{"id":12009,"date":"2025-03-27T11:38:17","date_gmt":"2025-03-27T11:38:17","guid":{"rendered":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/?p=12009"},"modified":"2025-04-15T03:45:15","modified_gmt":"2025-04-15T02:45:15","slug":"a-snapshot-of-post-quantum-cryptography-at-mwc25-barcelona","status":"publish","type":"post","link":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/latest-news\/a-snapshot-of-post-quantum-cryptography-at-mwc25-barcelona\/","title":{"rendered":"A Snapshot of Post-Quantum Cryptography at MWC25 Barcelona"},"content":{"rendered":"\n

Post-quantum security is an urgent challenge facing the mobile industry in preparation for ‘Q-Day’. As quantum computing inches closer to cryptographic relevance, the security models underpinning banking, telecommunications, and digital infrastructure could buckle under the weight of quantum decryption\u2014making immediate preparation essential.<\/p>\n\n\n\n

At the 6th Post-Quantum Network Seminar<\/a> in MWC25 Barcelona, industry leaders, policymakers, and cryptography experts discussed the looming threats, the industry\u2019s response, and the need for an immediate migration to quantum-safe cryptographic solutions. As Luke Ibbetson, Head of Group R&D at Vodafone<\/a>, put it, “The complexity of the ecosystem in which we need to upgrade cryptography is such that we need to start planning for this today.”<\/p>\n\n\n\n

\n
\n
\"A<\/figure>\n<\/div>\n\n\n\n
\n
\"A<\/figure>\n<\/div>\n\n\n\n
\n
\"A<\/figure>\n<\/div>\n<\/div>\n\n\n\n

The quantum threat: why act now?<\/strong><\/p>\n\n\n\n

Once powerful enough, quantum computers will shatter today\u2019s encryption standards, rendering sensitive data vulnerable. The \u2018store now, decrypt later\u2019 attack model is a particular concern: attackers are already harvesting encrypted data, waiting for the day quantum computing allows them to break it. Mark Carney, Head of Quantum for Cybersecurity Research at Santander, highlighted this stark reality: “If decrypt that data in ten years, I\u2019ve got a data lake that a quantum computer doesn\u2019t help me with. A smart attacker will know that. They\u2019ll be targeting the right data now.”<\/p>\n\n\n\n

But this isn\u2019t just about encryption\u2014quantum computers could undermine digital signatures, authentication mechanisms, and even network integrity. Bad actors could rewrite transaction histories, impersonate institutions, and systematically dismantle trust in digital systems.<\/p>\n\n\n\n

The financial sector, which operates under strict regulatory oversight, is particularly concerned. Anne Leslie, Cloud Risk Leader at IBM Cloud Financial Services, explained that “The challenge isn\u2019t just technical. It\u2019s human. We\u2019re already dealing with regulatory overload, operational resilience, and cyber threats. Adding quantum risk to that mix means prioritising what must be tackled first.”<\/p>\n\n\n\n

The estimated timeline for \u2018Q-Day\u2019, when quantum computers reach cryptographic relevance, varies\u2014but many experts predict it could arrive as early as 2030. Given the time required for global cryptographic migration, the industry must act now.<\/p>\n\n\n\n

\n
\n
\"Four<\/figure>\n<\/div>\n\n\n\n
\n
\"Two<\/figure>\n<\/div>\n\n\n\n
\n
\"A<\/figure>\n<\/div>\n<\/div>\n\n\n\n

Post-quantum security relies on industry collaboration<\/strong><\/p>\n\n\n\n

With mobile networks so crucial to digital infrastructure, the telecoms industry is at the centre of post-quantum security. Networks must transition to quantum-resistant encryption, but the task is immense. With security deeply embedded across supply chains, legacy infrastructure, and IoT ecosystems, the migration must be coordinated across sectors.<\/p>\n\n\n\n

Lory Thorpe, Chair of the GSMA Post-Quantum Telco Network Task Force and Senior Strategy Advisor at IBM<\/a>, emphasised that “The telco industry doesn\u2019t work in isolation. We need collaboration across vendors, regulators, and enterprises. This is a security upgrade at an unprecedented scale.”<\/p>\n\n\n\n

One key challenge is interoperability\u2014ensuring that quantum-safe cryptographic standards work seamlessly across global networks. While organisations like NIST, IETF, and 3GPP are leading standardisation efforts, different countries are pursuing their own quantum security strategies. Laura Iglesias, Head of Cybersecurity for European Markets at Vodafone, acknowledged the challenge: “We do need interoperability. We need an agreement between the different agents in the ecosystem\u2014telcos, vendors, software providers\u2014so we can all move in sync.”<\/p>\n\n\n\n

Regulation is also shaping this transition. The Digital Operational Resilience Act (DORA)<\/a> in Europe and U.S. federal mandates are forcing enterprise to confront post-quantum security. As Anne Leslie noted: “regulation is painful, but necessary. If we\u2019d all been following best practices, we wouldn\u2019t need it. The reality is, companies aren\u2019t securing their cryptography fast enough.”<\/p>\n\n\n\n

Challenges in implementation: IoT, legacy systems, and energy constraints<\/strong><\/p>\n\n\n\n

The IoT represents a particularly difficult security challenge for post-quantum security. IoT devices often have limited processing power, long lifespans, and no straightforward upgrade path\u2014yet they are critical to industries like energy, transportation, and healthcare. Simon Bryden, Consulting Engineer at Fortinet, warned: “IoT is where quantum security gets tricky. These devices are deployed for 10\u201315 years, sometimes longer. If we don\u2019t build quantum resilience into them today, we\u2019re setting ourselves up for massive security failures in the future.”<\/p>\n\n\n\n

Legacy infrastructure compounds the problem. Telecom networks, financial institutions, and governments must phase out outdated encryption across thousands of suppliers and generations of hardware. This is neither quick nor cheap.<\/p>\n\n\n\n

At the same time, post-quantum encryption demands more processing power, which affects energy efficiency\u2014especially in battery-powered IoT devices. This creates a trade-off between security and sustainability.<\/p>\n\n\n\n

\n
\n
\"An<\/figure>\n<\/div>\n\n\n\n
\n
\"Two<\/figure>\n<\/div>\n\n\n\n
\n
\"A<\/figure>\n<\/div>\n<\/div>\n\n\n\n

Regulatory landscape and standardisation efforts<\/strong><\/p>\n\n\n\n

Global cryptographic standardisation remains a moving target. NIST\u2019s selection of post-quantum cryptographic algorithms is a major milestone, but competing approaches exist. For example, countries like China and South Korea are pursuing their own quantum security strategies, creating uncertainty for global enterprises. Patricia D\u00edez Mu\u00f1oz, Global Security Director for Networks & Systems at Telef\u00f3nica, stressed that “the explosion of IoT devices means we need harmonised global security standards. Otherwise, manufacturers will be stuck following conflicting regulations in different regions.”<\/p>\n\n\n\n

For MNOs this fragmentation poses a serious risk. Without unified standards, networks will be forced to juggle multiple cryptographic frameworks, increasing complexity and cost.<\/p>\n\n\n\n

The road ahead for post-quantum security<\/strong><\/p>\n\n\n\n

The consensus at the seminar was clear: organisations must act now to avoid ominous security gaps in the near future. Post-quantum security is not a one-time upgrade but an ongoing process. Enterprises must follow a three-phase approach:<\/p>\n\n\n\n

    \n
  1. Discovery and inventory: identify cryptographic dependencies across networks, software, and supply chains.<\/li>\n\n\n\n
  2. Migration and testing: implement hybrid cryptographic solutions to transition gradually while ensuring resilience.<\/li>\n\n\n\n
  3. Continuous monitoring and adaptation: maintain cryptographic agility to accommodate future advancements.<\/li>\n<\/ol>\n\n\n\n
    \n
    \n
    \"A<\/figure>\n<\/div>\n\n\n\n
    \n
    \"At<\/figure>\n<\/div>\n\n\n\n
    \n
    \"A<\/figure>\n<\/div>\n<\/div>\n\n\n\n

    The shift will require cross-sector cooperation. As Maxime Flament, CTO of the 5G Automotive Association, pointed out: “Quantum threats don\u2019t respect industry boundaries. Whether it\u2019s telecom, banking, or automotive, we all need a shared security roadmap.” The organisations that take quantum security seriously today will be the ones best positioned to protect their infrastructure, data, and customers tomorrow. The transition to post-quantum security is one of the most complex challenges in cybersecurity history. The threat is real, the timeline is short, and the industry must act before it\u2019s too late.<\/p>\n\n\n\n

    The GSMA Post Quantum Telco Network Task Force <\/a>will continue to work with its members to help resolve the Post-quantum cryptography implementation challenges faced by the mobile industry.<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Please click here to download the presentation of the 6th Post Quantum Network Seminar.<\/p>\n\n\n\n

    \n
    Download<\/a><\/div>\n<\/div>\n\n\n\n

    <\/p>\n\n\n\n

    Watch on-demand<\/h2>\n\n\n\n

    \n