Cyber Summit Korea (CSK) 2026. (Source: CSK 2026 Cyber Summit Korea website)

CSK 2026 Session A-3: Staying a Step Ahead of the Quantum Computing Threat

The cybersecurity we need to start preparing for now, ahead of the quantum computing era

While artificial intelligence (AI) drives a new wave of change in cybersecurity, another massive technological shift is reshaping the security field too. That is quantum computing.

Because a quantum computer processes information in a completely different way from a traditional computer, it may in the future be able to quickly carry out calculations that are extremely difficult for today's computers. This advance could open new opportunities in fields like drug development, new-materials research, finance, and logistics, but from a cybersecurity standpoint it raises an important question.

"Is the cryptography we use today secure enough?"

In particular, some of the public-key cryptography widely used on the internet could see its security weakened once a sufficiently powerful quantum computer emerges.

This is why countries around the world are beginning the work of switching cryptographic systems before quantum computers become a real threat, rather than waiting until quantum computers are commercialized.

This trend was also covered as an important topic at Cyber Summit Korea (CSK) 2026, held at COEX Seoul in September 2026.

CSK 2026's Session A-3, under the theme "Staying a Step Ahead of the Quantum Computing Threat," examined quantum information technology and the future of cybersecurity, post-quantum cryptography (PQC), Korea's domestic KpqC response, and the present and future of quantum key distribution (QKD).

1. Why quantum security matters at CSK 2026

CSK 2026 is a global cybersecurity event jointly hosted by the National Intelligence Service and the National Security Research Institute.

The overall theme of the 2026 event was "A Step Ahead for Global Cybersecurity: Connected World, Security Together," and it covered future cybersecurity issues — the quantum computing threat and software supply chain security, alongside AI and the cloud.

The quantum computing issue in particular has a somewhat different characteristic from other security threats.

It doesn't mean that all cryptography is collapsing right now — it's the issue of preparing in advance for the possibility that some of today's public-key cryptographic systems could be affected once a sufficiently powerful quantum computer emerges in the future.

The National Intelligence Service likewise noted at CSK 2026 the possibility that advances in quantum computing technology could neutralize current cryptographic systems, and stated that it is reviewing plans with relevant ministries to move up the timeline for transitioning core areas to post-quantum cryptography ahead of the original target.

In other words, quantum security isn't a matter of "responding once quantum computers appear" — it's a field that requires the approach of "preparing before quantum computers appear".

2. What did Session A-3 cover?

CSK 2026 Session A-3 was chaired by Professor Kwak Jin of Ajou University.

The session examined the quantum security issue broadly from three perspectives.

First

how advances in quantum information technology affect the future of cybersecurity

Second

what cryptographic technology we need to transition to in order to respond to quantum computers

Third

how to make use of quantum key distribution, beyond cryptographic technology alone

The presentations were centered on the following three speakers.

• Professor Lee Dong-heon (Korea University)

• Director Jeong Kyung-cheol (National Security Research Institute)

• Director Kim Young-hee (National Information Society Agency)

Connecting the three presentations together, they can be understood through the flow "advances in quantum technology → threats to existing cryptography → the transition to PQC → the use of new security technology like QKD".

3. What is quantum information technology?

The first presentation covered advances in quantum information technology and the future cybersecurity issue.

Put simply, quantum information technology is technology that uses quantum-mechanical properties for information processing.

Representative examples include the following three fields.

① Quantum computing

Technology that uses quantum properties to perform calculations in a way different from traditional computers.

② Quantum communication

Technology that uses quantum-mechanical properties to transmit information or generate cryptographic keys.

③ Quantum sensing

Technology that aims for a higher level of measurement precision than existing sensors, using the properties of quantum states.

The National Information Society Agency (NIA) likewise describes quantum information technology through areas like quantum computing, quantum communication, and quantum sensing, and explains that countries around the world are expanding investment, treating quantum technology as a strategic technology.

Among these, the fields most directly connected to cybersecurity are quantum computing and quantum communication.

4. Why does a quantum computer threaten existing cryptography?

Cryptographic technology is necessary to exchange information safely over the internet.

For example, when we log into a website or shop online, a range of cryptographic technology is used to make sure personal and payment information is transmitted securely.

Some of the public-key cryptographic systems widely used today rely for their security on the computational complexity of mathematical problems that are extremely difficult for a traditional computer to solve, like factoring large numbers or the discrete logarithm problem.

But once a sufficiently powerful quantum computer emerges, it may be able to handle these problems in a way completely different from a traditional computer.

The representative quantum algorithm, Shor's algorithm, is theoretically known to be able to quickly solve factoring and discrete-logarithm problems on a sufficiently large-scale quantum computer.

So a new response will be needed in the future for some of the public-key cryptographic systems used today.

What matters here is that this doesn't mean every cryptographic system in existence today will be broken by a quantum computer immediately.

The issue is that systems need to start being transitioned now, in preparation for a future possibility of attack.

5. Why "change the cryptography now"

One concept that comes up often in quantum security is the potential for a "Harvest Now, Decrypt Later" attack.

This is a scenario where an attacker gathers currently encrypted data now, intending to decrypt it later once a sufficiently powerful quantum computer becomes available.

For example, consider state secrets, a company's core technical information, personal data, or research materials that need to be preserved for a long period, all currently encrypted.

Even if the encryption can't be broken today, the risk can change as technology advances in the future.

So the longer data needs to stay secure, the more important it is to start the transition to a new cryptographic system early.

The U.S. NIST likewise, in publishing its post-quantum cryptography standards, advises that organizations need to begin transitioning to post-quantum cryptography. NIST's transition plan lays out a phased path to deprecating cryptography vulnerable to quantum computers by 2035, with higher-risk systems required to transition sooner.

6. Post-quantum cryptography (PQC), the solution that has emerged

The representative method for responding to the quantum computing threat is post-quantum cryptography (PQC).

PQC refers to new cryptographic algorithms designed to withstand attack even once quantum computers emerge.

An important characteristic is that it can be used in today's computing environment.

In other words,

existing computers → using PQC algorithms

— in this way, existing networks and systems can be transitioned gradually.

So it's easiest to understand PQC not as a technology used only after quantum computers appear, but as a technology for replacing existing cryptographic systems ahead of time, in preparation for the quantum computing era.

7. PQC standardized by NIST

One important international development in the PQC field is standardization by the U.S. National Institute of Standards and Technology (NIST).

In August 2024, NIST finalized the following three post-quantum cryptography standards.

FIPS 203 — ML-KEM

This is a key encapsulation mechanism (KEM) that lets two parties establish a shared secret key over a public channel.

It's based on the existing CRYSTALS-Kyber.

FIPS 204 — ML-DSA

This is a standard for digital signatures.

It's based on the existing CRYSTALS-Dilithium.

FIPS 205 — SLH-DSA

This is a hash-based digital signature algorithm.

It's based on SPHINCS+, and serves as a complementary signature method using a different mathematical approach from ML-DSA.

NIST has continued its PQC standardization work since then.

In 2025, it selected HQC as an additional standardization target. HQC is being advanced as a separate key encapsulation algorithm to complement the existing ML-KEM.

In this way, post-quantum cryptography is developing beyond simply creating one new cryptographic algorithm, into a process where international standards and entire industrial systems move together.

8. Why KpqC matters domestically

The second presentation introduced trends in post-quantum cryptography and the state of Korea's domestic response through KpqC.

What's worth noting here is KpqC.

KpqC is a domestic research, competition, and technology-development framework for post-quantum cryptography, pursued to secure Korea's own post-quantum cryptography capability.

Korea's Post-Quantum Cryptography Research Group is working, through industry-academia-government-research cooperation, to expand the domestic PQC technology base and to develop and select domestic post-quantum cryptography algorithms.

In 2025, the following four algorithms were selected as finalists in the KpqC national competition.

• AIMer

• HAETAE

• NTRU+

• SMAUG-T

The research group has been preparing to propose these algorithms as national standards, and continues activities to publish final specifications and implementation code and to spread the technology.

In 2026, a KpqC Winter Camp was also held, offering training that introduced the technology needed to understand and implement the finalist algorithms.

This shows that post-quantum cryptography is moving, domestically too, beyond a simple research topic into a stage that considers actual implementation, standardization, verification, and industrial application.

9. KCMVP and the PQC transition

Applying post-quantum cryptography to actual public institutions or security products requires more than just developing the algorithm.

A system for verifying and managing the safety of the cryptographic modules built into actual security products is needed too.

In Korea, KCMVP (Korea Cryptographic Module Validation Program) plays an important role here.

KCMVP is a national-level system for verifying the security of cryptographic modules.

So for PQC to expand into critical areas like the public sector, defense, and finance, not just the safety of the PQC algorithm itself, but the verification and management system for the cryptographic modules that implement it need to develop together.

In 2026, cases of KCMVP certification for cryptographic modules that apply PQC also began appearing domestically, making the actual application stage of post-quantum cryptography more concrete.

In industry, discussion is also continuing on the importance of a hybrid approach that uses existing cryptography together with PQC, and of securing crypto-agility — the ability to swap out cryptographic algorithms as needed.

10. What matters in the cryptographic transition isn't just "swapping the algorithm"

Thought of simply, the PQC transition looks like this.

Existing cryptography → replaced with PQC

But in an actual company's or institution's IT environment, it's much more complex.

Even looking at just one institution, cryptographic technology is used across countless systems — servers, PCs, smartphones, network equipment, VPNs, certificates, databases, the cloud, IoT devices, and more.

So the PQC transition process first requires work like the following.

① Check what cryptography is currently in use

It's necessary to identify what cryptographic algorithms are currently used across an institution's systems and applications.

② Classify important data

It's necessary to distinguish information that needs long-term protection from information with a relatively short retention period.

③ Review PQC applicability

It's necessary to check whether PQC algorithms can be applied to current systems.

④ Consider running existing cryptography and PQC in parallel

In the early stages of the transition, a hybrid approach using both existing cryptography and PQC together can be considered.

⑤ Secure crypto-agility

Systems need to be designed so that cryptographic algorithms can be swapped relatively easily even as standards or security requirements change in the future.

In the end, quantum security is closer to the work of reviewing how cryptography is used across an entire IT infrastructure, rather than a project to swap out a single cryptographic algorithm.

11. Is PQC alone enough?

The third presentation covered the present and future of quantum key distribution (QKD).

Here it's necessary to understand the difference between PQC and QKD.

PQC

This is an approach that uses new mathematical cryptographic algorithms designed to stay secure even against attacks from quantum computers.

QKD

This is technology that uses quantum-mechanical properties to generate and distribute a secure cryptographic key between two communicating parties.

Put simply, PQC is close to "making a new lock that's hard to pick even with a quantum computer," while QKD is close to "using quantum-mechanical properties to deliver the key securely."

12. How does QKD work?

QKD uses quantum properties to generate a cryptographic key that the communicating parties will share.

In a representative QKD scheme, information is transmitted using a quantum state, like that of a photon.

Because a quantum state can change when it's measured or intercepted from outside, this quantum-mechanical property can be used to detect whether eavesdropping has occurred during communication.

So it's easiest to understand QKD's core concept as

"generating a secure key, and detecting any eavesdropping that may occur during communication"

.

The European Telecommunications Standards Institute (ETSI) describes QKD as technology that uses quantum-mechanical properties to generate a shared random secret key, and explains that it can be used together with PQC as part of a layered, quantum-safe security strategy.

13. Are QKD and PQC competitors?

There's no need to think of QKD and PQC simply as "a choice between one or the other."

The two technologies secure things in different ways.

ETSI likewise describes QKD as a complementary technology that can be used alongside PQC.

So in the future quantum security landscape, a multi-layered approach that uses PQC and QKD each according to their own characteristics and security requirements is likely to become important.

14. Korea's domestic QKD industry is moving into the demonstration stage too

In Korea too, the foundation for using quantum key distribution technology in real environments is expanding.

In 2025, an open quantum testbed opened in Pangyo, and activity was carried out to lay the groundwork for testing, certifying, and commercializing QKD and quantum-cryptography-related equipment.

At the time, the quantum testbed introduced certification cases related to QKD, quantum cryptography equipment, and quantum key management systems, and discussed plans to expand quantum key distribution services nationwide and demonstrate them further.

The NIA likewise plays a role in building and operating quantum testbeds, commercializing technology, and training personnel to industrialize Korea's domestic quantum technology, and takes part in standardization related to quantum key distribution and post-quantum cryptography as well.

This is part of a trend showing that QKD is moving beyond a purely lab-level technology into a stage that considers testing, verification, standardization, and industrial application all at once.

15. Competition over quantum security standardization is under way internationally too

Quantum security isn't a problem for any single country alone.

The U.S. NIST has already finalized its PQC standards, and work continues to apply them to international standardization and network technology.

NIST's PQC project explains that movement to apply post-quantum cryptography is also under way across international standards and communications-related areas like ISO/IEC, IETF, and 3GPP.

QKD, too, is being standardized across various areas — security, interoperability, interfaces, key management — centered mainly around ETSI.

ETSI in particular has continued publishing new QKD-related standards documents in 2026, showing that QKD, too, has entered a stage where standardization and interoperability matter just as much as technology development.

16. What should companies and institutions be preparing now?

This doesn't mean quantum computers have actually reached the point of being able to break all existing cryptography today.

But the transition to quantum security takes a considerable amount of time.

So companies and institutions can start preparing in the following ways.

First, identify your cryptographic assets.

It's necessary to check which cryptographic algorithms are used on which servers and applications.

Second, find the data that needs long-term protection.

Even if it's secure today, if it's important information that needs to be preserved for a long time, the future quantum computing threat needs to be taken into account.

Third, review the PQC standards.

You can review how to apply standards like NIST's ML-KEM, ML-DSA, and SLH-DSA to your systems.

Fourth, secure crypto-agility.

A structure is needed that allows for a quick swap when a new algorithm emerges or a vulnerability is found in an existing one.

Fifth, you can also consider the potential use of QKD.

Rather than applying QKD to every system, the right approach is to review its technical and economic feasibility for things like a nation's core network or communication environments that need a very high level of security.

17. When should quantum security preparation begin?

Waiting to start changing cryptography until after quantum computers are fully developed could be too late.

The reason is simple.

Changing a cryptographic system across a large-scale IT system takes a considerable amount of time.

In particular, in large-scale systems like finance, defense, public institutions, healthcare, telecommunications, manufacturing, and the cloud, a single cryptographic algorithm can be connected to countless programs and pieces of equipment.

So the core of quantum security is checking today's systems and building a transition plan before the future threat becomes real.

NIST likewise presents the direction that organizations need to begin preparation and migration now to apply post-quantum cryptography standards.

18. The direction for quantum security that CSK 2026 Session A-3 revealed

Connecting the three presentations of CSK 2026 Session A-3 into a single flow, it can be summarized as follows.

Advances in quantum information technology

↓

The potential threat quantum computers pose to existing cryptographic systems

↓

Developing post-quantum cryptography (PQC) and international standardization

↓

Pursuing domestic KpqC technology development and standardization

↓

Real-world verification systems like KCMVP and industrial application

↓

Using new security technology like quantum key distribution (QKD)

↓

Building a future, multi-layered quantum security system

In other words, quantum security isn't a problem solved by any single technology alone.

it can be seen as a long-term security transition task that requires cryptographic algorithms, standards, verification systems, networks, equipment, software, and policy to all move together.

19. Why quantum security matters for ordinary users too

"quantum computers are technology for experts — what does that have to do with ordinary users?"

— you might think.

But in reality, most internet services use cryptographic technology.

Online shopping, internet banking, email, cloud services, mobile apps, corporate work systems — the services we use every day are all connected to cryptographic technology.

So as the quantum computing era approaches in earnest, users are likely to experience a shift where service providers — web browsers, operating systems, the cloud, financial services, network equipment — apply quantum security technology on their end, even without users directly changing any cryptographic algorithm themselves.

In the end, quantum security isn't a problem for a handful of researchers alone — it's an issue connected to the future security of everyone who uses the internet.

20. Conclusion — security that prepares ahead of the quantum computer

The core message that CSK 2026 Session A-3, "Staying a Step Ahead of the Quantum Computing Threat," delivers is clear.

Quantum computers are still in development, but their potential is already demanding new changes to existing cybersecurity systems.

Internationally, PQC standards have already been established, centered on NIST, and domestically, algorithm development and standardization efforts continue through KpqC.

At the same time, demonstration and standardization work is under way to apply quantum communication technology, including QKD, to real networks and industrial environments.

Quantum security going forward isn't something that suddenly begins one day — it's likely to be a long-term transition process that starts being prepared, little by little, from now.

For companies and institutions in particular, identifying the cryptographic technology currently in use, checking which data needs long-term protection, reviewing the potential for a PQC transition, and securing crypto-agility can all be important parts of preparation.

Security for the quantum computing era doesn't begin after quantum computers appear — it starts with preparing before they do.

The phrase "a step ahead" that CSK 2026's Session A-3 emphasized is a case that captures exactly this importance of forward-looking security preparation.

Key takeaways at a glance

Please refer to the Cyber ​​Summit Korea (CSK) 2026 website (https://cybersummit.kr)