Why both problems reward the same underlying capability — and how security leaders can act on it in the next 90 days.

Two risks, one decision window

Security leaders are increasingly being asked two questions in the same quarter: is the organization ready for post‑quantum cryptography, and can it support gasless transactions without weakening control? The problems are different, but they reward the same discipline — inventory, written policy, telemetry and phased rollout — and they fail the same way when those are missing. The underlying question, in both cases, is how quickly the organization can change a cryptographic or trust assumption without disrupting the business.

What is real, and what needs perspective

The post‑quantum transition is no longer theoretical. NIST has approved three post‑quantum standards — FIPS 203 (ML‑KEM), FIPS 204 (ML‑DSA) and FIPS 205 (SLH‑DSA)[1],[2] — and the NSA's CNSA 2.0 suite sets a 2035 horizon for U.S. national security systems[6]. Federal civilian agencies have a parallel mandate under National Security Memorandum 10 (NSM‑10), OMB Memorandum M‑23‑02[4],[5] and the Quantum Computing Cybersecurity Preparedness Act[7] of 2022, all of which require cryptographic inventories and migration plans; the MITRE‑led Post‑Quantum Cryptography Coalition reflects the industry response. The joint CISA / NSA / NIST quantum readiness roadmap[3],[6], along with similar work at the European level[13], points in the same direction. The message is unglamorous but clear: start the inventory now, plan the migration in phases, and assume that long‑lived secrets are already exposed through harvest‑now, decrypt‑later collection.

The closest prior precedent is the SHA‑1 deprecation — a phased migration with multi‑year public notice and predictable failure modes for organizations that started late. Major browsers phased out trust in SHA‑1 certificates between 2014 and 2017[10], and several enterprises learned at the last minute that internal CAs, build pipelines, and embedded devices had quietly assumed the algorithm would last forever. The PQC takeaway has the same shape: long‑lived data and long‑lived trust chains need migration plans now, while the algorithms they will migrate to are finally stable.

A pragmatic post‑quantum model

A workable migration model starts with three questions:

• How long must the asset remain confidential?
• Which algorithms protect it today?
• Where can ciphertext or signatures be collected and stored for later analysis?

This framing lets teams rank systems by exposure rather than try to fix crypto everywhere at once. The systems where harvest‑now, decrypt‑later stops being theoretical are usually the same ones with the longest secret lifetimes — VPN concentrators, code‑signing pipelines, certificate authorities and archived TLS sessions. The asymmetry built into NIST and NSA guidance helps prioritize further[2],[6]: RSA, ECDH and ECDSA are most exposed, while AES‑256 and modern hashes survive with parameter adjustments rather than redesign.

When the DigiNotar CA was compromised in 2011[8],[9], the organizations that survived without an outage were largely the ones that already knew where every certificate lived. The cryptography was healthy; the trust assumption underneath it had to be replaced overnight, and the cost of replacement tracked inventory quality, not cryptographic sophistication.

What this looks like in practice

Picture a familiar scenario. A regional bank prepares a routine certificate rotation on its mobile banking apps. Somewhere in a vendor SDK shipped years earlier — through two acquisitions and a brand refresh — a hard‑coded RSA‑2048 check is pinned. The cert has to roll; the SDK accepts nothing else; the rollout window is a single weekend. A non‑trivial share of users is forced into an app update, and the support queue absorbs the cost. No attacker has to engineer the incident, and no quantum computer is in the room. The team has demonstrated to itself that it cannot change a cryptographic primitive without breaking the business — which is what crypto agility, before any algorithm choice, actually means in practice. After an outage of this shape, the post‑quantum conversation becomes easy. The hard part — funding, prioritization and getting platform teams to agree that algorithm choice belongs in a configuration file — is pre‑sold by a 36‑hour weekend no one wants to repeat. The scenario is hypothetical only in the sense that the names are not named: the pattern recurs across cert rotation post‑mortems in financial services, with mobile pinning, vendor SDK lineage and hidden algorithmic assumptions that quietly survive several acquisitions.

A four‑step crypto agility playbook

A low‑friction approach tends to work better than a large, isolated PQC project.

• Build a cryptographic inventory.Identify where cryptography lives — TLS, code signing, IAM, HSMs, mobile apps, third‑party SDKs, internal services. CISA's quantum readiness guidance and NIST's SP 1800‑38 migration project[11] both treat inventory as the prerequisite to everything else. The concept is converging with broader supply‑chain integrity work: a cryptographic bill of materials (CBOM) is, in effect, the cryptography‑specific instance of the SBOM and SLSA frameworks the industry has been formalizing in recent years. The underlying argument is older still — Schneier and others have observed for roughly two decades that cryptographic agility is a more useful operational property than the strength of any single algorithm; PQC has made that observation operationally unavoidable. The Log4Shell scramble of December 2021 illustrated the inventory principle in a non‑cryptographic context: an organization that does not know where a dependency lives cannot defend it, patch it or migrate it. Cryptographic dependencies behave the same way, and they are usually less visible.
• Make algorithm choice configurable.Wrap cryptographic operations behind interfaces so that key management and algorithms can evolve independently of business logic. This single change tends to have the largest payoff and the smallest political cost.
• Test hybrid deployments early.For externally negotiated protocols, classical‑plus‑post‑quantum hybrids reduce interoperability risk and hedge against weaknesses that may yet emerge in new schemes. IETF drafts and ETSI's Quantum‑Safe Cryptography work describe the patterns[12][13][14].
• Tie migration to existing change windows.Certificate rotations, SDK upgrades and HSM refresh cycles already have rehearsed rollback paths. A standalone "crypto modernization" program rarely does, which is one quiet reason such programs stall.

The sequence reduces unknown dependencies, implementation brittleness, and rollout risk together rather than one at a time.

Limitations and applicability

The recommendations above assume a microservices or containerized environment where cryptographic operations can be reasonably wrapped behind interfaces. They do not transfer directly to legacy mainframe environments (COBOL on z/OS, IBM i / AS/400) or to embedded HSM appliances where algorithm choice is fixed in hardware — those cases call for dedicated replacement planning rather than agility retrofits. The gasless guidance that follows assumes EVM‑compatible chains with ERC‑4337 or ERC‑2771 semantics; account abstraction models elsewhere differ enough to warrant their own threat modeling. None of the cost or timing claims here should be read as quantitative predictions; they are qualitative direction informed by current standards and a small number of operational engagements.

Gasless transactions change the trust boundary

Gasless transactions improve onboarding and conversion in Web3 and consumer fintech, but they relocate trust into a new layer. ERC‑4337 introduces account abstraction with bundlers and paymasters; ERC‑2771 supports meta‑transactions through relayers and trusted forwarders. The organization is now sponsoring user activity through an additional service that can be abused if it is not tightly governed.

The risks here are mostly not cryptographic — they are economic abuse, policy drift and availability. The most familiar pattern is also the most mundane: airdrop farming and similar high‑volume automated traffic, in which a sponsored paymaster effectively pays for an attacker's eligibility in someone else's campaign. It usually shows up first in the spend curve, a week or two after a campaign launches — a vertical line in sponsored gas that does not match the real user growth, while the wallet count chart still looks great. Adjacent failure modes include transactions that pass preliminary off‑chain checks but still consume sponsored gas on‑chain, and quiet concentration through a single relayer that becomes a censorship or front‑running surface. Public security audits of major ERC‑4337 implementations keep surfacing similar categories of finding: custom wallet validation logic, stake and deposit handling, and policy that has cleared off‑chain review but was never mirrored on‑chain[15],[16].

For an executive audience, the useful framing is that none of this is exotic. These are the abuse patterns security teams already deal with in payments, API misuse and rate‑limit bypass, moved into a layer that happens to settle on a blockchain.

Controls for gasless operations

Treat sponsorship like any other controlled financial or security service.

• Define sponsorship policy as code.Specify who is sponsored, which contracts and methods are allowed, and what value and rate limits apply.
• Enforce policy in both layers.The off‑chain paymaster service and the on‑chain validation logic should follow the same rules. Drift between the two is a common source of incidents.
• Add quotas and circuit breakers.Per‑user, per‑contract and global daily limits with automatic pause on anomaly contain budget abuse and limit blast radius.
• Build observability from the start.Track sponsored gas spend by user, dApp and relayer; alert on deviations from a rolling baseline; treat the dashboard as a SOC‑grade artifact, not a finance report.
• Audit and keep a degradation path.Independent security review of wallet validation and paymaster logic before launch, and a tested fallback to user‑paid gas if sponsorship fails or becomes unsafe.

These controls address abuse, cost and availability together — the same control logic security teams already apply to payment systems, API gateways and privileged automation.

A board‑level message that holds up

The board‑level question is not whether quantum risk or gasless UX is "good" or "bad." It is whether the organization can adjust trust assumptions safely, on schedule, with measurable controls. That framing avoids reflex panic, and it avoids the opposite mistake of treating migration and sponsorship as one‑time technical tasks instead of ongoing operational disciplines.

A reasonable 90‑day program

A workable plan for the next quarter usually contains the following elements rather than a single conclusive action:

• A cryptographic inventory, ranked by the ten systems with the longest confidentiality lifetimes.
• One externally negotiated protocol piloted on a NIST‑aligned hybrid or migration‑ready configuration.
• Algorithm selection converted to a configurable value in at least one critical service, with an end‑to‑end tested rotation procedure rather than a documented one.
• For gasless products: a written sponsorship policy, enforced in both off‑chain and on‑chain controls, and independently audited before launch.
• Spend dashboards, anomaly alerts and a tested failover path to user‑paid gas.
• A plain‑language briefing for leadership on migration order, gates and operational cost.

Closing observation

What determines outcomes in either case is the underlying capability — being able to change a trust boundary without taking the business offline. It is not a one‑time project but an operating discipline; once it exists, most of the post‑quantum debate becomes scheduling rather than emergency.

Over to readers

Two questions worth opening to discussion. Where is your team finding the biggest surprises in its cryptographic inventory — vendor SDKs, build pipelines, embedded devices, or somewhere less obvious? And for those operating gasless products: where has the sponsorship policy in code first diverged from the policy enforced on‑chain?

Disclosure: the author advises organizations on cryptographic migration and Web3 security architecture. The recommendations above reflect general practice and do not endorse any specific vendor or product.

Sources & references

[1]: National Institute of Standards and Technology (NIST). NIST Releases First 3 Finalized Post-Quantum Encryption Standards (August 2024). https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards

[2]: NIST Post-Quantum Cryptography Project. https://csrc.nist.gov/projects/post-quantum-cryptography

[3]: NIST Post-Quantum Cryptography (PQC) Program Overview. https://www.nist.gov/pqc

[4]: Office of Management and Budget (OMB). M-23-02: Migrating to Post-Quantum Cryptography (Full Memorandum). https://www.whitehouse.gov/wp-content/uploads/2022/11/M-23-02-M-Memo-on-Migrating-to-Post-Quantum-Cryptography.pdf

[5]: National Security Memorandum 10 (NSM-10). Overview and related federal guidance referenced in OMB M-23-02.

[6]: National Security Agency (NSA). Commercial National Security Algorithm Suite 2.0 (CNSA 2.0) and Post-Quantum Cybersecurity Resources. https://www.nsa.gov/Cybersecurity/Post-Quantum-Cybersecurity-Resources/

[7]: Quantum Computing Cybersecurity Preparedness Act. Regulatory framework overview. https://postquantum.com/quantum-policies/us-pqc-regulatory-framework-2026/

[8]: DigiNotar Certificate Authority Compromise. Detailed incident overview and references. https://en.wikipedia.org/wiki/DigiNotar

[9]: Fox-IT. DigiNotar Investigation Report (official technical investigation report). Available through Dutch government archives and referenced incident documentation.

[10]: SHA-1 Deprecation Timeline. Browser and Certificate Authority ecosystem documentation, including Chrome and Firefox security updates following CA trust improvements.

[11]: NIST Special Publication 1800-38. Migration to Post-Quantum Cryptography. https://csrc.nist.gov/pubs/sp/1800/38/iprd-(1)

[12]: Internet Engineering Task Force (IETF). Post-Quantum Cryptography guidance and PQUIP Working Group documents, including hybrid deployment recommendations. https://datatracker.ietf.org/wg/pquip/about/

[13]: European Telecommunications Standards Institute (ETSI). Quantum-Safe Cryptography Research and Standards Activities. https://www.etsi.org/technologies/next-generation-technologies/

[14]: ETSI Technical Specification TS 103 744. Hybrid Key Exchange Mechanisms.

[15]: Trail of Bits. Six Mistakes in ERC-4337 Smart Accounts. Security audit findings and analysis. https://blog.trailofbits.com/2026/03/11/six-mistakes-in-erc-4337-smart-accounts/

[16]: OpenZeppelin Security Audits and Research. Public reports covering access control, signature validation, smart contract security, and state management risks. https://www.openzeppelin.com/security-audits