIST warn that adversaries can take sensitive data now and decrypt it with a future quantum computer, a threat “particularly devastating to sensitive information with long-term secrecy requirements”.

25years
how long U.S. classified information can stay classified when its sensitivity requires it
5+years
how long state hackers held access inside some U.S. critical-infrastructure networks
Decades
how long, in AgilePQ’s experience, IoT deployments stay in the field
…pre-positioning themselves on IT networks to enable the disruption of OT functions across multiple critical infrastructure sectors.
CISA, NSA and FBI on Volt Typhoon, 2024

The European Commission: “‘Store now, decrypt later’ attacks are already likely occurring.” Nothing fails when a copy is taken, so nobody notices.

A device fielded in 2026 may still be transmitting in 2041 and long after. Everything it sends with today’s public-key cryptography can be kept until it can be read.

02The arithmetic

A 25-year secret outlives the quantum window.

A rule from quantum-risk research: data is at risk when x, how long it must stay secret, plus y, how long migration takes, is greater than z, the time until a quantum computer breaks today’s public-key cryptography.

x + y > zx how long the data must stay secrety how long the migration to new cryptography takesz how long until a quantum computer breaks today’s public-key cryptographyEXPERT ODDS OF A MACHINE THAT FACTORS RSA-2048 IN A DAY · 2025 SURVEY28–49%within 10 years51–70%within 15 yearsSent and recorded in transit, 2026Classified for 10 years2036Up to 25 years, when its sensitivity requires it2051Still classified for 16 years inside the window20262030203520402045205020552026x + y > zx how long the data must stay secrety how long migration takesz until public-key cryptography fallsEXPERT ODDS, 202528–49%within 10 years51–70%within 15 yearsRSA-2048 in a dayRecorded, 202610 yr203625 yr2051Still classifiedfor 16 yearsinside the window20262030203520402045205020552026
Sent in 2026 and recorded on the way. Its classification runs 10 to 25 years.Experts rate a machine that breaks RSA-2048 in a day as likely within 15 years.The 25-year secret is still classified for 16 years inside that window.

Classification periods from Executive Order 13526. Odds from the Global Risk Institute’s 2025 survey of 26 experts, counted from the survey year. The survey odds are the experts’, not a forecast by AgilePQ.

Set x to 25 years. Even if migration took no time at all, x alone runs past the 15 years within which surveyed experts rate such a machine as likely.

For a 25-year secret, the time to change the encryption is before it is sent.

03The mandates

Washington has set the dates. They reach the field too.

Federal high-value systems must move to post-quantum key establishment by the end of 2030. National security systems follow NSA’s CNSA 2.0, which gives constrained devices dates of their own.

  1. 2022

    • MayNational Security Memorandum 10 sets the goal: mitigate as much quantum risk as is feasible by 2035.NSM-10

  2. 2024

    • AugNIST approves its first post-quantum standards, all public-key algorithms.NIST FIPS 203, 204, 205

  3. 2026Today

    • JunExecutive Order 14412 sets post-quantum deadlines for federal systems and contractors.Executive Order 14412

  4. 2027

    • JanNew acquisitions for national security systems must be CNSA 2.0 compliant.NSA CNSA 2.0

  5. 2030

    • DecHigh-value and high-impact federal systems use post-quantum key establishment. Covered contractors to comply with NIST’s FIPS, under a rule the order calls for.Executive Order 14412
    • Constrained devices in national security systems: support and prefer CNSA 2.0.NSA CNSA 2.0

  6. 2031

    • DecFederal high-value and high-impact systems use post-quantum digital signatures.Executive Order 14412

  7. 2033

    • Constrained devices in national security systems use CNSA 2.0 exclusively.NSA CNSA 2.0

  8. 2035

    • NSA expects national security systems to have completed the transition.NSA CNSA 2.0
    • The national goal: as much quantum risk mitigated as is feasible.NSM-10
$7.1billion
to migrate prioritized federal systems to post-quantum cryptography, 2025–2035. Replacing cryptography hardwired into hardware or firmware is “a significant portion”.

These rules name their algorithms. CNSA 2.0 specifies AES with 256-bit keys for symmetric encryption in national security systems. The executive order points federal contractors to NIST’s FIPS. CNSA 2.0 also sets dates for constrained devices: the class of device AgilePQ works on.

SLiM is AgilePQ’s own encryption suite. It is not a NIST FIPS algorithm, and AgilePQ does not represent it as satisfying CNSA 2.0 or Executive Order 14412.

04What AgilePQ does

Encryption for the device at the far end of the link.

SLiM is AgilePQ’s encryption suite for the smallest devices: RFC 7228 Class 0 through Class 2. Device makers build it in and key each device on the production line; a key server issues session keys, so there is no public-key exchange for a quantum computer to break.

No public-key step

No key exchange to break later

SLiM uses no RSA or elliptic-curve key exchange, the public-key cryptography a large enough quantum computer is expected to break.

Sized for the field

Fits a device too small for TLS

AgilePQ measured about 1,500 bytes of RAM for the full protocol on a 16 MHz Arm Cortex-M0, in a device class that “cannot easily” run TLS.

What the agencies say

Symmetric cryptography, in general

NIST does not expect to transition away from symmetric standards such as AES in the post-quantum migration. NSA says symmetric algorithms are secure when the key is large enough.

Both are statements about symmetric cryptography in general, not endorsements of SLiM.

DISA Phase II finalist

In 2019 AgilePQ was a finalist in the Defense Information Systems Agency’s Phase II evaluation of cryptography prototypes.

Two U.S. patents

US 11,018,854 and US 11,924,329, assigned to Agile⁠PQ.

Runs where the radios are

AgilePQ has run SLiM over BLE, Wi-Fi, LoRaWAN, NB-IoT, LTE-M, 2G–4G and satellite links.

05Next step

Building devices for government? Bring AgilePQ the device.

Makers and integrators: describe the device, the link and how long the data must stay secret. AgilePQ will tell you whether SLiM fits, and where the rules above leave it.

Talk to AgilePQSchedule a demo

The other markets

01Device manufacturersBuild SLiM in once. Every device you ship carries it, into every market you sell to.03Network operatorsA fraction of a TLS handshake on links where every byte costs airtime.04Utilities and critical infrastructureMeters, pumps and sensors that outlive the cryptography they shipped with.

All four markets · How SLiM works

06Sources

Sources and notes24 sources · 9 from AgilePQ’s own records
  1. 1U.S. classified information is marked for declassification after 10 years, or up to 25 years when its sensitivity requires it.Executive Order 13526, section 1.5(b).Sourced
  2. 2CISA, NSA and NIST: “cyber actors could target our nation’s most sensitive information now and leverage future quantum computing technology”, a threat “particularly devastating to sensitive information with long-term secrecy requirements”.NSA press release on the joint Quantum-Readiness fact sheet (21 August 2023).Sourced
  3. 3AgilePQ licenses SLiM to device manufacturers, who build it into their products and take it into the markets they sell to.AgilePQ management (October 2026).AgilePQ record
  4. 4SLiM is symmetric end to end. A key server gives each device its own keys and issues session keys; the encryption changes with every packet. SLiM uses no RSA or elliptic-curve key exchange.AgilePQ, SLiM Overview v2.4 (April 2021) and SLiM Technical Overview v2.4.9 (January 2024).AgilePQ record
  5. 5CISA, NSA and FBI: Volt Typhoon is “pre-positioning themselves on IT networks to enable the disruption of OT functions across multiple critical infrastructure sectors”, with access maintained in some environments “for at least five years”, using “end-of-life SOHO routers”.CISA advisory AA24-038A (7 February 2024).Sourced
  6. 6AgilePQ’s 2020 white paper says IoT deployments may remain in the field for over 15 years; AgilePQ now describes that service life as decades.AgilePQ, SLiM Security for Cellular, Satellite, and Constrained Networks (2020), page 3.AgilePQ record
  7. 7European Commission: “‘Store now, decrypt later’ attacks are already likely occurring.”European Commission, Post-Quantum Cryptography policy page (June 2025).Sourced
  8. 8Data is at risk when x + y > z: x is how long it must stay secret, y is how long migration takes, z is how long until a quantum computer breaks today’s public-key cryptography.M. Mosca, “Cybersecurity in an era with quantum computers: will we be ready?”, IACR ePrint 2015/1075, section 1.Sourced
  9. 9Global Risk Institute survey of 26 experts: a quantum computer able to factor RSA-2048 in under 24 hours is “quite possible (28-49%) within the next 10 years” and “likely (51-70%) in the next 15”.Global Risk Institute, Quantum Threat Timeline Report (2025 survey, published March 2026).Sourced
  10. 10Executive Order 14412 directs agencies to “transition all HVAs and high impact systems to use PQC for key establishment by December 31, 2030” and for digital signatures by 31 December 2031, and calls for a rule requiring covered contractors “to comply by December 31, 2030, with NIST’s FIPS, including all applicable FIPS incorporating PQC compliant algorithms.”Executive Order 14412, Securing the Nation Against Advanced Cryptographic Attacks (22 June 2026; Federal Register 2026-12909).Sourced
  11. 11NSA CNSA 2.0: “Niche equipment (e.g., constrained devices, large public-key infrastructure systems): support and prefer CNSA 2.0 by 2030, and exclusively use CNSA 2.0 by 2033.” “NSA expects the transition to QR algorithms for NSS to be complete by 2035.”NSA, Announcing the Commercial National Security Algorithm Suite 2.0 (September 2022).Sourced
  12. 12The White House: the cost of migrating prioritized federal information systems to post-quantum cryptography “between 2025 and 2035 will be approximately $7.1 billion in 2024 dollars”; replacing systems with cryptography hardwired into hardware or firmware is “a significant portion of the overall estimate”.Report on Post-Quantum Cryptography (July 2024); excludes national security systems.Sourced
  13. 13NSA: “by January 1, 2027, all new acquisitions for NSS will be required to be CNSA 2.0 compliant unless otherwise noted”; symmetric encryption is AES with “256-bit keys for all classification levels”.NSA, CNSA 2.0 FAQ v2.1 (December 2024).Sourced
  14. 14AgilePQ designed SLiM’s cipher for RFC 7228 Class 0 through Class 2 devices.AgilePQ cipher design paper (internal draft, 2021), section 2.1.AgilePQ record
  15. 15AgilePQ: “The most common way is to have the device manufacturer provision the device.” Devices are “programmed directly by the manufacturer with a unique device voucher”, which “can be replaced in the field at any time in the future if a device’s keys become compromised.” Devices can also be provisioned in the field by a provisioning server on first power-up.AgilePQ, Cryptography Review (October 2018).AgilePQ record
  16. 16AgilePQ measured about 800 bytes of RAM for the standalone SLiM library and about 1,500 bytes for the full protocol, on a 16 MHz Arm Cortex-M0 compiled at -O3.AgilePQ engineering benchmarks (July 2021).AgilePQ record
  17. 17RFC 7228: Class 1 devices “cannot easily talk to other Internet nodes employing a full protocol stack such as using HTTP, Transport Layer Security (TLS), and related security protocols”.IETF RFC 7228, section 3.Sourced
  18. 18NIST on AES and other symmetric standards: “NIST does not expect to need to transition away from these standards as part of the PQC migration.”NIST IR 8547 ipd (12 November 2024).Sourced
  19. 19NSA: “symmetric algorithms are considered secure, provided the key size is sufficiently large”, a statement about the class of algorithms, not any particular cipher.NSA, CNSA 2.0 FAQ v2.1 (December 2024).Sourced
  20. 20AgilePQ was a finalist in the US Defense Information Systems Agency’s Phase II evaluation of quantum-resistant cryptography prototypes (2019).AgilePQ records (DISA Phase II oral presentation, 12 September 2019).AgilePQ record
  21. 21US patents 11,018,854 (Data conversion systems and methods, granted 25 May 2021) and 11,924,329 (Encryption of standalone data packages, granted 5 March 2024) are assigned to AgilePQ.Google Patents assignment records (accessed 14 October 2026).AgilePQ record
  22. 22AgilePQ has run SLiM as a C library on microcontrollers and modules including Silicon Labs EFR32/EFM32, TI MSP430, CC1310, CC2640 and CC3220, Nordic, Espressif ESP32, Dialog DA14585, Raspberry Pi and Cisco 809/819, over BLE, Wi-Fi, LoRaWAN, Sigfox, NB-IoT, LTE-M, 2G–4G and satellite links.AgilePQ test platform list (2021).AgilePQ record
  23. 23National Security Memorandum 10 sets the goal “of mitigating as much of the quantum risk as is feasible by 2035”.NSM-10 (4 May 2022), via govinfo.Sourced
  24. 24NIST approved its first three post-quantum standards in August 2024: FIPS 203 (ML-KEM, key establishment), FIPS 204 (ML-DSA, signatures) and FIPS 205 (SLH-DSA, hash-based signatures). They are public-key algorithms.Federal Register 2024-17956 (effective 14 August 2024).Sourced