Research Summary: A Global Readiness and Sovereignty Capability Model for Post-Quantum Cryptography Migration

The migration to Post-Quantum Cryptography (PQC) presents a critical opportunity to re-evaluate and reshape cryptographic dependence. A new national measurement model, the Readiness-Sovereignty Capability Model (RSCM), has been introduced to operationalize PQC readiness alongside cryptographic sovereignty, which existing models do not fully address. The RSCM disaggregates sovereignty into indigenous cryptographic capacity, indigenous post-quantum control, and external dependency, enabling a more comprehensive assessment than current readiness-focused approaches.

Why it matters

The transition to Post-Quantum Cryptography is not merely a technical upgrade but a strategic inflection point that will determine national and institutional control over foundational digital infrastructure for the foreseeable future. The choices made during this migration have long-term implications for dependence on external entities versus the cultivation of indigenous capabilities, directly impacting national security and economic resilience.

Key insights

• Cryptographic dependence is a pre-existing condition, but the PQC migration provides a unique window to reshape it.
• Decisions regarding PQC algorithms, implementations, hardware, and standards made now will determine dependence or sovereignty for decades.
• The Readiness-Sovereignty Capability Model (RSCM) is a national measurement model for PQC readiness and cryptographic sovereignty.
• Current maturity models primarily assess PQC readiness but do not adequately measure sovereignty.
• The RSCM defines sovereignty through three distinct constructs: indigenous cryptographic capacity, indigenous post-quantum control, and external dependency.
• The model aims to certify a 'post-quantum maker' based on these sovereignty criteria.

Source

arXiv — Computers and Society — https://arxiv.org/abs/2609.18477