Organizations across critical industries can now protect their credential security for physical access from quantum threats without having to replace any of their existing physical access control infrastructure they have already invested in. A post-quantum credential layer with a software translation layer can simply be implemented to the existing PACS via a software-only integration, no new reader hardware is necessary as the user’s mobile phone becomes the secure authentication device and each ML-DSA-signed unlock request is verified in the cloud.
Financial services and banking, energy and utilities, data centers, and government, national security and defense are among the sectors facing immediate PQC transition pressure. NIST’s newly finalized transition report supports a 31 December 2031 deadline for U.S. federal high-value assets and high-impact systems to use post-quantum digital signatures. In Europe, the European Commission has set the end of 2030 for critical infrastructure to complete its PQC transition, while the UK’s National Cyber Security Centre (NCSC) expects organizations to finish discovery and migration planning by 2028, complete priority migrations by 2031 and complete the full transition by 2035. Introducing post-quantum credential security for access control addresses an area that might otherwise be overlooked but is essential to perimeter security for critical infrastructure. Moving credential signatures to ML-DSA, the NIST post-quantum signature standard (FIPS 204), prepares for NIST’s deprecation of RSA and elliptic-curve algorithms after 2030.
How do post-quantum mobile credentials work with an existing PACS?
Sentry’s post-quantum mobile credential technology provides advanced protection for mobile credential identity and authentication, with credential signatures in line with NIST FIPS 204 . Delivering post-quantum credential security today while giving organizations the flexibility and freedom to modernize their existing access control systems on their own terms. Sentry secures the credential layer, and the existing PACS keeps the decision layer. A software-based translation layer connects them, a standalone application that runs on a computer between the Sentry Cloud and the PACS converts each post-quantum mobile credential into a credential format your PACS recognizes.
Each access event follows five steps:
- Enroll. The PACS with Sentry Open Credential over IP embedded issues a post-quantum credential to the user’s phone. The private key is generated and stored on the device and never leaves it.
- Tap. The user taps a Sentry Smart Access Tile, a wireless, passive NFC tile mounted beside the door. There’s no reliance on compatible reader hardware. The phone acts as the reader.
- Verify. The unlock request, signed with ML-DSA, travels across Sentry’s post-quantum protected network and is verified by the Sentry Cloud.
- Translate. A standalone translation layer, installed on a computer alongside the PACS, converts the verified credential into a format the PACS already recognizes.
- Decide. The PACS makes the final access decision and logs the event exactly as it does today.
The credential layer is post-quantum protected; the signal handed to the PACS remains conventional. The result is that legacy, weaker signalling is isolated behind a post-quantum, cryptographically verified front end, so credential identity and authentication no longer depend on RSA or elliptic-curve signatures.
Why do critical industries need post-quantum credentials for access control systems now?
Financial services and banking, energy and utilities, data centres, and government, national security and defence face the most urgent pressure. These sectors combine high-consequence physical spaces, long-lived infrastructure and explicit regulatory timelines, so the credential at the door is part of their post-quantum programme now.
In financial services and banking, credentials guard trading floors, vaults and data rooms, where resilience obligations apply and some data must stay confidential for decades. Energy and utilities protect substations, control rooms and remote sites. Data centre customers’ own compliance depends on the operator’s physical controls. Government, national security and defence sites face U.S. federal deadlines of 2030 for key establishment and 2031 for digital signatures.
In each sector, a forged credential is not just a data incident, it is unauthorized access to a space where the consequences are operational, financial or national.
Why are access credentials that use RSA or elliptic-curve cryptography vulnerable to quantum computers?
Quantum computing is expected to break both RSA or elliptic-curve cryptography, so any credential new or old that uses these encryption standards face the risk of being broken and enabling an attacker to create a fraudulent credential that the PACS accepts as real.
The signature is what proves a credential is genuine. If it can be faked, the system trusts the wrong person: the door opens, and the audit log records someone who was never there.
The risk sits in public-key cryptography, which is used to:
- issue and sign credentials
- prove identity at the door
- secure connections between readers, controllers, servers and the cloud
- manage devices, certificates and firmware updates
This creates two threats:
- Forged credentials: once a capable quantum computer exists, any credential still signed with RSA or elliptic-curve cryptography could be faked.
- Harvest now, decrypt later: attackers can collect encrypted data such as access logs today and decrypt it later, revealing who went where and when.
Protect the credential before the deadlines arrive
Credentials for access control are easy to overlook in a post-quantum migration plan because they sit with physical security rather than IT. However, the credential unlock request validation is what the access control systems trust to make the final decision to unlock a door. Moving credential signatures to ML-DSA removes the threat of quantum computing at the credential layer without a full PACS replacement. A post-quantum credential layer protects identity and authentication, while the existing PACS continues to make and log every access decision.
Get in touch to learn more about enrolling post-quantum mobile credentials on your existing access control system.
Frequently Asked Questions
How are standard access credentials breakable by quantum computers?
Standard access credentials use elliptical curve and RSA encryption which is quantum-breakable. Post-quantum mobile credentials use Module-Lattice-Based Digital Signature Algorithm (ML-DSA), designed to resist attacks from future quantum computers.
Do I need to replace my access control system to get post-quantum credentials?
No. A post-quantum mobile credential layer can be added to your existing PACS. A software-based translation layer is required to translate the post-quantum credential to a format the PACS can understand, this is installed on the PACS computer. No new reader hardware is needed, and your PACS keeps making and logging every access decision.
What is ML-DSA?
The Module-Lattice-Based Digital Signature Algorithm (ML-DSA) is the NIST post-quantum digital signature standard, published as FIPS 204. It proves a credential is genuine, like RSA or elliptic-curve signatures do, but it is designed to resist attacks from quantum computers.
What does “harvest now, decrypt later” mean for access credentials?
It means attackers can collect encrypted access data today and decrypt it once quantum computers are powerful enough. For access credentials, that could allow attackers to clone credentials to be able to use in the future.