Transition to post-quantum cryptography Classical asymmetric cryptography is commonly based on the Discrete Logarithm Problem and Integer Factorization, which are known to be solvable with a quantum computer if it has the ability to run Shor's algorithm, or an algorithm that solves these is devised to run on a classical computers.

Nowadays we know this is impossible to come at least in a few decades. But that doesn't imply that a passive eavesdropper gathers key exchange handshake packets where the symmetric key is negotiated. 

The eavesdropper could decrypt the communications associated with these key negotations once the aforementioned quantum computer is built. For example, in the past, cryptosystems that were being used ended up being vulnerable to attacks so a specialized attacker could recover all the stored private information during years.

The evident matter here is that moving to post-quantum cryptographic schemes in the present would stop an attacker in the future to recover private information once conventional asymmetric schemes are broken. I know these schemes are being analyzed right now i.e NIST calling for new post-quantum crypto schemes.



Q1: Is there any institution or government in the present implementing for example NTRU, SIKE or multivariate crypto schemes on their communication establishment to prevent past private information recovery?

Q2: What would be a good estimation on time (i.e years) to move on to these post-quantum cryptographic schemes? I mean, we cannot wait until these attacks are possible on a theoretical capable quantum-computer.
Question #1:

Is there any institution or government in the present implementing for example NTRU, SIKE or multivariate crypto schemes on their communication establishment to prevent past private information recovery?

Answer:

Currently the Open Quantum Safe (OQS) project has been launched to support the development and prototyping of post-quantum cryptography or quantum-resistant cryptography. 

They have implemented liboqs, an open source C library for quantum-resistant cryptographic algorithms based on the selected NIST Round 2 candidates (such as NTRU, SIKE, and MQDSS (which is multivariate crypto scheme) at GitHub repository.

Question #2:

What would be a good estimation on time (i.e years) to move on to these post-quantum cryptographic schemes? I mean, we cannot wait until these attacks are possible on a theoretical capable quantum-computer.

Answer:

(1) The Open Quantum Safe (OQS) project co-leader, Michele Mosca published an article Cybersecurity in an Era with Quantum Computers: Will We Be Ready? in IEEE Security &amp; Privacy (Volume 16, Issue 5, September/October 2018) to "estimate a 1/7 chance of breaking RSA-2048 by 2026 and a 1/2 chance by 2031."

(2) The Closing Remarks of Second PQC Standardization Conference held by NIST in August 2019, NIST PQC Standards - Next Steps states that

“NIST should not be aiming to conclude the process and have standards written by 2022. This is simply too fast to get proper answers.... Much more research is needed.”

(3) NIST will give a presentation at the eighth annual International Cryptographic Module Conference (ICMC20) on April 29, 2020 to report an update on the NIST Post-Quantum Cryptography Standardization process. . 

Towards PQC Standardization—An Update

"As we proceed to the third-round selection, this presentation shares what has been learned in evaluating the first and second round candidates. It addresses some critical issues and discusses transition and migration strategies."