The order that gave federal encryption a deadline
On January 15, 1977, the National Bureau of Standards published FIPS 46, the Data Encryption Standard, and gave federal encryption a single algorithm by mandate. The decision was designed for twenty years of computers. The computers lasted; the cipher strained. In January 1999, the Electronic Frontier Foundation’s Deep Crack — 1,856 custom chips built for less than $250,000 — broke a DES-encrypted message in twenty-two hours and fifteen minutes. On June 22, 2026, the White House wrote the next mandate.
Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks,” arrived in a different register than FIPS 46. The 1977 document specified an algorithm; this one carefully avoids naming any. It references NIST’s FIPS categories — 203, 204, 205, and successors — without binding itself to specific ciphers. When IBM and the NSA settled on 56-bit DES keys in the early 1970s, they locked a legal instrument to a technical parameter that aged badly. This order is built with what the post-quantum community calls cryptographic agility: if NIST expands its suite, the mandate follows automatically, no amendment required.
The operational spine of the order is a two-row table. Federal agencies managing High Value Assets and high-impact systems must migrate to quantum-resistant algorithms for key establishment by December 31, 2030, and for digital signatures by December 31, 2031. National Security Systems — already governed by the NSA’s CNSA 2.0 framework, announced in September 2022, with its own staggered deadlines running to 2033 — are excluded. Civilian agencies must name a PQC migration lead within thirty days of signing, file migration plans with OMB within 120 days, and wait for FAR rulemaking to extend the 2030 requirement to federal contractors. For a presidential order, the to-do list is unusually specific about who tells whom what, and by when.
The urgency behind the specificity has a name: harvest now, decrypt later. The tactic requires no quantum computer — only storage. An adversary intercepts encrypted government traffic today, archives it faithfully, and waits for the day decryption becomes possible. American intelligence agencies have tracked this pattern for years; foreign signals services are known to systematically archive encrypted diplomatic and military traffic they cannot currently read. The order, published in the Federal Register on June 25, 2026 (91 FR 38483), is the federal government’s public acknowledgement that those archives exist and that the window to obsolete their contents is finite.
None of this arrived in isolation. The NSA published CNSA 2.0 in September 2022; OMB Memorandum M-23-02 directed agencies to inventory cryptographic assets in 2022; the Quantum Computing Cybersecurity Preparedness Act required annual progress reports. None of it carried binding deadlines. EO 14412 hardened the ask, and it did so precisely when the EU, France’s ANSSI, Canada, Australia, India, Google, and Cloudflare were converging on overlapping 2028–2031 migration windows. The result is a global migration schedule in all but name.
The DES mandate shaped twenty-five years of internet infrastructure — and proved, when the time came, slow and expensive to retire. This one is working against an archive that has already been growing, somewhere, for years.
Sources
- Executive Order 14412, 91 FR 38483 — govinfo.gov — full text of the order, published June 25, 2026; deadline table and agency requirements.
- EO 14412: Hard 2030 and 2031 Federal PQC Deadlines — postquantum.com — detailed breakdown of timelines, CNSA 2.0 relationship, and cryptographic agility.
- The White House’s post-quantum executive order — Cloudflare blog — global alignment context; EU, ANSSI, and cloud-provider migration windows.
- EFF DES Cracker — Wikipedia — Deep Crack specifications, the 22-hour DES crack in 1999, and the $250,000 build cost.