In critical infrastructure such as electricity, water, transportation, and manufacturing equipment, computer-based information processing is linked to physical operations through the monitoring and control of equipment.

In such environments, equipment is used for long periods, the time available for shutdowns is limited, and older devices and communication methods tend to remain. As a result, security measures cannot always be updated in the same way or at the same pace as in general information systems. This difference is also a major challenge in migrating cryptographic methods in preparation for the development of quantum computers.

CPS, OT, and ICS Supporting Critical Infrastructure

In critical infrastructure, systems that handle information are combined with systems that measure and control the state of equipment. To understand this structure, the terms critical infrastructure (CI), cyber-physical systems (CPS), operational technology (OT), and industrial control systems (ICS) are used.

Table 1 Terms related to critical infrastructure and control systems

Term	Meaning in this article
Critical infrastructure (CI)	Foundations related to the continuity of society and the economy, such as electricity, water, transportation, and industrial facilities
Cyber-physical systems (CPS)	Systems that combine computation, communication, sensors, and the physical equipment or processes being controlled
Operational technology (OT)	Technology for monitoring the state of equipment and processes and controlling physical operations
Industrial control systems (ICS)	Systems used to monitor and control industrial processes in factories, infrastructure facilities, and so on

These do not necessarily exist separately. Within critical infrastructure, OT and ICS control equipment, and they may form a CPS when connected to communication networks and information systems.

Why Security in Critical Infrastructure Is Difficult

The devices that make up critical infrastructure may be used over long periods. It is not always possible to replace part of a facility in a short time, and older communication methods and devices designed on assumptions different from today’s tend to remain.

In addition, the times when equipment can be stopped for update work are limited. Even when software can be updated, control latency and safety must be confirmed, so updates cannot proceed in the same way as in information systems.

Furthermore, when devices have limited processing power or memory, there is little room to add new cryptographic processing or monitoring functions. If a cryptographic method is fixed into a device, it cannot be addressed by changing settings or software alone, and the device may need to be replaced.

The Link Between Cyberspace and Physical Processes

CPS and OT link information processing with physical equipment and are responsible for the automation, monitoring, and control of physical processes.

Critical infrastructure is not self-contained within a single device. Sensors, controllers, communication networks, monitoring systems, and so on are interconnected. While this connectivity improves operational efficiency, it also widens the scope of what must be protected.

Countermeasures must therefore consider not only the security of individual devices but also the dependencies between devices, how systems behave when communication is lost, and how to recover when failures occur.

How Quantum Computers Affect Cryptography

The problem raised by the development of quantum computers is that some of the public-key cryptography in use today may be broken by future quantum computers with sufficient capability.

Public-key cryptography is used for sharing keys with communication partners, digital signatures, verifying software and firmware updates, and more. Identifying which systems use public-key cryptography that is vulnerable to quantum computation, such as RSA and elliptic curve cryptography, is the starting point for migration.

However, this does not mean that all cryptography currently used in critical infrastructure will be broken immediately by quantum computers. The question is whether equipment used for long periods and information that must remain secret for long periods can be migrated in a planned way in time for future threats.

Harvest Now, Decrypt Later

The idea of acquiring and storing encrypted information now, on the assumption that quantum computers will be able to break the encryption in the future, and decrypting it later is called Harvest Now, Decrypt Later (HNDL).

Under this threat, information can become a target even if its content cannot be read right away, as long as it needs to remain secret into the future. It is necessary to consider both the period for which information must be protected and the time required to migrate to quantum-resistant cryptography.

In critical infrastructure, the equipment itself is also used for long periods. Because devices introduced today may still be in operation in the future, not only communication and authentication but also the cryptographic methods used for purposes such as verifying signatures on software updates must be migrated.

Post-Quantum Cryptography

Post-quantum cryptography (PQC) refers to cryptographic methods designed to withstand attacks by future quantum computers, which are being introduced into current products and communication systems.

NIST has approved three post-quantum cryptography standards used for key establishment and digital signatures.

Table 2 Post-quantum cryptography standards approved by NIST

Standard	Name	Main use
FIPS 203	Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM)	Key encapsulation for establishing a shared secret key over a public channel
FIPS 204	Module-Lattice-Based Digital Signature Standard (ML-DSA)	Digital signatures used to detect data modification and authenticate the signatory
FIPS 205	Stateless Hash-Based Digital Signature Standard (SLH-DSA)	Digital signatures based on hash functions

The availability of standards is not the same as the completion of migration for existing equipment. It is necessary to confirm which products and communication methods can support them and to introduce them while assessing the impact on existing systems.

Replacing Cryptography Is Difficult in OT

Post-quantum cryptography imposes a computational burden compared with existing methods. Even methods that can be used in general information systems may not be usable in the same way on OT devices, which have limited processing power and communication bandwidth and require strict response times.

In addition, critical infrastructure must maintain equipment availability and control stability even after cryptographic methods are changed. If introducing a new cryptographic method delays communication or control, operational problems separate from cryptographic security may arise.

If the cryptographic methods used for device authentication or updates are fixed in hardware, migration requires replacing the devices. Migration plans must take into account long equipment lifetimes, maintenance timing, conformity checks, and the readiness of suppliers.

Crypto-Agility

The ability to replace the cryptographic methods or keys in use without rebuilding the entire system when a change in cryptographic technology becomes necessary is called crypto-agility.

With crypto-agility in place, when a vulnerability in a cryptographic method comes to light or a change in standards becomes necessary, it is easier to identify the affected areas and replace them.

On the other hand, in configurations where cryptographic methods are fixed into devices or communication procedures and it is not known where they are used, even identifying the scope of migration is difficult. Preparing for the quantum era requires not only introducing new cryptography but also building configurations in which cryptographic methods can be changed in the future.

Quantum-Readiness Roadmap

Migration to post-quantum cryptography is not a task of replacing all devices at once. It is necessary to identify the cryptography currently in use, decide the order of migration according to the importance of information and functions, and coordinate timelines with product and service providers.

Table 3 Basic flow of a quantum-readiness roadmap

Stage	What to check
Establishing governance	Define a migration team that includes stakeholders from IT, OT, security, privacy, procurement, and so on
Cryptographic inventory	Identify the cryptography used in communication protocols, servers, end-user devices, applications, libraries, and software and firmware updates
Prioritization	Assess how long information must be kept secret, the importance of equipment and functions, and dependence on cryptography vulnerable to quantum computation
Confirmation with providers	Ask providers of products, cloud services, maintenance parts, and so on how and when they will support PQC
Migration and verification	Choose methods such as updates, configuration changes, or product replacement, and check compatibility, performance, and operational impact

A cryptographic inventory covers not only externally visible communications but also cryptography used inside products. However, cryptography inside embedded products may not be identifiable through the user’s own investigation alone. It is therefore also necessary to obtain information from suppliers and manufacturers.

Remaining Gaps Between Research and Implementation

Research on CPS and OT security in the quantum era faces the challenge that terminology and classifications are not standardized, making it difficult to compare different research results on the same basis.

In addition, research that incorporates post-quantum cryptography into OT and ICS communication protocols is limited. Data obtained from actual equipment is also scarce, and many studies remain in simulations or test environments.

Quantum threat modeling, a method for evaluating threats posed by quantum computers, is also not yet sufficiently developed. The challenge lies not only in choosing standards but also in verifying whether existing equipment can be migrated.

Summary

In critical infrastructure, information systems and physical equipment are linked through CPS, OT, and ICS. Long equipment lifetimes, limited opportunities for updates, legacy devices, strict response times, and other factors impose constraints on changing security measures and cryptographic methods that differ from those of general information systems.

Future quantum computers may affect some of the public-key cryptography in use today. In particular, for information that must remain secret for long periods, the HNDL concept—decrypting in the future encrypted data acquired today—is also relevant.

Migration to post-quantum cryptography requires taking an inventory of cryptographic assets, setting priorities based on importance and protection periods, and confirming providers’ plans. Beyond replacing existing methods with new ones, it is important to secure crypto-agility so that cryptographic methods can be changed in the future as well.

About This Article

References

• Siler Amador, César Pardo, Raúl Mazo, “Cybersecurity of Cyber-Physical Systems in the Quantum Era: A Systematic Literature Review-Based Approach”

Sources

• Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), National Institute of Standards and Technology (NIST), “Quantum-Readiness: Migration to Post-Quantum Cryptography”
• National Institute of Standards and Technology (NIST), “Announcing Approval of Three Federal Information Processing Standards (FIPS) for Post-Quantum Cryptography”
• National Institute of Standards and Technology (NIST), “FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard”
• National Institute of Standards and Technology (NIST), “FIPS 204, Module-Lattice-Based Digital Signature Standard”
• National Institute of Standards and Technology (NIST), “FIPS 205, Stateless Hash-Based Digital Signature Standard”

(Last accessed: October 17, 2026)


*This article was compiled based on the author’s understanding, with reference to the literature listed above.