🌐 Quantum Weekly - The Global Signals That Actually Mattered (26 October - 1 November 2026)
The week of 26 October to 1 November was about standards and the threat model that sits behind them. NIST published the final version of its transition report, which states that NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow it under NIST standards and guidelines after 2035. Two days later Alice & Bob announced a preprint, posted on 28 October, estimating that fewer than 23,000 physical cat qubits could factor RSA-2048 in about three days, a figure that rests on stated hardware assumptions. Capital and sovereign alignment moved alongside: Intel agreed to acquire the quantum software company Classiq, the United States and Finland signed a non-binding technology memorandum that lists advocating the adoption of post-quantum cryptography (PQC) standards as an area of cooperation, and Canada joined the EuroHPC Joint Undertaking with access to its quantum computing resources. On the supply side, IDEMIA Secure Transactions put NIST and Korean PQC algorithms on a SIM for a South Korean defence pilot, and SEALSQ's post-quantum secure element passed the technical phase of a Common Criteria evaluation, with the certificate still to be issued. Confirmed signals came from the United States, Israel, South Korea, Switzerland, France, Finland, Canada and the European Union. None of the seven is evidence that a cryptographically relevant quantum computer exists today.
📌 SITG-Consulting - Own Announcements (outside the signal count)
On 28 October 2026 I published "NIST IR 8547: What Changed Between the Draft and the Final Report", a comparison briefing on the November 2024 draft and the final report, and sent the PDF briefing directly to contacts the same day. On the same date I published "HQC: Why NIST's Backup KEM Belongs in Your Crypto-Agility Plan Now", and on 29 October "Cryptographic Discovery Sprint: The First Defensible Step in PQC Migration". My "PQC Governance Digest: Cut-off 30 October 2026" followed on 31 October. These are publications, not agreements; no partnership or signing falls in this window.
🇺🇸 🇮🇱 United States and Israel - Intel Signs a Definitive Agreement to Acquire Classiq, a Quantum Software Company
Capital Markets / Consolidation / Quantum Software
The Detail: On 26 October 2026 Intel, in a release datelined Santa Clara and Tel Aviv, announced that it had entered into a definitive agreement to acquire Classiq, which it describes as "a leading provider of quantum computing software".
Intel's chief executive, Lip-Bu Tan, states that the combination "transforms Intel's Quantum Computing Group into a full-stack quantum computing business."
The release states that closing is expected in the first half of 2027 and is subject to regulatory approvals and other customary closing conditions. "Until closing, Intel and Classiq will continue to operate as separate, independent companies."
The release discloses no price. Figures in press coverage are not Intel's and are not used here.
Why it matters: A chip manufacturer is buying the software layer that sits between applications and quantum hardware. In my assessment, that points toward consolidation into integrated stacks. For buyers, that changes the dependency picture: a software tool that ran across several hardware platforms may in future sit inside one hardware vendor's portfolio. Intel states it intends to continue supporting Classiq's existing multi-platform integrations; organisations running quantum pilots on Classiq should record that statement in their supplier file and review contract terms on portability before closing. The deal has no direct bearing on cryptographic risk.
🇰🇷 South Korea - IDEMIA Secure Transactions Puts NIST and Korean PQC Algorithms on a SIM for KT's Defence Pilot
Sovereign Deployment / Defence Communications / National Algorithms
The Detail: On 26 October 2026 IDEMIA Secure Transactions (IST), in a release, announced that it is implementing post-quantum algorithms on its Quantum-Resistant SIM platform for KT's post-quantum pilot in South Korean defence communications.
"The implementation is designed to support both international NIST standardized and Korea-specific PQC algorithms."
"The project is organized by the Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA)."
IST states that, subject to final validation, the project is expected to deliver the first implementation of Korean PQC (KpqC) algorithms on a smart-card platform in Korea. That is IST's claim, and it is conditional.
The release describes KT's wider pilot as covering defence environments for the Ministry of National Defense, including drones, ground control systems, CCTV and 5G networks. KT's own release was not reached; the detail is IST's account.
Why it matters: A national defence pilot is carrying two algorithm families on one device: the NIST standards and Korea's own. Any organisation supplying into Korean government or defence networks should plan for dual-algorithm support rather than assume the NIST set alone will satisfy local requirements. Two families on one secure element mean two sets of validation evidence, two parameter choices and two update paths to govern. It is a pilot, and the "first" claim depends on validation that has not yet concluded.
🇺🇸 United States - NIST Finalises Its Transition Report: Quantum-Vulnerable Public-Key Cryptography Deprecated After 2030, Disallowed After 2035
Standards / Migration Deadlines / Federal Policy
The Detail: On 27 October 2026 NIST published the final version of Interagency Report 8547, "Transition to Post-Quantum Cryptography Standards", on its publication page and in a news release. The publication history lists the draft on 12 November 2024 and the final on 27 October 2026.
Section 4 states that "NIST will deprecate quantum-vulnerable public-key cryptography after 2030" and "disallow its use under NIST standards and guidelines after 2035."
For signatures, the report records that earlier guidelines "had projected that NIST would disallow public-key schemes that provide 112 bits of security on January 1, 2031", and that NIST "will instead deprecate all quantum-vulnerable digital signature algorithms after 2030". The tables list ECDSA, EdDSA and RSA for signatures, and finite field and elliptic curve Diffie-Hellman and MQV and RSA for key establishment.
For key establishment, "NIST recommends using ML-KEM-768 as the default parameter set".
The abstract states that the report supports Executive Order 14412 and OMB Memorandum M-26-15, "which direct federal agencies to prioritize the migration of their most sensitive systems to post-quantum cryptography." The report cites dates of 31 December 2030 for key establishment and 31 December 2031 for digital signatures, which apply to high-value assets, high-impact systems and other highly sensitive systems, and, under Executive Order 14306 and M-26-15, TLS 1.3 support no later than 2 January 2030.
The news release notes that National Security Memorandum 10 "established the year 2035 as the primary target" for completing the migration to PQC across federal systems.
Why it matters: The 2030 and 2035 dates now sit in a final NIST publication rather than a draft. In NIST's usage, deprecated means use is permitted with accepted risk; disallowed means no longer approved under NIST standards. Federal agencies already face the executive order and OMB dates; the report sets out how NIST's own standards will follow. In my assessment, the wider effect runs through procurement and module validation: suppliers selling into US federal markets, and organisations whose policies reference NIST approval, will now be measured against these dates. The practical first step is the same for every organisation: an inventory that shows where RSA, elliptic-curve and Diffie-Hellman keys live, which systems hold long-lived data, and which suppliers control the change. A PQC Discovery Sprint produces that inventory and a prioritised migration path. I set out what moved between draft and final in my comparison briefing of 28 October.
🇨🇭 Switzerland - SEALSQ's QS7001 V1 Completes the Technical Phase of a Common Criteria EAL5+ Evaluation; Full Post-Quantum Evaluation and Certificate Still to Come
Hardware Assurance / Certification / Supply Chain
The Detail: On 27 October 2026 SEALSQ, in a release datelined Geneva, stated that version 1 (V1) of its QS7001 secure element "has successfully completed the technical evaluation phase of its Common Criteria EAL5+" certification.
SERMA Safety & Security, an evaluation laboratory licensed by France's national cybersecurity agency ANSSI, performed the tests. The release quotes the laboratory: "The penetration test campaign is closed with a final verdict to PASS."
The release states that the evaluation "covers the resistance of the chip to physical and side-channel attacks, including fault injection, as well as the correct and secure operation of its security functions", at "EAL5 augmented with ALC_DVS.2 and AVA_VAN.5".
SEALSQ describes the QS7001 product as combining a hardware root of trust with ML-KEM (FIPS 203) and ML-DSA (FIPS 204) alongside classical cryptography. The release does not state that the post-quantum algorithms sit within the V1 evaluation scope; it refers separately to "the V2 full post-quantum evaluation expected in January 2027."
Site audits "are scheduled for January 2027". "Once they have been passed, the evaluation report will be submitted to ANSSI for the formal issuance of the certificate." SEALSQ targets formal certification in 2027.
Why it matters: A passed technical evaluation is not a certificate, and an evaluation of one version is not an evaluation of the next. Procurement teams should record the status exactly: V1 technical evaluation complete, site audits pending, certificate not yet issued, and the full post-quantum V2 evaluation still to come. A supplier claim of post-quantum assurance should name the evaluated version and what its scope covered. A Common Criteria certificate from ANSSI also does not substitute for a FIPS 140-3 validation where a US federal buyer requires one, and, in my assessment, the NIST report published the same day makes that validation route more pressing for anyone selling into that market. A FIPS 140-3 Gap Analysis tests a module's design and documentation against that route before it reaches a laboratory.
🇫🇷 France - Alice & Bob Publishes a Preprint Estimating Fewer Than 23,000 Physical Cat Qubits to Factor RSA-2048 in About Three Days
Threat Model / Resource Estimates / Hardware Architecture
The Detail: On 29 October 2026 Alice & Bob, in a release datelined Boston and Paris, stated that "fewer than 23,000 physical cat qubits could be enough to factor RSA-2048 in just three days." The supporting paper, "Shor's algorithm compiled on cat qubits: 22 593 qubits for RSA-2048 in 3.14 days", is a preprint on IACR ePrint.
The release states that "30,000 physical qubits could crack a Bitcoin key in about one hour", and that its architecture needs 40 times fewer physical qubits than Google Quantum AI's Craig Gidney 2025 estimate. The record framing and the comparison are Alice & Bob's.
The assumptions carry the result: "The headline figures assume no bit flips during the computation, equivalent to a bit flip time of about 1 century." "If bit flips occur about once an hour instead, RSA 2048 needs about 45,000 qubits."
The release acknowledges that substantial engineering challenges remain, and states that Alice & Bob expects hardware improvements and falling resource requirements to converge in the early 2030s. That is the company's forecast.
The release does not state that the paper has been peer reviewed. On 20 October the same company reported that its logical error rate was "not yet below threshold", as covered in the previous edition.
Why it matters: Published resource estimates for breaking RSA-2048 have fallen repeatedly, and each fall shortens the distance between today's hardware and the threat that migration plans assume. This estimate depends on a bit-flip time that has not been demonstrated at scale, and the company's own sensitivity case roughly doubles the qubit count. Risk functions should log it as a dated, assumption-bound vendor estimate, not as a capability. The governance consequence is narrower and firmer: harvest-now, decrypt-later exposure is driven by how long data must stay confidential, and the NIST dates published two days earlier already require action on long-lived data. A falling estimate removes room for delay; it does not create a new deadline.
🇺🇸 🇫🇮 United States and Finland - Non-Binding Technology Memorandum Lists Advocacy of PQC Standards as an Area of Cooperation
Sovereign Alignment / Bilateral Policy / PQC Adoption
The Detail: On 29 October 2026 the White House published a memorandum of understanding between the governments of the United States and Finland on the Technology Prosperity Deal, signed in Washington, D.C., on 29 October.
Under the heading "Securing Quantum Advantage", the participants list "Endorsing and advocating for the adoption of Post-Quantum Cryptographic standards", alongside support for migrating systems to those standards.
The same heading covers joint research, workforce, secure supply chains and coordination in the Quantum Development Group, the Multilateral Dialogue on Quantum and NATO's Transatlantic Quantum Community, and "Advancing trusted, interoperable standards for quantum technologies".
The memorandum also covers connectivity, energy, space, defence, biotechnology, Arctic technology and research security.
It states: "This MOU does not constitute or create and is not intended to constitute or create any legally binding obligations."
Why it matters: PQC adoption is now a line item in a bilateral technology agreement between the United States and an EU and NATO member, signed two days after NIST's final transition report. The memorandum creates no obligation and no date. Its value is directional. In my assessment, it indicates that the US is carrying its standards into allied policy. Groups operating in both jurisdictions should expect PQC alignment to appear in public-sector procurement dialogue and should be able to show which standards their migration follows.
🇨🇦 🇪🇺 Canada and European Union - Canada Joins EuroHPC as Its 39th Participating State, With Access to Quantum Computing Resources
Sovereign Infrastructure / Research Access / Transatlantic Alignment
The Detail: On 30 October 2026, at the EU-Canada Summit in Montréal, Canada "officially became the 39th participating state" of the EuroHPC Joint Undertaking, according to the EuroHPC announcement. The European Commission published the same news.
EuroHPC states that Canada gains access to its supercomputing, AI and quantum computing resources, and that "Canadian scientists will also be able to collaborate with European counterparts" on AI, HPC and quantum projects.
EuroHPC states it is deploying a European quantum computing infrastructure that integrates quantum computers with existing supercomputers.
Neither page states Canada's financial contribution or conditions of participation.
Why it matters: Access to quantum computing capacity is being allocated through sovereign membership arrangements, not only through commercial cloud contracts. Canada, outside the EU, has joined a European infrastructure programme framed around strategic autonomy. For research institutions and companies, the governance point is jurisdiction: which legal framework governs data, intellectual property and export controls when work runs on shared quantum infrastructure across borders. It has no direct bearing on cryptographic risk.
🌐 Global Sweep - Dates in a Final Report, a Lower Estimate Beside Them
Ecosystem / Capital Markets / PQC Infrastructure / Hardware Architecture / Sovereign Security
The Detail:
PQC infrastructure and standards: NIST finalised IR 8547 with deprecation after 2030 and disallowance after 2035, and ML-KEM-768 as the default key-establishment parameter set. SEALSQ's QS7001 V1 secure element completed the technical phase of a Common Criteria evaluation; SEALSQ expects the full post-quantum V2 evaluation in January 2027.
Sovereign security: South Korea's ministry-organised defence pilot carries NIST and Korean PQC algorithms on a SIM. The US-Finland memorandum lists advocacy of PQC standards as an area of cooperation, without binding force. Canada joined EuroHPC with access to quantum computing resources.
Hardware architecture and threat model: Alice & Bob published a preprint estimating fewer than 23,000 physical cat qubits for RSA-2048, assuming no bit flips during the computation.
Capital markets: Intel signed a definitive agreement to acquire Classiq, with closing expected in the first half of 2027 and no price disclosed. QuantrolOx confirmed a €12 million Series A2 on 26 October (noted, not counted).
Regions with no counted in-window signal meeting the primary-source standard: United Kingdom; Germany, the Netherlands, Sweden, Denmark, Spain and Italy; GCC (Qatar, UAE, Saudi Arabia, Bahrain, Kuwait, Oman); Japan, China, India, Singapore, Australia and Taiwan; Africa (South Africa, Nigeria, Kenya, Ghana); Latin America (Brazil, Chile, Mexico, Colombia). Japan and Singapore produced in-window items that did not meet the inclusion rule (see What Was NOT Missed). This records that no signal was verified to the standard; it does not show that nothing occurred.
Geographic position: seven signals from eight jurisdictions. The United States appears in three, and Israel, South Korea, Switzerland, France, Finland, Canada and the European Union in one each.
Standards bodies and regulators with no confirmed in-window PQC output identified: CISA, NSA, UK NCSC, ENISA, BSI, ANSSI, Europol, ETSI, Singapore's CSA, the Bank for International Settlements and the Financial Stability Board.
Why it matters: The deadlines and the threat estimates moved in the same week, and in the same direction. A final NIST publication now fixes when quantum-vulnerable public-key cryptography loses approval, while a vendor preprint argues the hardware needed to break it may be smaller than previously estimated. A bilateral memorandum signed two days later names PQC standards as a shared aim. For boards, the dates are no longer a draft to be watched; in my assessment, they will become the reference that suppliers and auditors use.
🔮 SITG-Consulting COMMENT - THE WEEK'S REAL SIGNAL
In my assessment, the week's highest-consequence signal is NIST IR 8547 moving from draft to final. For two years, organisations could treat 2030 and 2035 as proposals. That defence has gone. NIST states it will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow it after 2035, and it names the algorithms: RSA, ECDSA, EdDSA, Diffie-Hellman and MQV. In my assessment, the question a board now faces is how these dates reach its organisation, and which systems and suppliers are at risk of missing them.
NIST: federal agencies already face executive order dates, and in my assessment NIST's dates will reach others through procurement terms and module validation. An organisation without a cryptographic inventory cannot say which systems fall inside 2030, because it does not know where the keys are.
Alice & Bob: a lower resource estimate, built on an undemonstrated assumption, published as a preprint. Record it with its assumptions. Its effect is on the case for delay, which gets weaker each time an estimate falls.
IDEMIA and KT: a national defence pilot carrying two algorithm families. Suppliers to multiple jurisdictions should expect national algorithms alongside NIST's, and should design for that rather than retrofit it.
SEALSQ: a passed V1 evaluation, a pending certificate and a full post-quantum evaluation still to come are three different facts. Supplier assurance files should record which one they hold, and for which version.
US and Finland: a non-binding memorandum that names advocacy of PQC standards as an area of cooperation. Where allied governments point to the same reference, auditors are likely to follow it.
The defining shift: migration dates have left the consultation stage. The board question is now evidential, and starts with an inventory. Cryptographic Transformation and Modernisation sets out how to locate, govern and replace that cryptography against the dates NIST has now fixed.
⚠️ Important - What Was NOT Missed
No credible evidence of near-term cryptographically relevant quantum advantage. Alice & Bob's figures are resource estimates in a preprint, resting on a bit-flip time not demonstrated at scale; IQM and Pasqal hardware results this week make no cryptanalytic claim, and Pasqal states on its blog: "No computational-advantage claim is made."
No breakthrough reducing the need for hybrid PQC or for migration of signatures.
Israel Innovation Authority report, "Israel's Quantum Ecosystem": the report is hosted on the Authority's own site and dated October 2026, with press coverage from 26 October, but no day of publication was established on the issuer's page. Held as pending, not counted.
Singapore: pQCee named Carahsoft as its US public-sector aggregator (29 October); a distribution agreement, not a governance or deployment signal. The CSA Quantum-Safe Kickstarter Grant programme period began on 1 November, but the grant was announced on 14 October. Neither counted.
Japan: NEDO selected a SoftBank-led consortium for a quantum computing and AI materials platform for fiscal 2026 to 2028 (28 October); quantum computing research with no PQC or cryptanalytic implication. Not counted.
Capital and contracts without a governance or deployment signal: QuantrolOx €12 million Series A2 (26 October; this closes the item held pending in the previous edition, and corrects "Series A" to "Series A2"); IonQ USD 7.5 million Air Force Research Laboratory follow-on for quantum networking (27 October); SEALSQ's intent to acquire satellite capacity for about USD 15 million (26 October); SAIC quantum portfolio launch (28 October). Not counted.
Vendor research: Sectigo's 2026 State of Crypto Agility survey (28 October) reports that 38% of respondents have fully assessed systems vulnerable to quantum attack; it is a self-reported survey and the company describes year-on-year comparisons as directional. Not counted.
GESDA and the Open Quantum Institute (Geneva, 27 October) published a report on quantum diplomacy; a governance report with no PQC content. Not counted.
ITU-T Recommendation X.1711 on QKD protocols was announced on 23 October, in the previous window, and was not covered there. Recorded for completeness.
Leads with no primary source located: Netpoleon India and QNu Labs channel partnership (reported 30 October); KT's 6G Security Insight Group (reported 28 October); IDEMIA's EMVCo post-quantum payment card certification (29 October, not verified). Excluded.
Forward context: the IETF draft on PQC for constrained devices is on the IESG telechat of 5 November; Quantinuum and IQM report results on 5 November; the ITU Plenipotentiary Conference opens in Doha on 9 November; under Executive Order 14412, signed on 22 June 2026, the Federal Acquisition Regulatory Council must publish a proposed rule within 180 days, which falls on 19 December, requiring covered contractors to comply with applicable FIPS, including those with post-quantum algorithms, by 31 December 2030.
⚠️ Disclaimer
This newsletter is produced by SITG-Consulting for informational purposes only. It does not constitute professional advice, whether legal, technical, regulatory, or otherwise. The content reflects publicly available information and the author's independent analysis as of the date of publication. Readers should verify all claims independently and seek qualified professional counsel before making decisions based on this material. SITG-Consulting accepts no liability for actions taken or not taken based on the contents of this newsletter.
Previous edition: https://www.sitg-consulting.com/post/quantum-weekly-the-global-signals-that-actually-mattered-19-25-october-2026 Full archive: https://www.sitg-consulting.com/blog
Comments