Built to Last: Why Automotive-Grade Post-Quantum Cryptography Can't Wait

The Road to Quantum Readiness Starts Today

Automakers face a unique challenge: vehicles rolling off the line in 2026 will still be on the road in the 2040s, well past the point when cryptographically relevant quantum computers (CRQCs) are expected to emerge. The coming quantum threat isn't just a future IT problem—it's a long-term automotive security problem that demands action now.

While the industry watches NIST's post-quantum cryptography (PQC) standards mature and high-profile IT migrations gain momentum, the automotive sector remains dangerously behind. This lag isn't just a compliance gap: decades-long vehicle lifecycles and complex supply chains create urgent, architecture-level exposure.

The Automotive PQC Gap

When it comes to PQC readiness, automotive is conspicuous for its lag. A 2026 survey of automotive decision-makers by the Ponemon Institute found that only 19% of automotive organizations have started planning for PQC. By contrast, sectors such as financial services and telecommunications are already piloting PQC migration strategies, and many governments have mandated timelines for critical infrastructure.

This disparity is striking, and it carries serious consequences for road users, vehicle manufacturers, and the broader automotive ecosystem. The unique constraints of automotive—long development cycles, functional safety requirements, and diverse hardware environments—make the migration challenge far more complex than in IT, where systems are typically replaced within a few years.

Why Automotive Is Different

The automotive industry's approach to PQC migration must account for factors that don't apply in most other sectors:

Extended vehicle lifespans. A car built today can remain in service for 15 to 20 years or more. Any cryptographic system deployed now must be resilient against quantum attacks that may emerge well before the vehicle is retired.
Strict functional safety and security standards. ISO 26262 (functional safety) and ISO/SAE 21434 (automotive cybersecurity) impose rigorous requirements on any new technology introduced into vehicles. PQC algorithms must be evaluated against these frameworks.
Constrained embedded environments. Vehicle ECUs often operate with limited processing power, memory, and energy budgets. PQC algorithms must be optimized for these constraints without compromising performance or safety.
Complex supply chains. Automotive security depends on hardware and software from dozens of suppliers. Achieving PQC readiness requires coordinated, standards-based approaches across the entire ecosystem.
Over-the-air update challenges. While OTA updates can help patch vulnerabilities, they also introduce new attack surfaces and require careful key management.

The Coming Storm: Harvest Now, Decrypt Later

One of the most pressing threats is the "harvest now, decrypt later" (HNDL) attack. Adversaries are already capturing encrypted automotive data—from vehicle-to-cloud communications to firmware updates—with the intention of decrypting it once quantum computers become powerful enough. For vehicles with 20-year lifespans, data encrypted today with RSA or ECC could be exposed within the vehicle's operational lifetime.

In 2025, the U.S. National Security Agency (NSA) updated its guidance on PQC migration, emphasizing that organizations must begin transitioning now to protect long-lived data. Automotive systems that rely on public-key cryptography for authentication, secure boot, and secure communications are particularly vulnerable.

What Automotive-Grade PQC Looks Like

Automotive-grade PQC isn't just about dropping in a new algorithm. It requires a comprehensive, standards-based approach that addresses the unique demands of the automotive environment:

Crypto-agility. Vehicles need the ability to update cryptographic algorithms via OTA updates without compromising safety or security. This requires designing software and hardware with replaceable cryptographic modules from the start.
Hybrid cryptography. During the transition period, combining classical and post-quantum algorithms provides defense-in-depth against both quantum and classical attacks.
Hardware acceleration. Many PQC algorithms, such as those based on lattices, require more computational resources than their classical counterparts. Automotive-grade hardware must include efficient accelerators to meet performance and power constraints.
Standards compliance. PQC implementations must align with emerging standards from NIST, ISO, and SAE, as well as regional regulations. In 2026, NIST is expected to finalize additional PQC standards, and automotive-specific guidance from ISO/SAE is in development.
Supply chain coordination. Automakers and suppliers must collaborate on PQC migration roadmaps, ensuring interoperability and consistent security across all vehicle components.

The Cost of Waiting

Delaying PQC migration in automotive carries significant risks:

Safety and security exposure. Quantum-enabled attacks on vehicle systems could compromise passenger safety and enable theft or remote control of vehicles.
Regulatory penalties. Governments are increasingly mandating cybersecurity requirements for vehicles. Non-compliance could result in fines, recalls, or restrictions on market access.
Reputational damage. A high-profile quantum-related breach could severely damage consumer trust in automotive brands.
Costly retrofits. Upgrading cryptographic systems after vehicles are already on the road is far more expensive and complex than building PQC in from the start.

The Path Forward

Automotive stakeholders must take action now to ensure PQC readiness:

Assess exposure. Identify all systems and data flows that rely on public-key cryptography and evaluate their vulnerability to quantum attacks.
Develop a migration roadmap. Create a phased plan that aligns with NIST standards, ISO/SAE guidance, and vehicle development cycles.
Invest in crypto-agility. Design vehicles with updateable cryptographic modules and hardware accelerators that can support PQC algorithms.
Collaborate across the ecosystem. Work with suppliers, standards bodies, and regulators to ensure a coordinated approach.
Start piloting now. Begin testing PQC algorithms in real-world automotive environments to identify performance, safety, and integration challenges early.

Conclusion

The quantum threat to automotive security is real, and the industry's long development cycles leave no room for delay. Automotive-grade PQC isn't just a technical upgrade—it's a strategic imperative for protecting vehicles, passengers, and brands in the quantum era. The time to act is now.

This article was originally published on Semiconductor Engineering and has been updated for 2026.

via Semiconductor Engineering

Built to Last: Why Automotive-Grade Post-Quantum Cryptography