On Oct. 1, the National Security Agency sharpened America’s post-quantum deadline.
asserted
Agency → sharpen → deadline
Beginning in 2027, new commercial National Security Systems must be capable of supporting quantum-resistant algorithms, and legacy systems that cannot do so are to be phased out by 2030.
asserted
that → begin → 2030
That deadline focuses attention on migration.
asserted
deadline → focus → migration
But even a fully migrated system can carry a stale green check mark.
asserted
system → migrate → mark
The cryptography can be current, while the evidence used to approve that configuration is not.
asserted
evidence → use → configuration
Imagine a system that passes its post-quantum test on Monday.
asserted
that → imagine → Monday
On Tuesday, the software changes.
asserted
software → change → Tuesday
On Wednesday, the firmware is updated.
asserted
firmware → update → Wednesday
A trust anchor rotates.
asserted
anchor → rotate → ?
A credential expires.
asserted
credential → expire → ?
A recovery image is replaced.
asserted
image → replace → ?
The next disconnected operating window lasts longer than the one used in the test.
asserted
window → last → test
The harder question is whether it still applies.
asserted
it → apply → ?
Every assurance claim has an evidence applicability lifetime.
uncertain
claim → have → lifetime
It is not a fixed countdown, and there is no universal number of days.
asserted
It → fix → days
Evidence stops supporting a claim when the assumptions that made it relevant materially change.
uncertain
it → stop → claim
President Donald Trump’s June Executive Order 14412 accelerated the federal move to post-quantum cryptography.
asserted
Order → accelerate → cryptography
The Office of Management and Budget has since directed agencies toward dynamic, continuously updated cryptographic inventories and monitoring dashboards.
asserted
Office → direct → dashboards
The Pentagon’s own post-quantum strategy requires its systems to support PQC by the end of 2030 and use it by the end of 2031, while prioritizing mission criticality, interoperability, and testing.
asserted
strategy → require → criticality
The policy is moving toward dynamic inventories.
asserted
policy → move → inventories
The assurance record has to become dynamic too.
asserted
record → have → ?
A constructed research model I developed shows the logic.
asserted
I → construct → logic
In one case, every modeled cryptographic asset has completed migration, and both selected services have supporting evidence.
asserted
services → model → evidence
Make the evidence for one shared dependency stale, without changing the algorithm inventory, and both service claims become “not demonstrated.”
uncertain
claims → make → inventory
Tie the evidence to the wrong configuration, and only the service that depends on it loses support.
asserted
that → tie → support
No operational military system was evaluated; this is a logical counterexample, not a Pentagon finding.
asserted
this → evaluate → ?
Washington should turn that distinction into four practical rules:
First, every consequential test result should carry a scope label.
asserted
result → turn → label
Record the software and firmware versions, cryptographic profile, trust anchors, operating configuration, environment, and time window the evidence actually covers.
asserted
evidence → record → versions
A signed report should not become a lifetime warranty for every later version.
asserted
report → sign → version
Second, define the events that shorten the evidence lifetime.
asserted
that → define → lifetime
A material software change, firmware revision, trust-anchor change, credential expiry, a newly enabled fallback path, or a recovery-path change should trigger an applicability review.
asserted
change → enable → review
That does not mean every patch requires a full retest.
asserted
patch → mean → retest
It means someone has to establish why the earlier evidence still applies instead of assuming that it does.
asserted
it → mean → ?
A component can be “PQC migrated” while the evidence for its current configuration is stale, incomplete, or inapplicable.
asserted
evidence → migrate → configuration
The dashboard should be able to say “migrated, evidence current,” “migrated, evidence review required,” or “not demonstrated.”
asserted
review → say → ?
Missing evidence is not proof of compromise.
asserted
evidence → miss → compromise
A reboot can restore software; it does not automatically restore assurance.
asserted
it → restore → assurance
A recovery image can re-
asserted
image → re → ?
enable cryptography or configuration states that the migration was meant to retire.
asserted
migration → enable → cryptography
Recovery checks should confirm that the restored configuration still meets the current profile before the system returns to full operational status.
asserted
system → confirm → status
…and 12 more, not listed.
The Aporia
